BleedingBit: The hidden attack surface within BLE chips [pdf]
go.armis.com
go.armis.com
For that that might not know, Ti the approach that some others (not Nordic) does where they give you an ARM Cortex M4 to put your code on and have another Cortex M0 that runs the ROM based BLE Stack. This drove me away from many of the Ti offerings because while you can't mess them up, the BLE Stack is typically not upgradable. With the launch of BLE 5 and it's mainly software upgrades it was important to us to have that ability. So here is an issue with the shared que between the two chips - I'm not sure if this will be patch-able all applications.
The hack to get console on the Aruba device is pretty cool.
They are doing great stuff
So... it gets its own ram, rom, and you can’t (not supposed to anyhow) access it. So... no, to answer your question, but depends on what you are trying to prevent I guess.
You don’t need to run the softdevice at all, can shut off it down temporarily like while doing some crypto work, but if there was an exploit it seems like it could be bad because the SD seems like it can probably do anything your code could plus some. Additionally with the ‘software interrupt’ peripheral it seems it has a built-in way to branch to any arbitrary code location.
However... there is a gambling application that uses one and the code has been through a couple audits as I was told.
Bluetooth seems to be quite hard to secure (or am I mistaken?), is there any decent (simpler) alternative available or on the horizon that could become ubiquitius?
Are they security researchers or posers?
Security researcher B hires a designer, makes a logo, catchy name and a website and it gets upvotes on HN and Reddit and media picks it up and the whole world gets a day-worth of drama from it, emergency meetings are held and things get fixed.