Blur

I’m glad to share three updates about the BLURtooth paper.

We successfully tested the BLUR attacks on a Google Pixel 6 (Bluetooth 5.2) and submitted our findings to Google. They classified the report with high severity, assigned CVE-2022-20361, and shipped fixes as part of August’s Android Security bulletin. More details about the fixes can be found here. This is yet another finding demonstrating that the attacks are effective on all Bluetooth versions supporting CTKD unlike stated in this note from the Bluetooth SIG .

Aug 17, 2022 1 min read

BLURtooth (BLUR Attacks) Disclosure

Since January 2020 we’ve been working on a security analysis of Bluetooth cross-transport key-derivation (CTKD). In May 2020 we reported to the Bluetooth SIG a set of CTKD vulnerabilities and related attacks (i.e., the BLURtooth report about the BLUR attacks) and kept our findings private.

Sep 25, 2020 1 min read