Register for your free TechRepublic membership or if you are already a member, sign in using your preferred method below.

We recently updated our Terms and Conditions for TechRepublic Premium. By clicking continue, you agree to these updated terms.

Invalid email/username and password combination supplied.

An email has been sent to you with instructions on how to reset your password.

By registering, you agree to the Terms of Use and acknowledge the data practices outlined in the Privacy Policy.

You will also receive a complimentary subscription to TechRepublic's News and Special Offers newsletter and the Top Story of the Day newsletter. You may unsubscribe from these newsletters at any time.

All fields are required. Username must be unique. Password must be a minimum of 6 characters and have any 3 of the 4 items: a number (0 through 9), a special character (such as !, $, #, %), an uppercase character (A through Z) or a lowercase (a through z) character (no spaces).

Vulnerabilities found in Bluetooth Low Energy gives hackers access to numerous devices

Your email has been sent

NCC Group has found proof of concept that BLE devices can be exploited from anywhere on the planet.

A critical flaw found in Bluetooth Low Energy (BLE) receivers may grant cyber criminals entry to anything from personal devices, such as phones or laptops, to even cars and houses. The new findings from cybersecurity company NCC Group detail how BLE uses proximity to authenticate that the user is near the device. This has been able to be faked as part of the research, which could affect everyone from the average consumer to organizations seeking to lock the doors to their premises.

This issue is believed to be something that can’t be easily patched over or just an error in Bluetooth specification. This exploit could affect millions of people, as BLE-based proximity authentication was not originally designed for use in critical systems such as locking mechanisms in smart locks, according to NCC Group.

“What makes this powerful is not only that we can convince a Bluetooth device that we are near it—even from hundreds of miles away—but that we can do it even when the vendor has taken defensive mitigations like encryption and latency bounding to theoretically protect these communications from attackers at a distance,” said Sultan Qasim Khan, Principal Security Consultant and Researcher at NCC Group. “All it takes is 10 seconds—and these exploits can be repeated endlessly.”

To start, the cybersecurity company points out that any product relying on a trusted BLE connection is vulnerable to attacks from anywhere in the world at any given time.

To quote NCC Group’s findings, “by forwarding data from the baseband at the link layer, the hack gets past known relay attack protections, including encrypted BLE communications, because it circumvents upper layers of the Bluetooth stack and the need to decrypt.”

These Bluetooth systems are used to lock items such as vehicles or residences that are using Bluetooth proximity authentication mechanisms that can be easily broken with cheap off-the-shelf hardware, according to the cybersecurity company. As a proof of concept, it was found by Khan that a link layer relay attack conclusively defeats existing applications of BLE-based proximity authentication. This was found to affect the following devices:

One of the specified vehicles known to be affected by this exploit are the Tesla Models 3 and Y.

“This research circumvents typical countermeasures against remote adversarial vehicle unlocking, and changes the way engineers and consumers alike need to think about the security of Bluetooth Low Energy communications,” Khan added. “It’s not a good idea to trade security for convenience—we need better safeguards against such attacks.”

SEE: Mobile device security policy (TechRepublic Premium)

To assist users with avoiding being the next victims of the BLE and its shortcomings, NCC Group offers the following three tips:

Since the bug can be exploited from anywhere, it is crucial that users find out which of their devices uses BLE technology and disable it or at least restrict passive unlocking. For manufacturers and system makers, it could be crucial to rethink which pieces of technology are being used to unlock devices and potentially stop producing items with BLE technology since it can be easily exploited.

Strengthen your organization's IT security defenses by keeping abreast of the latest cybersecurity news, solutions, and best practices.

Vulnerabilities found in Bluetooth Low Energy gives hackers access to numerous devices

Your email has been sent

Your message has been sent

TechRepublic Premium content helps you solve your toughest IT issues and jump-start your career or next project.

The technologies could enable immersive experiences, accelerated AI automation and optimized technologist delivery in the next two to 10 years, according to the firm.

Are you an IT manager or executive trying to make the case for a new ERP vendor? Compare the top ERP software solutions with our list today.

Learn about the new features available with macOS 13 and how to download and install the latest version of Apple’s flagship operating system.

Get great deals on developer and Linux training courses, Microsoft Office licenses and more through these TechRepublic Academy offerings.

This comprehensive guide covers the use of services from multiple cloud vendors, including the benefits businesses gain and the challenges IT teams face when using multicloud.

Recruiting a Scrum Master with the right combination of technical expertise and experience will require a comprehensive screening process. This hiring kit provides a customizable framework your business can use to find, recruit and ultimately hire the right person for the job. This hiring kit from TechRepublic Premium includes a job description, sample interview questions ...

Knowing the terminology associated with Web 3.0 is going to be vital to every IT administrator, developer, network engineer, manager and decision maker in business. This quick glossary will introduce and explain concepts and terms vital to understanding Web 3.0 and the technology that drives and supports it.

While the perfect color palette or the most sublime button shading or myriad of other design features play an important role in any product’s success, user interface design is not enough. Customer engagement and retention requires a strategic plan that attempts to measure, quantify and ultimately create a complete satisfying user experience on both an ...

IIoT software assists manufacturers and other industrial operations with configuring, managing and monitoring connected devices. A good IoT solution requires capabilities ranging from designing and delivering connected products to collecting and analyzing system data once in the field. Each IIoT use case has its own diverse set of requirements, but there are key capabilities and ...