Researchers at EURECOM have developed six (6) new attack packages called “BLUFFS” that break the encryption of Bluetooth sessions. One of the original researchers stated that the attack targets previously unknown flaws in how the Bluetooth standard generates session keys. This is important as it means the Bluetooth standard itself has a flaw and is not limited to any specific hardware or software platform. Tracked as CVE-2023-24023, this issue impacts Bluetooth Core Specification 4.2, released in December 2014, through 5.4, released in February 2023. The issue works by exploiting the session key creation process to force the key created for the communication session to be abnormally short. This short length limits the possible combinations and thus allows the attacker to brute force the key so that decryption of the session is possible. After the initial compromised connection is made the threat actor may then cause the target device to establish a connection with the device in the middle to create a new encryption procedure using legacy encryption favorable to the attacker. While this does require the threat actor using this flaw to be within Bluetooth range of the two (2) communicating devices, it allows the attacker to then impersonate one (1) of the devices and begin an Adversary-in-the-Middle (AiTM) attack. EURECOM tested the various BLUFFS attacks they had devised on real world devices and discovered every device they tested was vulnerable to at least some of the attacks. This highlights the severity of the flaws found as it can be used on devices like Bluetooth enabled keyboards, mice, listening devices, and audio devices, presenting a large risk for a leak of data through an AiTM attack or for the attacker to inject malicious Bluetooth packets.