Tag Info

Hot answers tagged

20

Introduction I'll try to the best of my knowledge to approach your questions without touching the technical parts of the Bluetooth technology itself. I've learned a lot of the following while I had to write a security report to shape a BYOD policy. Knowing you, I won't have to lecture you on that there's nothing 100% secure, everything we do is just to make ...


7

The attack you mention isn't really all that scary or surprising. It doesn't actually attack the encryption used by the devices, but rather the pairing process. When you pair a bluetooth device, an encryption key has to be exchanged. This is done by deriving an AES key from a PIN number. They effectively try all pin numbers against a recorded pairing ...


7

This answer may be incomplete or incorrect as my knowledge on the topic is limited, but my understanding of Bluetooth is that it is a fairly loose stack on which different protocols (called profiles) can be developed. A lot of the particulars of security are going to depend on the particular Bluetooth stack and profile that you have on your hardware. ...


6

Device security is limited to the type of device. What are the security risks of Bluetooth and what technologies and best practices should be used to protect my device? Each device provides a level of services. The services provided create the restrictions or limitations to access and exploit. The best protection is to keep Bluetooth turned off (if ...


6

Jamming is the radio equivalent of shouting. The jammer drowns your communications under a lot of noise. Defence against jamming usually is a combination of the following: Power: speak louder. I.e. increase the power of your radio-emitting apparatus, so that it will take more noise to drown it. Of course, this increases energy consumption and heat ...


5

Jamming is used either by fools or by clever professionals. The jammer can be triangulated by professional-level direction-finders (see source of this answer for a sample link) in half no time (unless special steps are taken by the attacker) What is jammed cannot be eavesdropped (okay, it's not as easy as that, but will suffice for the simplest case) ...


4

The Ubertooth one will allow you to sniff bluetooth traffic. It is fully capable of being placed into monitor mode and can be used with tools such as Kismet to perform bluetooth sniffing. There may be additional functionality that will allow you to perform packet injection as well. However if the traffic is encrypted this may not allow you to see the ...


4

I'm not aware of something that would turn your Android bluetooth radio into a sniffer. I think you would need to invest in an Ubertooth to accomplish what you're looking for. http://ubertooth.sourceforge.net/ http://hakshop.myshopify.com/products/ubertooth-one With the ubertooth you'll be able to sniff the bluetooth packets between your arduino devices.


3

Yes, there are other attacks you should be wary of. There are three types of authentication with Bluetooth "Smart" (aka Bluetooth Low Energy): Out of Band - This is what you need. Somehow exchange a 128-bit key between the two devices. The main example is to use NFC between the Bluetooth device and a smartphone. If any private information is being ...


3

As far as I know the range doesnt depend on the device scanned, but on the device that is scanning. With an antenna it is possible to detect a class 2 device one mile away if you point your antenna in the right direction. Anyway the question is about wardriving for bluetooth devices. You can use Bluediving loop mode for that (see http://bluediving.sf.net) ...


3

Well bluetooth scanner apps do exist (e.g. like this one ), so if the lock is broadcasting it will likely be discoverable. As to range, as @adnan says in comments depends on the class, however there have been examples of specialist antennas picking up signals over a mile away.


3

Very interesting Technology Indeed If the technology is designed, developed and safely, then it can be fairly secure. It seems to provide a lot of cool features. Configure keys to access house centrally on "App". Deploy "Key" to person as needed and for agreed timeframes and without physical delivery. Decommissioning keys as needed. Many keys possible, ...


2

Controlling robots via bluetooth sounds cool. Perhaps instead of intercepting the bluetooth communication and decoding it, it might actually be easier to decompile the closed-source app and then search for the bluetooth commands? The control devices might use a standard bluetooth library that you might be able to hook into and log all requests/responses ...


2

A TMSI is a randomly generated 32 bit number assigned to a mobile device, allowing it to be paged without using its permanent and immutable IMSI number. This number is assigned to a device by a Visitor Location Register (VLR) when the device enters (or is switched on within) the geographical area covered by that VLR. The assigned TMSI remains the same until ...


2

Technologically, there is no reason that later classes of bluetooth (2.1 and after) shouldn't be able to be used securely. The 2007 E0 vulnerabilities were addressed in alterations made to the bluetooth spec for 2.1 and later and encryption was made a required portion with alterations made to the pairing process. Given a secure pairing (which can be ...


1

The sub-section of the answer you are referring to indicates that refreshing the security pin frequently is a good idea. By no means is bluetooth a secure technology. You can read the rest of that answer or this article for some more info on how bluetooth is vulnerable. If you want specific attacks, just google "CVE bluetooth" and read through. In answer ...


1

Have you taken a look at the Ubertooth project? It's a hardware platform plus a good bit of code to get you started in Bluetooth analysis. Also, I found Mike Ryan's Black Hat presentation from last year to be helpful: (links directly to the pdf)


1

There are two options for this currently, the first is to use a software-defined radio that supports the ISM band (at least 2.4 to 2.485 GHz). This will allow you to grab any radio signals within the bluetooth range and will be especially useful if you're trying to identify interfering signals as you'll be able to look at the big picture of the nearby radio ...


1

Active jamming is highly illegal, and if you report it the FCC should respond rapidly. Of course, that depends on your usage model (and your threat model). The problem is that you'd have to determine if it was being deliberately jammed, and not simply interfered with. The nature of the unlicensed bands is that even legal devices can simply have faults ...


1

One defense technique against jamming is to use frequency hopping. It means that you change your frequency of broadcast (It is an automated process and part of the communication protocol) but I am not sure if you would be able to do it in your case.


1

Jamming is a form of DoS attack on the services using these protocols. Unfortunately, it is very hard to prevent such attacks without doing something to the protocol in question that violates its standard (which also means that you could break compatibility with other devices using the same protocol. Specifically, for broadcasting devices the only way would ...


1

There is nothing you can do against a jammer. The only think I could think of is by somehow using a uni-directional antenna and boosting its signal so you can at least send (with a stronger signal than the jammer, which might even be illegal). However I'm not even sure that you will be able to receive. The only real option to prevent a jammer is by using ...


1

If the device isn't normally discoverable, it won't necessarily transmit unless a paired device transmits to it first (depending on how it is implemented.) Range will depend on the devices involved and if you need one or two way communication. It's also worth noting that even if discovered, a bluetooth lock is unlikely to draw additional attention to you. ...


1

Based on the way your stating the requirements, also not knowing that much about bluetooth, I wondering if your request for authentication based on a unique signal matters. Meaning if the signal is not passing a key via a secure layer, what is to stop that signal from just being recorded, and then played back? Or to be even more clear, if the lock on the ...


1

Bluetooth 2.1 and forward require encryption on all connections other than service discovery. A key is exchanged during pairing and used for all future service delivery. If your hardware is using a standard prior to 2.1, then it is possible it could use an unencrypted connection, but otherwise it is guaranteed to use encryption. In fact, the NSA has even ...


1

http://btprox.sourceforge.net/ has some code that does this. It is an application you can install that I believe is what you're looking for.


1

It amazes me that you did not search for keywords like bluetooth hacking or something similar. Of course it possible - its called bluesnarfing. http://en.wikipedia.org/wiki/Bluesnarfing


1

Well it is not that easy. Refer to this article. Unlike sniffing 802.11, Bluetooth doesn't use one channel, but hops over 79 channels. Which makes sniffing a lot harder. You also have little or no control over the hardware, the only way to do this is by using the HCI with predefined commands. The thing is when you check the sites you will see you need to ...



Only top voted, non community-wiki answers of a minimum length are eligible