The story so far:
CCybersecurity experts note that apps that allow users to connect smartphones or laptops to wireless earbuds can record conversations and are vulnerable to hacks. Even the most secure smartphones such as iPhones are vulnerable to such attacks. Any app with access to Bluetooth can record users’ conversations with Siri and audio from the iOS keyboard dictation feature when using AirPods or Beats headsets, some app developers say. Through a process called bluebugging, a hacker can gain unauthorized access to these apps and devices and control them as they see fit.
What is bluebugging?
It is a form of hacking that allows attackers to access a device through its detectable Bluetooth connection. Once a device or phone is tapped, a hacker can listen to the calls, read and send messages, and steal and modify contacts. It started as a threat to laptops with Bluetooth capabilities. Later hackers used the technique to target cell phones and other devices.
Independent security researcher Martin Herfurt blogged about the threat of bluebugging back in 2004. He noted that the bug exploited a loophole in the Bluetooth protocol that allowed it to download phone books and call lists from the attacked user’s phone.
How does bluebugging hack devices?
Bluebugging attacks work by using Bluetooth devices. The device’s Bluetooth must be in discoverable mode, which is the default setting on most devices. The hacker then tries to pair with the device via Bluetooth. Once a connection is established, hackers can use brute force attacks to bypass authentication. They can install malware on the compromised device to gain unauthorized access to it. Bluebugging can happen when a Bluetooth device is within 10 meters of the hacker. However, according to a blog by VPN service provider NordVPN, hackers can use booster antennas to increase the attack range.
How can bluebugging be prevented?
Disabling Bluetooth and disconnecting paired Bluetooth devices when not in use, updating the device’s system software to the latest version, limiting public Wi-Fi use, and using VPN as an added security measure are some ways to avoid bluebugging. to avoid, Shubho Pramanik, said senior vice president, Applied Cloud Computing, a Thane-based cloud service provider The Hindu.
Most devices make Bluetooth discoverable by default, making your devices susceptible to unsolicited connections. So the first step would be to make your Bluetooth devices untraceable through Bluetooth settings. This makes them invisible to hackers, preventing them from pairing with the device, NordVPN said in the blog.
Users should also be wary of suspicious activity on their devices, NordVPN suggested. “If your phone suddenly disconnects and reconnects, or you notice messages that were not sent by you, it could indicate that someone is controlling your device. Reset the device to factory settings or uninstall apps you don’t recognise.” One should also keep an eye out for sudden spikes in data usage. If the amount of data used suddenly becomes unreasonably high, someone could control the device as part of a botnet gobbling up data, NordVPN said.
Modern antivirus software can also help prevent such attacks. The new antivirus software helps users detect strange and spammy content by filtering, blocking and consistently reminding people to be alert, Manoj Kumar Shastrula, CEO and founder of SOCLY.io, a cybersecurity company, told me. The Hindu.
Which devices are most susceptible to such attacks?
Any Bluetooth device can be bluebugged. Wireless earbuds are susceptible to such hacks. Apps that allow users to connect to their TWS (True Wireless Stereo) devices or earbuds can record conversations. The apps of these TWS devices can record conversations. Once hacked, the attacker can make and listen to calls, read and send messages and modify or steal your contacts, Mr Pramanik said.
Earlier, Apple also acknowledged that wireless earbuds can record conversations. “An app may be able to record audio with a pair of connected AirPods,” Apple said on its support page while releasing the fixes for the problem. However, smartphones are more vulnerable to this type of hacking as most users leave their Bluetooth on in public places where hackers might be lurking.
Nowadays, several smartphones have their Bluetooth settings in discovery mode, which makes it easy for hackers to access the phones when they are within 10 meters of the device. Some earlier models of Bluetooth phones were vulnerable to bluebugging, but have since been corrected, Arindam Mitra, co-founder, CTO and President of Services, ProcessIT Global, told me. The Hindu. However, devices with short password PINs can be easily cracked using brute-force computing and may also be vulnerable to these attacks, Mitra added.
