Is Your Bluetooth Chip Leaking Secrets via RF Signals?
semanticscholar.org
semanticscholar.org
(To be clear, I trust the iMessage protocol with reasonable confidence. I judge the probability that Apple has applied this extra layer of security uniformly to all sensitive data to be about 8%.)
iMessage... the golden standard for 1click RCE. /s
They're on an proprietary extension of Bluetooth, standard compatible but closed to their devices. They usually don't talk much about it, Phil Schiller was the most explicit I think (it was about the airpod's W1 but it's the same deal)
https://www.theverge.com/2016/9/7/12829190/apple-w1-chip-iph...
> Apple’s Phil Schiller described Apple’s move to a new wireless chip as “fixing the challenges” of wireless audio
I'm more concerned about card readers, medical devices, etc.
The only thing making these kinds of attacks unattractive is that most companies are too stingy to buy anything better than a cheap wired Logitech keyboard
[1] https://en.wikipedia.org/wiki/Bluetooth#Specifications_and_f...
It does solve this by having a different topology. It supports a configurable number of streams in each direction, so at least in theory 5.2 surround with a stereo microphone should be possible, we'll see if it's usable
It also supports what is often called 'true wireless' earbuds by default, as each audio sink can stream only the channel it's interested in.
Finally there's all that broadcasting stuff, which works fine in our tests most of the time but also with a myriad of issues, some of them in the spec, others in the Android implementation, which is currently the de facto target to support
It's been so terribly bad since it came out. You know it's bad when there's even an xkcd about it: this one is from 5 years ago, joking about 10 years before that. https://xkcd.com/2055/
Sigh, side channel attacks seem to be everywhere now.
Now, I know that pretty much every Bluetooth based credit card reading device explicitly defends against a channel such as this, but there are tons of access control solutions, and medical devices that don’t
Would you notice a raspberry pi tucked into the mess of wires beneath the security guard guards desk?
Every Zigbee device uses AES keys to secure the network, although the security of the protocol is pretty weak in most deployments, especially when new devices join the network. Leaking the network key would provide access to the entire network. The ARM Cortex-M4 is often used, which the side-channel attack in the article is about.