Hacker News Reader

Comment by TheAceOfHearts | Hacker News Reader

Haven't watched the video yet, but I think this capability was leaked by VP Kamala Harris during her recent interview with the Late Night Show [0]. She stated she doesn't use wireless headphones because she's been in security meetings and knows they're not safe.

[0] https://youtu.be/BD8Nf09z_38 (Timestamp 18:40)

View on HN

Disclaimer: This comment is not intended to be political - I don't care about the specific party she's part of.

Out of all the people I would trust on the matter, Kamala Harris doesn't certainly end up at the top of my list, for reasons such as this one: https://youtu.be/O2SLyBL2kdM?si=Zq-EN8zxj4Y_UCwI

You also don't need to be in classified meetings to understand that Bluetooth/ BLE (and specifically the way most vendors implement the spec) is not as secure as other more battle-tested technologies

I think many people would be justified in making the argument that bluetooth has existed for at least 20 years and thus is the established battle tested protocol.

Yeah, but Bluetooth spec changed a lot over the years (3000+ pages) and the certification price is rather expensive.

There's an interesting article from Wired [1] about this, although some interesting comments from the engineers working on BT stacks are far more interesting. It seems like most of the manufacturers do not create spec-compliant devices, and that the tests from the certification are just poor.

I'd love to hear more from an expert on the topic, but this looks to be the consensus.

[1]: https://archive.ph/6201V

I'm by no means an expert, but I've recently implemented a small BLE based IoT device, and had a look at the security/privacy of a medical BLE device.

Some points:

* there's a real lack of quality, up-to-date documentation. I would have thought that at least on Linux you'd find some documentation, but most of it seems to be "RTFS".

* BLE is in general very unfamiliar to most developers. There's no client and server, there's central and peripheral. GATT profiles are a mix between TCP connections and binary REST-ish interface.

* Encryption/authentication is possible, but depending on the manufacturer's API/quality of documentation it's not really apparent a. how to select a secure connection method b. how to even check if and which authentication/encryption was chosen

* Coming from the previous point, many BLE devices have the same generic GATT profiles, sometimes with the same sample data. This looks like a lot of BLE devices just copy&pasted sample code from the manufacturer and added the minimal changes "to make it work"

* It's probably really easy to do passive/active fingerprinting to find out the manufacturer and/or chip version used in a device. Default services, ordering of advertising options etc

* Many BLE devices are not conformant. Uninitialised name fields with garbage in them ("Device Name: WHOOP\020��=u5״\023n"), manufacturers using random identifiers that clearly don't belong to them

* when doing passive BLE sniffing: the biggest obstacle isn't getting data. It's how to filter it. One of the most useful filters of the nRF Connect app for android is to filter out all advertisement packages for apple and ms devices, to cut down the overwhelming amount of such devices

I think people are generally aware of how low quality the Bluetooth protocol suite is though so maybe they'd guess that extends to security too.

I definitely remember lots of folk security advice to keep bluetooth off on your phone back when smartphones were new (nobody does that now though, and Android auto-enables it these days).

What she says isn't necessary untrue, now is it? She just skips a lot of steps most people have no clue about.

I had files in a cabinet, now they are digital. And most often also on a cloud drive, which is metaphysical in some sense. For most it is indistinguishable from magic.

It's essentially a statement about the view of gov security, not about the view of an individual.

> doesn't certainly end up at the top of my list

There hasn't been a POTUS or VPOTUS with a technical background in the last 45 years (Jimmy Carter was a nuclear engineer). So obviously none of them would be authoritative on such topics.

However the individual in question is not delusional or conspiratorial, and we know for sure that they are receiving advice or restrictions from extremely well-informed sources, so there's every reason to believe they are (lo-fi) repeating that.

>There hasn't been a POTUS or VPOTUS with a technical background in the last 45 years (Jimmy Carter was a nuclear engineer). So obviously none of them would be authoritative on such topics.

