• State Resolved
  • Locked Locked
  • Replies 3 replies
  • Subscribers 54 subscribers
  • Views 5096 views
  • Users 0 members are here
Support feedback
Options
Options
Similar topics

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

Industry news on potential Bluetooth vulnerabilities

tscheck
Mastermind 23525 points
Other Parts Discussed in Thread: CC2564C, BLE-STACK, CC2640, CC2650, CC1352R, CC1350
  • TI is aware of the recent announcement regarding a potential vulnerability that may be present during initial pairing with certain Bluetooth®-enabled devices. Like many other companies, we are actively working with the Bluetooth Special Interest Group (SIG) and our software partners to understand and verify the issue, and identify potential mitigation paths. 
  • As described in the Bluetooth’s SIG’s announcement, several factors may need to be present for this vulnerability to be intentionally exploited:

–         The attack attempt must occur while the devices are in initial pairing or provisioning process

–         Both sides of the Bluetooth-linked products need to be vulnerable (if one side of the link performs public key validation, the attack cannot be exploited)

–         Attacker must be in close physical proximity to the pairing devices

–         Multiple attempts are usually required

 

  • TI has identified that certain TI Bluetooth and Bluetooth Low Energy (BLE) wireless MCU devices may be affected:

–         TI BLE Stack: CC26xx and CC13xx families

–         TI Dual-Mode Bluetooth Stack for BLE: CC2564C, and WL18xx devices

–         TI Dual-Mode Bluetooth Service Pack for BT Classic: CC2564x, WL18xx , and WL12xx devices

  • Customers using these devices should reference information available from Bluetooth SIG to understand more about the nature of this potential vulnerability and to determine whether their application is affected based on how it is being used. The level of action needed will likely vary depending on the use-case of each end-product. 
  • Below is information on software updates available for TI devices implementing Bluetooth Erratum 10734.

–         Software updates for several TI BLE-Stack devices have already been deployed in the latest SDK available:

–         Software updates have also now been released for the following TI Dual-mode device families. Please feel free to subscribe for any future updates by clicking the “Alert Me” button through the links below for each device type implemented.

–         For information on other devices implemented that are not listed above, please contact bt_ble_fcic@list.ti.com.