Google yesterday announced that it will be offering free replacement to customers in the US who purchased Google’s Bluetooth Low Energy (BLE) version of the Titan Security Key. Google is doing this because Microsoft reported a security vulnerability affecting these security keys. Due to a misconfiguration in the Bluetooth pairing protocols, an attacker physically close to the key can use your security key to (a) communicate with your security key, or (b) communicate with the device to which your key is paired.
Here’s how the attacker can take advantage of this vulnerability:
- When you’re trying to sign into an account on your device, you are normally asked to press the button on your BLE security key to activate it. An attacker in close physical proximity at that moment in time can potentially connect their own device to your affected security key before your own device connects. In this set of circumstances, the attacker could sign into your account using their own device if the attacker somehow already obtained your username and password and could time these events exactly.
- Before you can use your security key, it must be paired to your device. Once paired, an attacker in close physical proximity to you could use their device to masquerade as your affected security key and connect to your device at the moment you are asked to press the button on your key. After that, they could attempt to change their device to appear as a Bluetooth keyboard or mouse and potentially take actions on your device.
If you own an affected BLE Titan Security Key, you can get a free replacement here.