Bluetooth Bugs Speak to Lack of Security in DevOps

The pair of bugs were reportedly found in chips built by Texas Instruments. Networking device makers such as Aruba, Cisco and Meraki commonly build the Bluetooth Low Energy chips into their line-up of enterprise wireless access points. While the two bugs are distinctly different from each other in the range of models they target, researchers said that both could allow an attacker to take over an access point and break into an enterprise network or jump over the virtual walls that separate networks, according to TechCrunch.

“As the researchers point out, the vulnerability is not in the protocol but rather in the way the protocol has been implemented on the affected chipsets,” said Nick Murison, managing consultant, Synopsys Inc. “This underscores the importance for vendors to test that their implementations not only adhere to the protocol specification but also respond in a secure manner when presented with malformed traffic.”

Taking proactive steps throughout the entire development life cycle can thwart these types of bugs, minimizing their ability to survive all the way through to production, Murison said. “Using static code analysis during development can identify unsafe use of buffers, integer overflows and many other similar types of issues. Unit and integration test suites can be written to not only execute positive functional tests but also perform negative and boundary testing.

“Most companies that do any significant level of software development these days will be leveraging continuous integration pipelines to automatically build and test software from a quality perspective; such pipelines can easily be adapted to also include security-specific testing, such as static analysis and fuzzing.”

Developers also need to understand the repercussions of such implementation bugs, which should come from enterprise training that begins in at the design phase, according to Murison. “As part of the design phase, companies should also be looking at threat modeling or architecture risk analysis to identify potential security weak spots, and look for opportunities to make the overall solution secure by design.”