In August 2019, CVE (Common Vulnerabilities & Exposures, Common Vulnerabilities and Disclosures) updated a Bluetooth vulnerability KNOB (Key-Negotiation-of-Bluetooth) code-named CVE-2019-9506, with a CVSS score of 9.3. The vulnerability was discovered by researcher Daniele Antonioli of Singapore SUTD, Dr Nils Ole Tippenhauer of CISPA, Germany, and Professor Kasper Rasmussen of the University of Oxford, UK. The vulnerability spans the Bluetooth BR/EDR Bluetooth Core Specification version 1.0 to 5.1, affecting more than 100,000 units. Bluetooth devices, including smartphones, laptops, IoT devices, and industrial equipment. In today’s post, we shall be discussing how safe is bitcoin Hardware-wallet for Bluetooth transmission.
The Importance of Bluetooth Protocol to Compatible Devices
The introduction and popularization of the Bluetooth protocol have a history of 25 years. From the audio transmission, graphic transmission, video transmission, to Internet transmission with low power consumption as the main application, Bluetooth is used widely.
In addition, many hardware wallets at home and abroad also use Bluetooth technology to complete the hot and cold side of information transmission. So, does KNOB pose a threat to these hardware wallets?
Bitcoin Hardware-Wallet for Bluetooth Transmission Security and Vulnerability
Let’s dissect the Bluetooth vulnerability KNOB for everyone! First, let’s have a brief understanding of the types of Bluetooth:
This knob/protocol is suitable for short-distance (within 10 meters) continuous wireless connection. Such connections as transferring pictures from mobile phone A to mobile phone B, Bluetooth headphones to listen to songs, etc falls under this category.
For security reasons, two Bluetooth BR/EDR devices can negotiate an entropy value of 1-16 bytes as the encryption key when pairing for a secure connection. A larger entropy value means more security.
The KNOB vulnerability appeared during the entropy negotiation of traditional Bluetooth (BR / EDR) devices.
After research, it is found that the process of entropy negotiation uses the LMP protocol (Link Manager Protocol), which is neither encrypted nor verified, so it can be used for attack and operation by OTA.
The specific process of LMP Knob Attack:
The KNOB vulnerability allows an attacker to spoof two target devices to agree to set the entropy value of the encryption key to 1 byte, which can easily brute force the negotiated encryption key.
Summary of the Necessary Conditions for KNOB Attacks
- First off, both devices must be Bluetooth BR / EDR devices, and there is a KNOB vulnerability;
- The attacker needs to be within the physical range of the device’s connection;
- Since the entropy negotiation needs to happen every time encryption is enabled, and the time window of the attack is very small, the attacker needs to repeat the attack very quickly;
After understanding the principle of KNOB, you will agree with me that the Bluetooth hardware wallet is still relatively safe because it is really difficult to meet the attack conditions.
Cause for Concern
However, like all wireless technologies, Bluetooth communication is vulnerable to a variety of threats. Because Bluetooth technology uses a variety of chipset, operating system, and physical device configurations.
All of these involve a large number of different secure programming interfaces and default settings. These complications increase the likelihood and impact of Bluetooth attacks. Attackers can use this vulnerability to monitor and manipulate data transmitted between two devices, which can lead to the leakage and tracking of personally identifiable and sensitive information.
Especially Relevant: Will Bitcoin be overtaken? These are the reasons why the answer is no
Suggestions to Secure Your Bluetooth Hardware Wallet:
1. Before purchasing a Bluetooth hardware wallet, confirm the Bluetooth type and version of the device, and avoid versions with a history of vulnerabilities;
2. Try not to use the Bluetooth hardware wallet in public places and crowded scenes;
3. When the device is not in use, please keep the Bluetooth function off;
4. You can consider a hardware wallet with two-dimensional code for data transmission, which is more secure and transparent.