Google Online Security Blog: Advisory: Security Issue with Bluetooth Low Energy (BLE) Titan Security Keys

Security Blog

The latest news and insights from Google on security and safety on the Internet

Advisory: Security Issue with Bluetooth Low Energy (BLE) Titan Security Keys

May 15, 2019

Posted by Christiaan Brand, Product Manager, Google CloudWhat is the security issue?

When you’re trying to sign into an account on your device, you are normally asked to press the button on your BLE security key to activate it. An attacker in close physical proximity at that moment in time can potentially connect their own device to your affected security key before your own device connects. In this set of circumstances, the attacker could sign into your account using their own device if the attacker somehow already obtained your username and password and could time these events exactly.

Before you can use your security key, it must be paired to your device. Once paired, an attacker in close physical proximity to you could use their device to masquerade as your affected security key and connect to your device at the moment you are asked to press the button on your key. After that, they could attempt to change their device to appear as a Bluetooth keyboard or mouse and potentially take actions on your device.

Am I affected?

Steps to protect yourself iOS devices: On devices running iOS version 12.2 or earlier,unpair itOnce you update to iOS 12.3these instructionsOn Android and other devices: unpair itHow to get a replacement key - updated on 07/16/20Starting on July 16, 2020, we are changing the key replacement process. After July 16, 2020, if you have purchased a Bluetooth Titan Security Key ("T1" or "T2") from the Google Store, you can contact the Google Store directly for a replacement device.
Is it still safe to use my affected BLE Titan Security Key?