ANDROID USERS: Turn off your Bluetooth or you could get hacked

Security researchers at ERNW have discovered a critical vulnerability in Android that allows attackers to silently steal personal data or upload malware to devices via a Bluetooth connection. Dubbed BlueFrag, the vulnerability affects Android 9 (Pie) and Android 8 (Oreo). Android 10 devices aren't affected by BlueFrag. The researchers who discovered the vulnerability aren't yet sure whether it affects older versions of Android.

All that's needed to exploit the vulnerability is the targeted device's Bluetooth MAC address, which can often be deduced from its WiFI MAC address. It's not exactly a simple task, but it's definitely possible for a determined enough attacker. An attacker does, of course, have to be within Bluetooth range of your device. The attack itself is silent, however; there's no way for a user to know whether it's been executed. 

The February security update for Android addresses BlueFrag, however many older phones may never receive this patch. Google only requires Android phone manufacturers provide two years of monthly security updates, and in many cases, has been quite lax in enforcing this. In addition, some manufacturers choose to bundle security updates in quarterly editions, rather than pushing them out on a month-to-month basis. It's also quite possible that some Android devices effected by BlueFrag will never receive a fix.

You can check which security update your Android phone is running by following these steps:

• Open the Settings app
• Tap About Phone
• Tap Android version

This screen will tell which Android security update your device is running. These steps may vary slightly depending on what device you're using, and what version of Android it is running.

If your phone has an update available, it should automatically inform you with a push notification. If you want to check manually, follow these steps:

• Open the Settings app
• Tap System
• Tap Advanced
• Tap System Update

Once again, these steps may vary slightly depending on your device.

If your phone is affected by BlueFrag and doesn't have an update available, it's recommended that you keep Bluetooth turned off on your phone other than at times when you need it.

Alex Choros

Managing Editor + Group Telco Editor | X | Instagram | Threads | LinkedIn

Alex Choros is the Managing Editor of WhistleOut Australia and an award-winning journalist. He's been writing about consumer technology for over a decade and is an expert on the Australian telco sector, to the point where he knows far too many phone and internet plans by heart. In addition to leading the WhistleOut editorial team, Alex is responsible for ruining the office Sonos with his troubled taste in music.

Read full bio