Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
BlueBorne (security vulnerability)
open-in-new
<h2 id="history">History</h2> <p>The BlueBorne security vulnerabilities were first reported by Armis, the asset intelligence cybersecurity company, on 12 September 2017.<a class="footnote-ref" id="fnref:10" href="#fn:10"><sup>10</sup></a> </p> <h2 id="technical-information">Technical Information</h2> <p>The BlueBorne vulnerabilities are a set of 8 separate vulnerabilities.<a class="footnote-ref" id="fnref:11" href="#fn:11"><sup>11</sup></a> They can be broken down into groups based upon platform and type. There were vulnerabilities found in the Bluetooth code of the Android, iOS, Linux and Windows platforms:<a class="footnote-ref" id="fnref:12" href="#fn:12"><sup>12</sup></a> </p> <ul><li>Linux kernel RCE vulnerability - CVE-2017-1000251<a class="footnote-ref" id="fnref:13" href="#fn:13"><sup>13</sup></a></li> <li>Linux Bluetooth stack (BlueZ) information Leak vulnerability - CVE-2017-1000250<a class="footnote-ref" id="fnref:14" href="#fn:14"><sup>14</sup></a></li> <li>Android information Leak vulnerability - CVE-2017-0785<a class="footnote-ref" id="fnref:15" href="#fn:15"><sup>15</sup></a></li> <li>Android RCE vulnerability #1 - CVE-2017-0781<a class="footnote-ref" id="fnref:16" href="#fn:16"><sup>16</sup></a></li> <li>Android RCE vulnerability #2 - CVE-2017-0782<a class="footnote-ref" id="fnref:17" href="#fn:17"><sup>17</sup></a></li> <li>The Bluetooth Pineapple in Android - Logical Flaw CVE-2017-0783<a class="footnote-ref" id="fnref:18" href="#fn:18"><sup>18</sup></a></li> <li>The Bluetooth Pineapple in Windows - Logical Flaw CVE-2017-8628<a class="footnote-ref" id="fnref:19" href="#fn:19"><sup>19</sup></a></li> <li>Apple Low Energy Audio Protocol RCE vulnerability - CVE-2017-14315<a class="footnote-ref" id="fnref:20" href="#fn:20"><sup>20</sup></a></li></ul> <p>The vulnerabilities are a mixture of <a href="/facts/Information_leakage/QLp4vJBd">information leak</a> vulnerabilities, <a href="/facts/Remote_code_execution/zwnFfLRw">remote code execution</a> vulnerability or logical flaw vulnerabilities. The Apple iOS vulnerability was a remote code execution vulnerability due to the implementation of LEAP (Low Energy Audio Protocol). This vulnerability was only present in older versions of the Apple iOS.<a class="footnote-ref" id="fnref:21" href="#fn:21"><sup>21</sup></a> </p> <h2 id="impact">Impact</h2> <p>In 2017, BlueBorne was estimated to potentially affect all the 8.2 billion Bluetooth devices worldwide,<a class="footnote-ref" id="fnref:22" href="#fn:22"><sup>22</sup></a> although they clarify that 5.3 billion Bluetooth devices are at risk.<a class="footnote-ref" id="fnref:23" href="#fn:23"><sup>23</sup></a> Many devices are affected, including <a href="/facts/Laptop/3EFwTAb2">laptops</a>, <a href="/facts/Autonomous_car/KXeFywXS">smart cars</a>, <a href="/facts/Smartphone/cSIrBMWG">smartphones</a> and <a href="/facts/Wearable_technology/HBSY4P0x">wearable gadgets</a>.<a class="footnote-ref" id="fnref:24" href="#fn:24"><sup>24</sup></a><a class="footnote-ref" id="fnref:25" href="#fn:25"><sup>25</sup></a><a class="footnote-ref" id="fnref:26" href="#fn:26"><sup>26</sup></a><a class="footnote-ref" id="fnref:27" href="#fn:27"><sup>27</sup></a><a class="footnote-ref" id="fnref:28" href="#fn:28"><sup>28</sup></a> </p><p>In 2018, after one year after the original disclosure, Armis estimated that over 2 billion devices were still vulnerable.