The Bluetooth CYBORG: Analysis of the Full Human-Machine Passkey Entry AKE Protocol
Michael Troncoso, Britta Hale · 2021
Assuming that an adversary cannot effect such channels is no longer realistic, as demonstrated by recent attacks leveraging malware to target the user interface, as well as more established social engineering attacks.Notably the Tap 'n Ghost attack [33], which specifically targets Bluetooth devices, refutes the idea that user communications should be ignored in protocol analysis.As a result, it is critical to analyze the protocols in their entirety, accounting for both user interaction and device-to-device communication -namely, the cyborg protocol.Leading authenticated key exchange (AKE) models do not capture user-to-device (UtD) attacks due to the sole focus on device-to-device (DtD) communications.However useroriented attacks arise precisely from adversarial control of the UtD channel, or from a combination of control on UtD and DtD channels.While models capturing the UtD channel in the analysis of authentication protocols have emerged [18], [23], there has been a lack of such modeling for key exchange until now despite the standarized use of such protocols in practice.This is in stark contrast to the widespread implementation and standardization of AKE protocols employing the UtD channel [10], [25].We model adversarial abilities against key exchange on what is normally the OOB channel.As noted before, Tap 'n Ghost is one attack which focuses heavily on vulnerabilities in the (previously assumed to be perfect) OOB channel.The attack is notable as it is a two-pronged assault on a user interface (without actively attacking device memory itself).The attacker first executes a Tag-based Adaptive Ploy, which forces a pop-up to display on a user's device, and then activates a Ghost Touch Generator, which spoofs touches on unwanted areas of the screen, to force pairing with a corrupted device.Thus, the attack requires adversarial ability to create messages to be sent to a user from a device, and adversarial ability to modify communications back from the user to the device (see Figure 1).We reference the Tap n' Ghost attack as an illustrative example throughout, but it is not the only attack leveraging the UtD communication channel.Touchloggers [12], [16], the StrandHogg vulnerability [24], social engineering, and shoulder-surfing attacks also fall into this category.All such attack vectors are systematically accounted for in our CYBORG model.Bluetooth's Passkey Entry [10] generates and shares a random value (a passkey) via the user to effectively achieve Abstract-In this paper, we computationally analyze Passkey Entry in its entirety as a cryptographic authenticated key exchange (AKE) -including user-protocol interactions that are typically ignored as out-of-band.To achieve this, we model the user-to-device channels, as well as the typical device-to-device channel, and adversarial control scenarios in both cases.In particular, we separately capture adversarial control of device displays on the initiating and responding devices as well as adversarial control of user input mechanisms using what we call a CYBORG model.The CYBORG model enables realistic real-world security analysis in light of published attacks on user-mediated protocols such as Bluetooth that leverage malware and device displays.In light of this, we show that all versions of Passkey Entry fail to provide security in our model.Finally, we demonstrate how slight modifications to the protocol would allow it to achieve stronger security guarantees for all current variants of passkey generation, as well as a newly proposed twofold mode of generation we term Dual Passkey Entry.These proof-of-concept modifications point to improved design approaches for user-mediated protocols.Finally, this work points to categories of vulnerabilities, based on compromise type, that could be exploited in Bluetooth Passkey Entry.