BrakTooth Vulnerability Puts Bluetooth Users At Risk, Flaws Left Unpatched

White Hat hackers revealed a set of vulnerabilities named as BrakTooth, which affects commercial bluetooth gadgets, raising suspicions about vendor’s intent to fix the flaws. Automated Systems Security (ASSET) Research Group at Singapore University of Technology and Design said that they released BrakTooth, “a family of 16 new security vulnerabilities (20+ CVEs) in commercial Bluetooth Classic (BR/EDR) stacks that range from denial of service (DoS) via firmware crashes and deadlocks in commodity hardware to arbitrary code execution (ACE).

“The team has shown off arbitrary code execution on an ESP32 microcontroller, commonly found in Internet of Things (IoT) devices which are rarely if ever updated by their manufacturers, denial of service attacks against laptops and smartphones with the Intel AX200 and Qualcomm WCN3390 chips, and the ability to freeze or shut down headphones and other Bluetooth audio devices,”said the Register. It said BrakTooth affects major SoC (System on Chip) vendors like Qualcomm, Intel, Texas Instruments, Silicon Labs, Infeneon and others.

BrakTooth represents around 1400 commercial products including Microsoft Surface Pro 7, Surface Laptop 3, Surface Book 3, and Surface Go 2, and Volvo FH infotainment systems which threaten to leak “fundamental attack vectors in the closed BT [Bluetooth] stack.” 

This is not the first time that the group has made such claims, earlier, ASSET was behind the SweynTooth vulnerabilities in 2020. Vendors have been informed about the sixteen vulnerabilities, however, the feedbacks recieved vary. 

“Espressif, whose popular ESP32 microcontroller family was affected, was one of the first to release a patch closing the holes, along with Bluetrum Technology and Infineon. Intel, Actions, and Zhuhai Jieli Technology have confirmed they are either investigating the flaws or actively developing patches. Harman International and SiLabs, by contrast, “hardly communicated with the team,” the researchers claimed, “and the status of their investigation is unclear at best,” reports the Register. 

Qualcomm and Texas Instruments had it worse, latter said that it won’t release the patches until the customers demand so, and the former is only patching few parts even though unpatched chips appear in brand new products releasing across the world.