<a class="footnote-ref" id="fnref:29" href="#fn:29"><sup>29</sup></a><a class="footnote-ref" id="fnref:30" href="#fn:30"><sup>30</sup></a> </p> <h2 id="mitigation">Mitigation</h2> <p>Google provides a BlueBorne vulnerability scanner from Armis for <a href="/facts/Android_(operating_system)/nNyHb0xz">Android</a>.<a class="footnote-ref" id="fnref:31" href="#fn:31"><sup>31</sup></a> Procedures to help protect devices from the BlueBorne security vulnerabilities were reported by September 2017.<a class="footnote-ref" id="fnref:32" href="#fn:32"><sup>32</sup></a><a class="footnote-ref" id="fnref:33" href="#fn:33"><sup>33</sup></a><a class="footnote-ref" id="fnref:34" href="#fn:34"><sup>34</sup></a>[<i>needs update</i>] </p> <h2 id="external-links">External links</h2> <ul><li><a href="https://www.armis.com/blueborne/">Official website</a></li></ul> <h2 id="references">References</h2> <ol> <li id="fn:1"><p>Staff (12 September 2017). "The Attack Vector "BlueBorne" Exposes Almost Every Connected Device". Armis.com. Retrieved 5 January 2018. <a href="https://www.armis.com/blueborne/" target="_blank">https://www.armis.com/blueborne/</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li> <li id="fn:2"><p>Staff (12 September 2017). "BlueBorne - Protecting the Enterprise from BlueBorne" (PDF). Armis.com. Archived from the original (PDF) on 20 December 2017. Retrieved 5 January 2018. <a href="https://web.archive.org/web/20171220084324/http://go.armis.com/hubfs/BlueBorne%20Technical%20White%20Paper.pdf" target="_blank">https://web.archive.org/web/20171220084324/http://go.armis.com/hubfs/BlueBorne%20Technical%20White%20Paper.pdf</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li> <li id="fn:3"><p>Biggs, Jpohn (12 September 2017). "New Bluetooth vulnerability can hack a phone in 10 seconds". TechCrunch. Retrieved 5 January 2018. <a href="https://techcrunch.com/2017/09/12/new-bluetooth-vulnerability-can-hack-a-phone-in-ten-seconds/" target="_blank">https://techcrunch.com/2017/09/12/new-bluetooth-vulnerability-can-hack-a-phone-in-ten-seconds/</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li> <li id="fn:4"><p>Staff (12 September 2017). "The Attack Vector "BlueBorne" Exposes Almost Every Connected Device". Armis.com. Retrieved 5 January 2018. <a href="https://www.armis.com/blueborne/" target="_blank">https://www.armis.com/blueborne/</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></p></li> <li id="fn:5"><p>Staff (12 September 2017). "BlueBorne - Protecting the Enterprise from BlueBorne" (PDF). Armis.com. Archived from the original (PDF) on 20 December 2017. Retrieved 5 January 2018. <a href="https://web.archive.org/web/20171220084324/http://go.armis.com/hubfs/BlueBorne%20Technical%20White%20Paper.pdf" target="_blank">https://web.archive.org/web/20171220084324/http://go.armis.com/hubfs/BlueBorne%20Technical%20White%20Paper.pdf</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></p></li> <li id="fn:6"><p>Newman, Lily Hay (13 September 2017). "Hey, Turn Bluetooth Off When You're Not Using It". Wired. Retrieved 5 January 2018. <a href="https://www.wired.com/story/turn-off-bluetooth-security/" target="_blank">https://www.wired.com/story/turn-off-bluetooth-security/</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></p></li> <li