The Armis Lab has discovered a new vector attack affecting all devices with Bluetooth enabled including Linux and IoT systems.
Armis has disclosed two vulnerabilities in the Linux operating system which allow attackers to take complete control over infected devices. The first is an information leak vulnerability, which can help the attacker determine the exact version used by the targeted device and adjust his exploit accordingly. The second is a stack overflow with can lead to full control of a device.
For instance all devices with Bluetooth enabled should be marked as malicious. The infected devices will create a malicious network allowing the attacker to take control of all device out of its Bluetooth range. Using the Bluetooth on Linux system to connect a peripheral devices (keyboards, mice, headphones, etc.) put the Linux under a various risks.
This attack does not require any user interaction, authentication or pairing, making it also practically invisible.
All Linux devices running BlueZ are affected by the information leak vulnerability (CVE-2017-1000250).
All my Linux OS with Bluetooth enabled are marked as vulnerable after a check with the BlueBorne Vulnerability Scanner (Android application by Armis to discover the vulnerable device require to enable the device discovery, but the attack just require only the Bluetooth to be enabled).
Is there a way to mitigate the BlueBorne attack when using Bluetooth on a Linux system?