CVE-2024-38271
📋 TL;DR
This vulnerability in Quick Share/Nearby allows an attacker to force a victim's device to remain connected to the attacker's WiFi network after a file sharing session, enabling man-in-the-middle attacks. The attacker exploits Bluetooth communication during Quick Share to trigger a crash that prevents normal network reversion. Users of vulnerable Quick Share versions are affected.
💻 Affected Systems
- Google Quick Share
- Google Nearby Share
📦 What is this software?
Nearby by Google
⚠️ Risk & Real-World Impact
Worst Case
Attacker performs persistent man-in-the-middle attacks, intercepting sensitive data, injecting malware, or redirecting to malicious sites through the maintained WiFi connection.
Likely Case
Attacker intercepts unencrypted network traffic, potentially capturing login credentials, personal data, or session cookies from the victim's device.
If Mitigated
With proper controls like network segmentation and encrypted communications, impact is limited to temporary connection disruption.
🎯 Exploit Status
Exploitation requires proximity via Bluetooth and specific packet sequence timing.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.1724.0 or above
Vendor Advisory: https://github.com/google/nearby/pull/2402
Restart Required: Yes
Instructions:
1. Open Quick Share/Nearby settings. 2. Check current version. 3. Update to version 1.0.1724.0 or higher via official app store or update mechanism. 4. Restart the application or device.
🔧 Temporary Workarounds
Disable Quick Share/Nearby
allTemporarily disable the vulnerable feature until patched.
Disable automatic WiFi connections
allPrevent automatic connection to new WiFi networks during file sharing.
🧯 If You Can't Patch
- Disable Bluetooth when not in use to prevent initial exploitation.
- Use VPN for all network traffic to encrypt communications even if redirected.
🔍 How to Verify
Check if Vulnerable:
Check Quick Share/Nearby version in application settings; if below 1.0.1724.0, it is vulnerable.Check Version:
Check via app settings UI; no universal command-line command available.Verify Fix Applied:
Confirm version is 1.0.1724.0 or higher after update and test Quick Share functionality.📡 Detection & Monitoring
Log Indicators:
- Unexpected WiFi network switches during Quick Share sessions
- Quick Share/Nearby application crashes
Network Indicators:
- Devices connecting to unfamiliar WiFi SSIDs after file transfers
- Unusual Bluetooth packet sequences
SIEM Query:
Search for events where WiFi network changes coincide with Quick Share/Nearby activity or crashes.🔗 References
- https://github.com/google/nearby/pull/2402
- https://github.com/google/nearby/pull/2433
- https://github.com/google/nearby/pull/2435
- https://github.com/google/nearby/pull/2589
- https://github.com/google/nearby/pull/2402
- https://github.com/google/nearby/pull/2433
- https://github.com/google/nearby/pull/2435
- https://github.com/google/nearby/pull/2589
