Security issues with promiscuous devices

I spend a lot of time with connected device companies. Their rise over recent years can be attributed to many things, including the evolution of Bluetooth (and the omnipresent Bluetooth Low Energy). Suddenly, a plethora of objects could be tied to your phone. Data moves easily and you’ve got the remote control in your hand. But unless it’s been layered with security, you’ve potentially exposed a gaping hole into your device ecosystem.

I recently hung out with an electrical engineer named Matt. Before we got together one evening, he was at an IoT meetup where a hot hardware startup demo’d its product. The presenter turned on the device, tried to link to it via Bluetooth, and found he couldn’t. Matt knew there’d be a few seconds where anyone could pair and he jumped in. He later called the device promiscuous. That’s because your Bluetooth devices will hook up with anybody. He had his fun, de-paired, and let the presentation continue.

This 2006 throwback is very relevant to the conversation.

Following the presentation, he approached the speaker. He told him there was a security flaw with the product. The founder disagreed. The device was already paired to the speaker, so Matt hit it with a DDOS attack. The attack forced the Bluetooth component to re-start. It would normally re-pair with the original controller, except he jumped in and grabbed it again. Matt is smarter than me. I have no idea how he did this on the go.

This has implications. I can connect to BLE devices from a decent distance. I think 10 meters? And what are your walls made out of? You probably don’t live in a Faraday cage and I can probably see your devices on my own. Is there a chance your device is also connected to your router? Or another device? Is there a group of devices working together? So walking by your apartment, I can spam your one BLE device, reset it, pair, and potentially dive into your whole connected network.

Security holes like this can put your whole house at risk.