BlueBorne - A New Class of Airborne Attacks that can Remotely Compromise Any Linux/IoT Device
summary
BlueBorne describes an airborne Bluetooth attack class that achieves remote code execution by abusing an L2CAP conf_rsp parsing stack overflow and an information‑leak primitive; two of eight zero‑days are demonstrated and the vulnerabilities impact 5.3 billion devices across Android, Windows, Linux and iOS. Exploits use Ubertooth and a <$1 NRF24 module plus Python tools from GitHub to build large fragmented L2CAP packets, write shellcode or ROP, hijack the kernel’s orderly_power usermode helper for a shell, and successfully compromise Amazon Echo and Samsung Gear devices.
AI-written summary · about
chapters (37)
- 0:00Introduction
- 4:51Why are these attacks so severe
- 5:43Discoverability
- 8:09Software
- 10:49Bluetooth
- 11:53Packet fragmentation
- 13:24L2CAP
- 14:36Mutual Configuration
- 16:09Mutual Configuration Example
- 16:44Negotiation Process
- 19:09Strategy
- 21:13Mitigations
- 22:17Kernel Configuration
- 23:48Samsung Smart Watch
- 24:24Damos Echo
- 25:10Delimited RC
- 26:11Configuration Parameters
- 28:03PTR
- 30:15Overflow ELA
- 32:17Post Exploit
- 33:28Exploit Recap
- 35:00Solara
- 36:56SmartWatch
- 37:21Recap
- 39:17Bluetooth Connection
- 39:38Exploit Script
- 41:04Botnet
- 41:43Health Area
- 42:55Gear
- 44:33WiFi MAC Address
- 46:09Vulnerabilities Fixed
- 46:48Android Devices
- 48:30Industrial Control Systems
- 50:35Undocumented Communication
- 52:03Solution
- 54:01How to build an exploit
- 55:15How to monitor mobile devices
related talks
35mDeep into Android Bluetooth Bug Hunting: New Attack Surfaces and Weak Code Patterns
47mBLEEDINGBIT: Your APs Belong to Us
18mBluetooth Security Testing with BlueToolkit: a Large-Scale Automotive Case Study
25mSweynTooth: Unleashing Mayhem over Bluetooth Low Energy
40mPerfektBlue: Universal 1-click Exploit to Pwn Automotive Industry…
24mAttacking Bluetooth LE Design and Implementation in Mobile + Wearables Ecosystems
37mHi, My Name Is Keyboard
01h 10mAttacking IoT Telemetry