Deep into Android Bluetooth Bug Hunting: New Attack Surfaces and Weak Code Patterns

In the past few years, researchers have found hundreds of security vulnerabilities in the AOSP Bluetooth module such as Blueborne and BlueFrag. Almost all of these vulnerabilities are caused by the process not properly validating the remote user-supplied data, when parsing the Bluetooth request packet.In this context, in order to improve the security of Bluetooth, Google has adopted a variety of hardening methods:1. Validate the length of incoming Bluetooth packets.2. Implement a new and more secure AVRCP profile.3. Rewrite Bluetooth stack code-named Gabeldorsche in Rust.However, through some new approaches (focusing on the lifecycle of Bluetooth packet data and specific weak Bluetooth architectural logic), we still found a large number of security vulnerabilities hidden deep in the code.In this presentation, we will first introduce the Bluetooth protocol architecture in AOSP, and summarize the existing research results and known attack surfaces...

By: Zinuo Han