Recent threats

We highlight current cyber security threats in New Zealand, and provide guidance on what to do if they affect you.

13 Sep 2017

BlueBorne: Security vulnerabilities affecting Bluetooth devices

BlueBorne is a recently identified vulnerability that can affect devices that use Bluetooth. This vulnerability is not limited to computers, tablets and smartphones; it is also possible that it will affect Internet-of-Things (IoT) devices such as smart TVs, smart fridges, and other devices.

What's happening

Systems affected

This vulnerability affects devices that use Bluetooth. This includes Android, Apple (iOS), Linux and Windows systems and devices. This includes computers, phones, tablets, and Internet-of-Things devices like smart TVs and smart fridges.

What this means

Attackers can use this vulnerability to infect any Bluetooth device that does not have up-to-date security patches. They can compromise the device wirelessly, and without you knowing. They can only do this when they are physically near a device that is vulnerable - within Bluetooth range which is generally 10 metres.

What to look for

How to tell if you're at risk

Your device is at risk if it has Bluetooth capabilities and has not been updated, including (but not limited to):

Microsoft Windows (all releases since Vista)
Android (all releases)
Apple iOS (previous to 9.3.5)

What to do

Prevention

These are the steps that CERT NZ recommends you take immediately.

Ensure you've patched all your devices. CERT NZ recommends that you apply all security updates to all systems as soon as they are available. Older devices may no longer be supported by the manufacturer and therefore can't be patched. We recommend you plan to replace these devices before they reach end-of-life so you continue to be protected.
If you don’t need Bluetooth on the device, turn it off.
Be careful when you have Bluetooth switched on in public. Attackers can only use this vulnerability when they are physically near the device they are trying to compromise – within Bluetooth range which is generally 10 metres. You can limit your risk by switching off Bluetooth.
If you can’t disable Bluetooth, check with the product manufacturer to find out what actions you can take to protect your device
If you’re not sure whether your device is vulnerable, or you’re not sure what to do, speak with the retailer where you purchased the device.

Additional advice for businesses

Ensure staff are aware of this vulnerability. Remind them to make sure systems are up-to-date and only turn on Bluetooth on their devices if it is required.
Special consideration should be taken for devices and systems that are reaching end of life. CERT NZ recommends that these are updated to a supported version immediately. If updating isn’t possible, it’s important to identify the risks of continuing to use these systems and devices and mitigate them where possible, such as by switching off Bluetooth in this instance.

More information

If you require more information or further support, submit a report on our website or contact us on 0800 CERT NZ.

Report an incident to CERT NZ.

CERT NZ is closed on 22 January for Wellington Anniversary. You can still report online and via 0800 CERT NZ.