A suite of vulnerabilities related to devices using Low Energy (BLE) wireless communications protocol

RE: A suite of vulnerabilities related to devices using Low Energy (BLE) wireless communications protocol

CheMax — Mon, 23 Mar 2020 08:45:03 GMT

Hi, below the contents of the letter:

Hi Maxim,

All vulnerabilities have registered CVEs and are documented here:
https://asset-group.github.io/disclosures/sweyntooth/sweyntooth.pdf

All CVEs identify the hardware and software platforms affected.  
Nordic is not documented as an affected platform.
The fact that our devices and software are unaffected is evidenced in the fact 
we are not identified in the CVEs.  We do not need to issue an official statement to verify this, 
it can be independently verified by anyone as the CVE database is public. 

MACIEJ MICHNA | Regional Sales Manager
M +48 600 439 203 | Kraków, Poland
nordicsemi.com | devzone.nordicsemi.com

RE: A suite of vulnerabilities related to devices using Low Energy (BLE) wireless communications protocol

had23j — Mon, 23 Mar 2020 03:22:19 GMT

CheMax were you able to get a document to prove that nRF52 BLE stacks are not affected by any of the sweyntooth vulnerabilities ?

RE: A suite of vulnerabilities related to devices using Low Energy (BLE) wireless communications protocol

CheMax — Mon, 16 Mar 2020 13:17:21 GMT

Ok, thanks.

RE: A suite of vulnerabilities related to devices using Low Energy (BLE) wireless communications protocol

Simonr — Mon, 16 Mar 2020 13:03:32 GMT

Please contact your local RSM for more details on what tests we did to confirm that we are not affected by these vulnerabilities.

Best regards,

Simon

RE: A suite of vulnerabilities related to devices using Low Energy (BLE) wireless communications protocol

CheMax — Mon, 16 Mar 2020 10:58:44 GMT

Hi Simon,

Thanks for very fast answer.

It is wonderful that there are no vulnerabilities. In the article, as I understand it, not all manufacturers are listed, for example, the same Silabs are also absent.
How can you confirm your assurances to the auditors if they have questions?
Unfortunately they may not believe a word :(

Best regards

RE: A suite of vulnerabilities related to devices using Low Energy (BLE) wireless communications protocol

Simonr — Mon, 16 Mar 2020 10:47:24 GMT

Hi Max

We've tested these vulnerabilities up against our BLE devices, and we've found that our integration and system tests have been testing all the sequences of transactions that have been used to explore the vulnerabilities in the BLE chips. These tests have been in our system for years. This means that all versions of our nRF51 and nRF52 BLE stacks are not affected by any of these vulnerabilities. As you can see in the article in question, Nordic Semiconductor is not mentioned as one of the affected devices.

Best regards,

Simon