id="fn:7"><p>Hildenbrand, Jerry (16 September 2017). "Let's talk about Blueborne, the latest Bluetooth vulnerability". AndroidCentral.com. Retrieved 5 January 2018. <a href="https://www.androidcentral.com/lets-talk-about-blueborne-latest-bluetooth-vulnerability" target="_blank">https://www.androidcentral.com/lets-talk-about-blueborne-latest-bluetooth-vulnerability</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></p></li> <li id="fn:8"><p>Kerner, Sean Michael (12 September 2017). "BlueBorne Bluetooth Flaws Put Billions of Devices at Risk". eWeek. Retrieved 5 January 2018. <a href="http://www.eweek.com/security/blueborne-bluetooth-flaws-put-billions-of-devices-at-risk" target="_blank">http://www.eweek.com/security/blueborne-bluetooth-flaws-put-billions-of-devices-at-risk</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></p></li> <li id="fn:9"><p>Staff (12 September 2017). "The Attack Vector "BlueBorne" Exposes Almost Every Connected Device". Armis.com. Retrieved 5 January 2018. <a href="https://www.armis.com/blueborne/" target="_blank">https://www.armis.com/blueborne/</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></p></li> <li id="fn:10"><p>Staff (12 September 2017). "The Attack Vector "BlueBorne" Exposes Almost Every Connected Device". Armis.com. Retrieved 5 January 2018. <a href="https://www.armis.com/blueborne/" target="_blank">https://www.armis.com/blueborne/</a> <a href="#fnref:10" class="footnote-back-ref">↩</a></p></li> <li id="fn:11"><p>"BlueBorne Whitepaper" (PDF). Archived (PDF) from the original on 5 May 2020. <a href="https://info.armis.com/rs/645-PDC-047/images/BlueBorne%20Technical%20White%20Paper_20171130.pdf" target="_blank">https://info.armis.com/rs/645-PDC-047/images/BlueBorne%20Technical%20White%20Paper_20171130.pdf</a> <a href="#fnref:11" class="footnote-back-ref">↩</a></p></li> <li id="fn:12"><p>"An Analysis of BlueBorne: Bluetooth Security Risks". Decipher. Retrieved 28 July 2021. <a href="https://duo.com/decipher/an-analysis-of-blueborne-bluetooth-security-risks" target="_blank">https://duo.com/decipher/an-analysis-of-blueborne-bluetooth-security-risks</a> <a href="#fnref:12" class="footnote-back-ref">↩</a></p></li> <li id="fn:13"><p>"NVD - CVE-2017-1000251". nvd.nist.gov. Retrieved 28 July 2021. <a href="https://nvd.nist.gov/vuln/detail/CVE-2017-1000251" target="_blank">https://nvd.nist.gov/vuln/detail/CVE-2017-1000251</a> <a href="#fnref:13" class="footnote-back-ref">↩</a></p></li> <li id="fn:14"><p>"NVD - CVE-2017-1000250". nvd.nist.gov. Retrieved 28 July 2021. <a href="https://nvd.nist.gov/vuln/detail/CVE-2017-1000250" target="_blank">https://nvd.nist.gov/vuln/detail/CVE-2017-1000250</a> <a href="#fnref:14" class="footnote-back-ref">↩</a></p></li> <li id="fn:15"><p>"NVD - CVE-2017-0785". nvd.nist.gov. Retrieved 28 July 2021. <a href="https://nvd.nist.gov/vuln/detail/CVE-2017-0785" target="_blank">https://nvd.nist.gov/vuln/detail/CVE-2017-0785</a> <a href="#fnref:15" class="footnote-back-ref">↩</a></p></li> <li id="fn:16"><p>"NVD - CVE-2017-0781". nvd.nist.gov. Retrieved 28 July 2021. <a href="https://nvd.nist.gov/vuln/detail/CVE-2017-0781" target="_blank">https://nvd.nist.gov/vuln/detail/CVE-2017-0781</a> <a href="#fnref:16" class="footnote-back-ref">↩</a></p></li> <li id="fn:17"><p>"NVD - CVE-2017-0782". nvd.nist.gov. Retrieved 28 July 2021. <a href="https://nvd.nist.gov/vuln/detail/CVE-2017-0782" target="_blank">https://nvd.nist.gov/vuln/detail/CVE-2017-0782</a> <a href="#fnref:17" class="footnote-back-ref">↩</a></p></li> <li id="fn:18"><p>"NVD - CVE-2017-0783". nvd.nist.gov. Retrieved 28 July 2021. <a href="https://nvd.nist.gov/vuln/detail/CVE-2017-0783" target="_blank">https://nvd.nist.gov/vuln/detail/CVE-2017-0783</a> <a href="#fnref:18" class="footnote-back-ref">↩</a></p></li> <li id="fn:19"><p>"NVD - CVE-2017-8628". nvd.nist.gov. Retrieved 28 July 2021. <a href="https://nvd.nist.gov/vuln/detail/CVE-2017-8628" target="_blank">https://nvd.nist.gov/vuln/detail/CVE-2017-8628</a> <a href="#fnref:19" class="footnote-back-ref">↩</a></p></li> <li id="fn:20"><p>"NVD - CVE-2017-14315". nvd.nist.gov. Retrieved 28 July 2021. <a href="https://nvd.nist.gov/vuln/detail/CVE-2017-14315" target="_blank">https://nvd.nist.gov/vuln/detail/CVE-2017-14315</a> <a href="#fnref:20" class="footnote-back-ref">↩</a></p></li> <li id="fn:21"><p>"What is BlueBorne? An Apple Device FAQ". The Mac Security Blog. 22 September 2017. Retrieved 28 July 2021. <a href="https://www.intego.com/mac-security-blog/what-is-blueborne-an-apple-device-faq/" target="_blank">https://www.intego.com/mac-security-blog/what-is-blueborne-an-apple-device-faq/</a> <a href="#fnref:21" class="footnote-back-ref">↩</a></p></li> <li id="fn:22"><p>Staff (12 September 2017). "The Attack Vector "BlueBorne" Exposes Almost Every Connected Device". Armis.com. Retrieved 5 January 2018. <a href="https://www.armis.com/blueborne/" target="_blank">https://www.armis.com/blueborne/</a> <a href="#fnref:22" class="footnote-back-ref">↩</a></p></li> <li id="fn:23"><p>Smith, Ms (12 September 2017). "5.3 billion devices at risk for invisible, infectious Bluetooth attack". CSO Online. Retrieved 28 July 2021. <a href="https://www.csoonline.com/article/3224365/53-billion-devices-at-risk-for-invisible-infectious-bluetooth-attack.html" target="_blank">https://www.csoonline.com/article/3224365/53-billion-devices-at-risk-for-invisible-infectious-bluetooth-attack.html</a> <a href="#fnref:23" class="footnote-back-ref">↩</a></p></li> <li id="fn:24"><p>Staff (12 September 2017). "The Attack Vector "BlueBorne" Exposes Almost Every Connected Device". Armis.com. Retrieved 5 January 2018. <a href="https://www.armis.com/blueborne/" target="_blank">https://www.armis.com/blueborne/</a> <a href="#fnref:24" class="footnote-back-ref">↩</a></p></li> <li id="fn:25"><p>Staff (12 September 2017). "BlueBorne - Protecting the Enterprise from BlueBorne" (PDF). Armis.com. Archived from the original (PDF) on 20 December 2017. Retrieved 5 January 2018. <a href="https://web.archive.org/web/20171220084324/http://go.armis.com/hubfs/BlueBorne%20Technical%20White%20Paper.pdf" target="_blank">https://web.archive.org/web/20171220084324/http://go.armis.com/hubfs/BlueBorne%20Technical%20White%20Paper.pdf</a> <a href="#fnref:25" class="footnote-back-ref">↩</a></p></li> <li id="fn:26"><p>Newman, Lily Hay (13 September 2017). "Hey, Turn Bluetooth Off When You're Not Using It". Wired. Retrieved 5 January 2018. <a href="https://www.wired.com/story/turn-off-bluetooth-security/" target="_blank">https://www.wired.com/story/turn-off-bluetooth-security/</a> <a href="#fnref:26" class="footnote-back-ref">↩</a></p></li> <li