Bluetooth Vulnerability Makes Spying Easy
Bluetooth is one of the weakest links that opens doors for attacks. A newly discovered vulnerability in Bluetooth enables bad actors to spy on data flowing between two devices.
According to the Hacker News, “The vulnerability, assigned as CVE-2019-9506, resides in the way 'encryption key negotiation protocol' lets two Bluetooth BR/EDR devices choose an entropy value for encryption keys while pairing to secure their connection.”
The vulnerability exposes billions of smartphones, laptops, and industrial devices.
There is nothing users can do to protect themselves at this time. According to an advisory by Carnegie Mellon University, Bluetooth host and controller suppliers should refer to the Bluetooth SIG's "Expedited Errata Correction 11838" for guidance on updating their products. Downstream vendors should refer to their suppliers for updates.
