SWEYNTOOTH Bluetooth flaws potentially impacting Medical Devices
Summary:
Health-ISAC published an initial Vulnerability Bulletin regarding SWEYNTOOTH on February 21, 2020 and is providing updated analysis and recommendations in this amended release. Health-ISAC is working closely with many Medical Device Manufacturers (MDMs) who welcome the hard work and diligence by the security researcher community in evaluating embedded systems. Their work makes the healthcare industry more resilient to cybersecurity attacks.
SWEYNTOOTH captures a family of 12 vulnerabilities (more under non-disclosure) across different Bluetooth Low Energy (BLE) software development kits (SDKs) of seven major system-on-a-chip (SoC) vendors. The vulnerabilities expose flaws in specific BLE SoC implementations that allow an attacker within radio range to trigger deadlocks, crashes and buffer overflows or completely bypass security of Bluetooth enabled devices depending on the circumstances.