id="fn:27"><p>Hildenbrand, Jerry (16 September 2017). "Let's talk about Blueborne, the latest Bluetooth vulnerability". AndroidCentral.com. Retrieved 5 January 2018. <a href="https://www.androidcentral.com/lets-talk-about-blueborne-latest-bluetooth-vulnerability" target="_blank">https://www.androidcentral.com/lets-talk-about-blueborne-latest-bluetooth-vulnerability</a> <a href="#fnref:27" class="footnote-back-ref">↩</a></p></li> <li id="fn:28"><p>Kerner, Sean Michael (12 September 2017). "BlueBorne Bluetooth Flaws Put Billions of Devices at Risk". eWeek. Retrieved 5 January 2018. <a href="http://www.eweek.com/security/blueborne-bluetooth-flaws-put-billions-of-devices-at-risk" target="_blank">http://www.eweek.com/security/blueborne-bluetooth-flaws-put-billions-of-devices-at-risk</a> <a href="#fnref:28" class="footnote-back-ref">↩</a></p></li> <li id="fn:29"><p>Osborne, Charlie. "Two billion devices still vulnerable to Blueborne flaws a year after discovery". ZDNet. Retrieved 28 July 2021. <a href="https://www.zdnet.com/article/two-billion-devices-still-exposed-after-blueborne-vulnerabilities-reveal/" target="_blank">https://www.zdnet.com/article/two-billion-devices-still-exposed-after-blueborne-vulnerabilities-reveal/</a> <a href="#fnref:29" class="footnote-back-ref">↩</a></p></li> <li id="fn:30"><p>"BlueBorne: One Year Later". Armis. 13 September 2018. Retrieved 28 July 2021. <a href="https://www.armis.com/blog/blueborne-one-year-later/" target="_blank">https://www.armis.com/blog/blueborne-one-year-later/</a> <a href="#fnref:30" class="footnote-back-ref">↩</a></p></li> <li id="fn:31"><p>Staff (12 September 2017). "BlueBorne Vulnerability Scanner by Armis - 2017". Google. Retrieved 5 January 2018. <a href="https://play.google.com/store/apps/details?id=com.armis.blueborne_detector&hl=en" target="_blank">https://play.google.com/store/apps/details?id=com.armis.blueborne_detector&hl=en</a> <a href="#fnref:31" class="footnote-back-ref">↩</a></p></li> <li id="fn:32"><p>Staff (15 September 2017). "Information on new BlueBorne security vulnerability". Cornell University. Retrieved 5 January 2018. <a href="https://its.weill.cornell.edu/news-and-alerts/news/information-on-new-blueborne-security-vulnerability" target="_blank">https://its.weill.cornell.edu/news-and-alerts/news/information-on-new-blueborne-security-vulnerability</a> <a href="#fnref:32" class="footnote-back-ref">↩</a></p></li> <li id="fn:33"><p>Meyer, David (13 September 2017). "How to Check If You're Exposed to Those Scary BlueBorne Bluetooth Flaws". Fortune. Retrieved 5 January 2018. <a href="http://fortune.com/2017/09/13/armis-blueborne-bluetooth-ios-android-windows-linux/" target="_blank">http://fortune.com/2017/09/13/armis-blueborne-bluetooth-ios-android-windows-linux/</a> <a href="#fnref:33" class="footnote-back-ref">↩</a></p></li> <li id="fn:34"><p>Geiger, Erik (20 September 2017). ""BlueBorne" Exposes Millions of Bluetooth Devices". Wisconsin University. Archived from the original on 5 January 2018. Retrieved 5 January 2018. <a href="https://web.archive.org/web/20180105233711/https://it.wisc.edu/news/blueborne-exposes-millions-bluetooth-devices/" target="_blank">https://web.archive.org/web/20180105233711/https://it.wisc.edu/news/blueborne-exposes-millions-bluetooth-devices/</a> <a href="#fnref:34" class="footnote-back-ref">↩</a></p></li> </ol>