A flaw in BLE chips

Researchers from the Israeli security firm Armis have discovered a new security flaw in BLE (Bluetooth Low Energy) chips that expose millions of access points and networking devices around the world. This opened the door to a new hack.

The flaw has been dubbed "BleedingBit" and is actually two separate vulnerabilities that could allow a hacker to execute code or take complete control over a vulnerable device without the need of a password.  What makes BleedingBit an especially dangerous flaw is the fact that a wide range of medical devices including pacemakers and insulin pumps can be targeted, along with other IoT devices and point of sale terminals.

According to the research team, the attack works as follows

"First, the attacker sends multiple benign BLE broadcast messages called Advertising Packets, which will be stored on the memory of the vulnerable BLE chip in the targeted device.

Next, the attacker sends the overflow packet, which is a standard advertising packet with a subtle alteration - a specific bit in its header is turned ON instead of off.  This bit causes the chip to allocate the information from the packet a much larger space than it really needs, triggering an overflow of critical memory in the process."

It should be noted that in order to execute the attack, a hacker would need to be in close proximity to the target device. Of course, once it has been compromised, it can be accessed again at will remotely, monitoring network traffic, conducting man in the middle attacks, or launching additional attacks on other devices connected to the targeted device.

The Armis researchers responsibly reported their findings and the chip manufacturer, Texas Instruments, has confirmed the vulnerabilities and has already released patches for the affected hardware.

Our perspective

If your company uses BLE chips in any aspect of your business, be sure to grab the latest update.


The author

Thanks for reading this short post. For more tips on thriving with small business technology, check out the other blog posts at DWPia Blogs. I am also available at dwpia on LinkedIn, at dwpia on Facebook, and @dwpia on Twitter.

Cybersecurity Expert, Small Business Technology Consultant, Managed Services Provider, Managed IT Support

Denis S Wilson

I am President and Principal Consultant for DWP Information Architects: specializing in managed IT support for smaller healthcare practices, clinics, insurance companies, law firms, and construction companies in Ventura County and San Fernando Valley. And have created cost-effective IT solutions, for over 20 years, specializing in cybersecurity and regulatory compliance.

I am also a published author and speaker, working extensively with organizations that include: the State of California, the Federal Bureau of Investigation (FBI), the Small Business Administration (SBA), SCORE, Women's Business Centers, and Small Business Development Centers. As well as providing small business technology education programs through business and professional associations.

Contact me if you would like me to speak at your meeting.

Meanwhile, check out this report

Executive Report: 10 Hidden IT Risks That Might Threaten Your Business