Why it matters: Most newer Bluetooth devices pair more easily thanks to the Just Works security model implemented in Bluetooth 4.0 and newer standards. However, that added convenience can be exploited by an attacker to compromise all of your Bluetooth devices.

The Bluetooth Special Interest Group earlier today confirmed the existence of a new vulnerabilities in Bluetooth 4.x and Bluetooth 5.0 that allow an attacker within wireless range to essentially overwrite the pairing key and get access to other Bluetooth devices that you may have paired with the one they compromised.

The flaws were found by two separate research teams at Purdue University and the École Polytechnique Fédérale de Lausanne. Collectively dubbed "BLURtooth," they have to do with a process called Cross-Transport Key Derivation (CTKD), which is used to negotiate the authentication keys for pairing Bluetooth devices that are compatible with the Low Energy (BLE) and Basic Rate/Enhanced Data Rate (BR/EDR) standards.

This means the issue affects millions of smartphones, tablets, laptops, and countless IoT devices that support dual-mode pairing. An attacker can exploit the fact that these devices pair over either BLE or BR/EDR to get the Link keys for both transport types, without having to do the process a second time.

Many devices pair using the Just Works security model -- which doesn't offer protection from Man-in-the-Middle (MITM) attacks or passive eavesdropping -- so the attacker can use this convenience to impersonate your Bluetooth device and gain access to others that use strong encryption keys.

The good news is that these attacks require the hacker to be within wireless range, which in practice can be a lot smaller than the theoretical maximums in the official spec. Bluetooth SIG is currently working with manufacturers to develop firmware updates for affected devices, and the upcoming Bluetooth 5.1 specification will include restrictions that will prevent encryption key overwrites.

Still, this is becoming a worrying trend where we see two serious vulnerability disclosures every year -- from exploits that are as easy as turning a knob to attacks that make it trivial to track you through your smartphone or wearables.