In July 2009, a Spanish security researcher, Alberto Moreno Tablado, publicly disclosed a Bluetooth flaw in HTC smartphones running Windows Mobile 6 and 6.1. PCWorld reported on 14 July 2009 that an attacker could use the flaw to access any file on the phone or upload malicious code over Bluetooth.
Who was exposed and why
The Register described the bug as a directory traversal flaw in the Bluetooth File Transfer Profile (OBEX FTP) service built into HTC’s Bluetooth stack. It let an attacker move out of the phone’s Bluetooth shared folder and into other folders. The result, according to InfoWorld, was access to contact details, e-mails, pictures or other data stored on the phone. Uploading software, including malicious code, was also possible.
The flaw was in nearly all HTC handsets running Windows Mobile 6 or 6.1. Handsets running Windows Mobile 5 were not affected. Tablado’s tests confirmed eight models: the P3600i, Touch Find, S710, P3650, Touch Diamond, Touch Pro, Touch Cruise and S740.
The fault was not in Microsoft’s code. Tablado first suspected the Windows Mobile Bluetooth stack, but Microsoft concluded that only HTC’s implementation of the OBEX FTP service was affected. The component was a third-party driver called obexfile.dll, developed by HTC. Handsets from other makers did not share the problem.
What an attacker needed
The attack was not a drive-by compromise. The target device had to have Bluetooth enabled and Bluetooth file sharing activated. The attacker also needed a connection to the phone. The Register said that pairing with the handset would do the trick, and more sophisticated routes included sniffing the pairing, cracking the link key or spoofing a MAC address. Tablado also described MAC spoofing as the attacker convincing the phone that it was one of its already paired devices. The Register added that, once access was gained, the activity was completely transparent to the victim.
Disclosure and the fix
Tablado said he told HTC about the flaw in February 2009. Softpedia reported that he went public after HTC showed no interest in releasing a patch. His account was that HTC Europe was contacted several times between February and June 2009.
Once the details were public, HTC moved quickly. InfoWorld reported that HTC released a software update on Thursday, days after the disclosure. The hotfix was made available for the Touch Pro, Touch Diamond and Touch HD handsets, and Tablado said it closed the directory traversal hole. Dark Reading’s report of 17 July 2009 said users could download the fix from HTC’s website and transfer it to their handsets through Microsoft ActiveSync or Windows Mobile Device Center.
What defenders were told to do
Until the fix was installed, the advice was simple and aimed at reducing exposure:
- Turn Bluetooth off when it is not needed. Dark Reading noted that turning Bluetooth off entirely limited exposure.
- Do not pair with untrusted phones or computers, and delete devices already paired that are not trusted.
- Do not leave Bluetooth file sharing switched on without a reason.
For companies with fleets of HTC handsets, the case showed how much depended on the handset maker. The vulnerable code was a vendor driver, not the operating system, so a Microsoft update would not have covered it. The fix had to come from HTC itself, and it arrived only after the researcher went public, months after he first reported the flaw.