Bluetooth Pairing Security Bypass in Silicon Labs Gecko SDK

Executive Summary

This vulnerability involves Bluetooth Low Energy (BLE) re-pairing where a legitimate device may use a lower security level than before, making it easier to brute-force the Long Term Key (LTK). This allows attackers to exploit weaker encryption during re-pairing, potentially enabling impersonation or Man-in-the-Middle attacks with minimal user interaction.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves BLE re-pairing attacks that downgrade security levels. Detection requires monitoring BLE pairing processes for unexpected security level changes or unauthorized re-pairing attempts. Use tools like Wireshark with BLE protocol filters to analyze SMP messages during pairing. Check for repeated pairing attempts or mismatched security parameters between devices.

Useful 0 Not Useful 0

Impact Analysis

An attacker could intercept or manipulate BLE communications by exploiting weaker encryption during re-pairing. This may lead to unauthorized access to sensitive data, device impersonation, or session hijacking, especially if the device uses weak encryption keys or lacks proper security measures.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or interception, violating confidentiality requirements under GDPR and HIPAA. Organizations using affected BLE devices may fail to meet data protection standards, risking legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update BLE SDKs to the latest versions that enforce minimum encryption key sizes. For Silicon Labs devices, use SDK version 4.1.0 or later and configure `rsi_ble_vendor_set_SMP_min_enc_keysize` to require keys of at least 16 bytes. Disable unauthenticated re-pairing where possible and implement authenticated re-pairing protocols as described in BLERP mitigations.

Useful 0 Not Useful 0