New BlueBorne Malware Hacks smartphone in seconds

A single infected device moving through a busy office past dozens of people with phones, tablets, or computers. With Bluetooth switched on could cause BlueBorne rapid infection across networks leading to network infiltration, ransomware attacks, or data theft.

Apple is adding more features in iOS 11

A security company Armis has found a collection of eight exploits. Collectively called BlueBorne that can allow an attacker access to your phone without touching it. The attack can allow access to computers and phones, as well as IoT devices.

Bluetooth Network Encapsulation Protocol

The more serious flaws allow an attacker to gain control of affected devices and their data, and steal sensitive business data from corporate networks. To launch an attack, malware can connect to a target device and remotely execute code on the phone, tablet, computer, or smart device, which lets the malware spread further to other devices. The complex vector begins by finding a device to hack. This includes forcing the device to give up information about itself. Ultimately, release keys and passwords exploit that forced many web servers to display passwords and other keys remotely.

The next step a set of code executions allows for full control of the device. This vulnerability resides in the Bluetooth Network Encapsulation Protocol BNEP service, which enables internet sharing over a Bluetooth connection tethering. Moreover, due to a flaw in the BNEP service, a hacker can trigger a surgical memory corruption. It is easy to exploit and enables him to run code on the device. Effectively granting him complete control, write the researchers.

[td_block_video_youtube playlist_title="" playlist_yt="Az-l90RCns8" playlist_auto_play="0"]

Man-in-the-Middle attack

Moreover, the majority of Android phones, tablets, and wearables except devices only with Bluetooth Low Energy are vulnerable to two memory corruption-based remote code execution flaws, an information leak bug, and a data intercepting man-in-the-middle attack. Meanwhile, Windows machines with Bluetooth are also at risk of a vulnerability that lets an attacker invisibly intercepting or rerouting wireless traffic by creating a malicious networking interface on the device. Several companies, including software and device makers, were notified of the vulnerabilities in April and have since rolled out patches. The majority of newer phones, tablets, and some computers already fixed.

Further, the undetectable flaws, said researchers, put the majority of devices around the world at risk at least 5.3 billion devices including Windows, Android, Linux, and Apple devices. While the vulnerabilities vary by severity and platform, the worst affected are Android devices, and older iPhones and iPads.

Google is patching Android 4.4.4 KitKat and later, leaving fewer than one-in-ten older Android devices without the patches. A Google spokesperson said the company "will continue working with other affected platforms across the industry. To develop protections that help keep users safe."

Microsoft said in an emailed statement that it patched its Windows-focused vulnerability back in July, but withheld disclosure until other vendors could develop and release updates." Windows Phones are not affected.

Upcoming Apple Watch to have LTE cell service

However, those who are affected but can"t get patches are advised to leave Bluetooth switched off. Part of the blame for these flaws falls on how device makers have implemented the overly complex Bluetooth protocol across devices over the years, which is where many of the weak spots are found.