Jimmy Carter was a very smart guy, but he was not a nuclear engineer.

https://atomicinsights.com/jimmy-carter-never-served-nuclear...

Interesting, it looks more complicated than I realized. "Nuclear engineer" might be too colloqualized, a la "software engineer". (perish the thought!)

But he was an engineer who was trained to operate nuclear facilities on subs. With a few more months of service he would have qualified for the label "nuclear engineer" without any asterisks.

And what even was a "nuclear engineer" in the early 1950s? The field was new enough that the titles were probably not well settled.

Tha National Academy of Engineering says:

> A graduate of the U.S. Naval Academy and a trained nuclear engineer

https://www.nae.edu/19579/31222/20054/327746/331204/Jimmy-Ca...

US Navy history says:

> He served as executive officer, engineering officer, and electronics repair officer on the submarine SSK-1. When Admiral Hyman G. Rickover (then a captain) started his program to create nuclear-powered submarines, Carter wanted to join the program and was interviewed and selected by Rickover. Carter was promoted to lieutenant and from 3 November 1952 to 1 March 1953, he served on temporary duty with the Naval Reactors Branch, U.S. Atomic Energy Commission, Washington, D.C., to assist "in the design and development of nuclear propulsion plants for naval vessels."

> From 1 March to 8 October 1953, Carter was preparing to become the engineering officer for USS Seawolf (SSN-575), one of the first submarines to operate on atomic power. However, when his father died in July 1953, Carter resigned from the Navy and returned to Georgia to manage his family interests.

https://www.history.navy.mil/browse-by-topic/people/presiden...

It's not "complicated", Jimmy Carter was not a nuclear engineer.

He was an engineer who worked on nuclear things. Hand-picked by Rickover for work on the project.

I'm going with "functionally pretty darn close", and the details are a bit ambiguous and/or complicated.

You can persist in whatever version of it you prefer, however, it is no interest of mine.

you have a tracking "si=..." parameter in the youtube link

Too late to edit. I missed that, sorry!

It isn't about trust. There's no need to trust Kamala Harris in order to heed "wireless headphones probably have a legitimate security risk." And we know that even if she's a complete moron in this topic area, she's advised by people who should know. Even if you put no stock in her opinion, there is zero security downside (and an awful lot of common sense benefit) to additional caution.

Even before this report, I had a vague feeling that there were probably some security issues with BT headsets, and now it's confirmed in a very concrete way. So whether she is stupid or not, Kamala was right about this.

Regular Bluetooth security is not that great. A lot of it is poor usability where the user can't easily know that they don't have a secure connection. Setting up a secure connection might involve entering a PIN on each end of the connection which might be challenging for something like a pair of earbuds. This contains a nice discussion of the issues and talks about active attacks:

* https://arxiv.org/pdf/2108.07190

I guess what she was trying to say is "Anything wireless is bad in term of security". We don't really know whether the bad guy already has technology to decode wireless protocol we are going to use, so it's best to assume they already have and reduce the attack surface for them.

There is little encryption being done by bluetooth, while wifi, many layers add their own encryption to the data.

> this capability was leaked

I think the policy Harris is referring to is based on the _risk_ of something like this - it is easy to imagine wireless devices being vulnerable and enabling this capability - rather than being based on definitive existence of this capability.

The government also doesn't let people conduct sensitive or classified conversations over un-certified protocols or devices. Unless the NSA was participating in the bluetooth encryption standards decisions they aren't going to allow those devices to be used by the President or VP. IMHO though, it's probably more that there were security trade-offs made when developing the standards and the government isn't OK with those types of trade-offs. It doesn't mean they're horrible, just that they aren't verified to be secure enough for sensitive governmental purposes.

It seems this vuln was already publicized in june, or is that interview from earlier?

My brother [0] is a state judge whom uses a typewriter specifically for OpSec.

Because he also knows a thing or two about technology. His agency won't even allow him use an iPhone (for official business).

[0] Dude is decades away from retirement, not even close to "Boomer"

Reply on news.ycombinator.com