Firmware Insider: Bluetooth Randomness is Mostly Random
summary
Evaluation of Broadcom and Cypress Bluetooth chips finds that many firmwares keep an insecure PRNG fallback and that some popular devices—including a Samsung Galaxy S8 and at least one iPhone model—rely on the weak fallback or missing HRNG initialization. Researchers extract firmware, patch chips, and pull a gigabyte of samples per device to run dieharder tests and reverse engineer pseudocode showing a CRC32 fallback and cached HRNG values; most HRNGs pass statistical tests but the fallback is trivially predictable.
AI-written summary · about
chapters (23)
- 0:00Intro
- 1:38RNG Variants 2 and 3
- 3:05RNG Variant 2, PRNG Fallback
- 3:42How random is the PRNG?
- 4:01CVE Time!
- 5:40Optimizations
- 6:10HRNG Measurements
- 6:41But what about the variants???
- 7:18RNG Variant #1
- 7:44More Chips of Variant 2 and 3
- 8:04Variant 5
- 8:32Variant 4: Samsung Galaxy S8/S8+/Note 8
- 9:14iOS 13.5 Updates
- 10:03Variant 4: PRNG Inputs
- 10:16Time Inputs
- 11:03Signal Processing Inputs (1)
- 11:53Where is randomness used anyway?
- 12:45Active MITM on Numeric Comparison
- 13:26Android m
- 13:38Filling the private ECDH key directly from BLE rand...
- 14:23The Patch (June 2020 Patchlevel)
- 15:16Lessons Learned
- 16:00Credits
related talks
57mAttacking the Linux PRNG on Android
25mSweynTooth: Unleashing Mayhem over Bluetooth Low Energy
20mSoK: Insecurity of Cellular Basebands
54mAnalyzing & Breaking QNX Exploit Mitigations and PRNGs For Embedded Systems
51mBluetooth Hacking: Tools And Techniques
35mDeep into Android Bluetooth Bug Hunting: New Attack Surfaces and Weak Code Patterns
45mInside the Linux Kernel Random Number Generator
30mUnfit Story of Fitness Trackers: Hacking BLE Fitness Trackers