We're in the middle of a trend right now where more and more OEMs are removing the 3.5mm headphone port. Even Samsung has shed away many of the features that once made the Galaxy Note series so desireable and the 3.5mm headphone port is its latest casualty. This has increased the momentum Bluetooth has had even more and that redirects attention back towards Bluetooth as a desireable attack vector for bad actors. The latest exploit in the Bluetooth specification is called the KNOB (Key Negotiation of Bluetooth) Attack and Android devices that haven't installed August 2019's security update are vulnerable.

This particular exploit has actually been around for a while, as the security researchers were sharing details of the vulnerability to the Bluetooth Special Interest Group (Bluetooth SIG) back in November of last year, before disclosing the vulnerability publicly. This team, which consists of Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen, says the KNOB Attack is possible on "any standard-compliant Bluetooth device", indicating that the exploit has a very wide ambit. The team conducted its test on 17 unique Bluetooth chips (used across 24 different devices) from companies including Broadcom, Qualcomm, Apple, Intel, and Chicony manufacturers.

The results showed that all devices they tested were vulnerable to this attack. The KNOB Attack itself breaks the security mechanisms of Bluetooth and is then able to listen to or change the content of nearby Bluetooth communications. This attack can even do this between existing device connections which were already established before the attack was successful. This is possible because the Bluetooth spec includes an encryption key negotiation protocol that allows negotiating encryption keys with 1 byte of entropy without protecting the integrity of the negotiation process.

Because of this specific encryption key negotiation protocol, the remote attacker can then manipulate the entropy negotiation to let any standard-compliant Bluetooth device negotiate encryption keys with just 1 byte of entropy. This results in the attacker having the ability to brute force the low entropy keys in real-time, as it significantly reduces the total number of possible keys to try out.

As mentioned, every device with Bluetooth that hasn't received the August 2019 Android security patch (which includes this particular fix - CVE-2019-9506) is vulnerable. For this particular reason, you may see several Android OEMs being concerned about rolling out this patch for as many devices as possible.

Source: KNOB Attack