Google is still working on getting the September security patches out the door, but it has posted a security bulletin detailing the changes. Several of the flaws noted in the bulletin are part of an enormous Bluetooth vulnerability discovered by Armis Labs, which bills itself as an IoT security firm. The "BlueBorne" attack exposes billions of Android devices to complete takeover by hackers, but it's not only Android. The same flaw exists in Windows, Linux, and some versions of iOS.

BlueBorne is dangerous because most devices have Bluetooth active even when it's not actively being used, and an attacker does not need to pair with the target device to completely take it over. There are eight vulnerabilities listed by Armis, four of which are critical (though Google's classifications differ). The most severe issues are the two remote code executions, which allow an attacker to completely own a device without the user even knowing. These flaws are present in the Bluetooth Network Encapsulation Protocol (BNEP) service, which is used for internet sharing and networking.

You don't even need an internet connection to infect a device, and the Android demo above is wild. If one of the affected devices has Bluetooth on, it's a target. The attacker can gain complete control of the phone to launch any app, install malware, and exfiltrate data. Armis estimates that about 8 billion devices are vulnerable, including 2 billion Android phones, tablets, set top boxes, and watches. There are another 2 billion Windows devices and around 1 billion iOS phones and tablets affected. BlueBorne doesn't work on iOS 10, so the damage is mitigated there.

^{BlueBorne vulnerabilities in the security bulletin}

Most of the vulnerabilities in Android reported by Armis affect all recent builds of the OS, so Google is adding a lot of patches to AOSP. It's up to OEMs to push those out to devices, though. Anything with a patch level of September 1st, 2017 or later will have the necessary fixes. It's going to take time for this patch to roll out, and in the meantime, there are a lot of vulnerable devices.

Source: Armis Labs