Tag Info

Hot answers tagged

27

Introduction I'll try to the best of my knowledge to approach your questions without touching the technical parts of the Bluetooth technology itself. I've learned a lot of the following while I had to write a security report to shape a BYOD policy. Knowing you, I won't have to lecture you on that there's nothing 100% secure, everything we do is just to make ...


9

The attack you mention isn't really all that scary or surprising. It doesn't actually attack the encryption used by the devices, but rather the pairing process. When you pair a bluetooth device, an encryption key has to be exchanged. This is done by deriving an AES key from a PIN number. They effectively try all pin numbers against a recorded pairing ...


8

This answer may be incomplete or incorrect as my knowledge on the topic is limited, but my understanding of Bluetooth is that it is a fairly loose stack on which different protocols (called profiles) can be developed. A lot of the particulars of security are going to depend on the particular Bluetooth stack and profile that you have on your hardware. ...


7

Device security is limited to the type of device. What are the security risks of Bluetooth and what technologies and best practices should be used to protect my device? Each device provides a level of services. The services provided create the restrictions or limitations to access and exploit. The best protection is to keep Bluetooth turned off (if ...


7

Jamming is the radio equivalent of shouting. The jammer drowns your communications under a lot of noise. Defence against jamming usually is a combination of the following: Power: speak louder. I.e. increase the power of your radio-emitting apparatus, so that it will take more noise to drown it. Of course, this increases energy consumption and heat ...


6

Jamming is used either by fools or by clever professionals. The jammer can be triangulated by professional-level direction-finders (see source of this answer for a sample link) in half no time (unless special steps are taken by the attacker) What is jammed cannot be eavesdropped (okay, it's not as easy as that, but will suffice for the simplest case) ...


5

The Ubertooth one will allow you to sniff bluetooth traffic. It is fully capable of being placed into monitor mode and can be used with tools such as Kismet to perform bluetooth sniffing. There may be additional functionality that will allow you to perform packet injection as well. However if the traffic is encrypted this may not allow you to see the ...


4

Yes, there are other attacks you should be wary of. There are three types of authentication with Bluetooth "Smart" (aka Bluetooth Low Energy): Out of Band - This is what you need. Somehow exchange a 128-bit key between the two devices. The main example is to use NFC between the Bluetooth device and a smartphone. If any private information is being ...


4

I'm not aware of something that would turn your Android bluetooth radio into a sniffer. I think you would need to invest in an Ubertooth to accomplish what you're looking for. http://ubertooth.sourceforge.net/ http://hakshop.myshopify.com/products/ubertooth-one With the ubertooth you'll be able to sniff the bluetooth packets between your arduino devices.


4

Basically, anyone allowed to connect to your router/wifi access point can in turn make their computer (or whatever device) into a router of their own. They can then, without your router even knowing, create their own little network and share internet amongst themselves, then relaying the traffic through one device. You can generally see what devices are ...


3

As far as I know the range doesnt depend on the device scanned, but on the device that is scanning. With an antenna it is possible to detect a class 2 device one mile away if you point your antenna in the right direction. Anyway the question is about wardriving for bluetooth devices. You can use Bluediving loop mode for that (see http://bluediving.sf.net) ...


3

Well bluetooth scanner apps do exist (e.g. like this one ), so if the lock is broadcasting it will likely be discoverable. As to range, as @adnan says in comments depends on the class, however there have been examples of specialist antennas picking up signals over a mile away.


3

Very interesting Technology Indeed If the technology is designed, developed and safely, then it can be fairly secure. It seems to provide a lot of cool features. Configure keys to access house centrally on "App". Deploy "Key" to person as needed and for agreed timeframes and without physical delivery. Decommissioning keys as needed. Many keys possible, ...


3

A TMSI is a randomly generated 32 bit number assigned to a mobile device, allowing it to be paged without using its permanent and immutable IMSI number. This number is assigned to a device by a Visitor Location Register (VLR) when the device enters (or is switched on within) the geographical area covered by that VLR. The assigned TMSI remains the same until ...


2

Controlling robots via bluetooth sounds cool. Perhaps instead of intercepting the bluetooth communication and decoding it, it might actually be easier to decompile the closed-source app and then search for the bluetooth commands? The control devices might use a standard bluetooth library that you might be able to hook into and log all requests/responses ...


2

Technologically, there is no reason that later classes of bluetooth (2.1 and after) shouldn't be able to be used securely. The 2007 E0 vulnerabilities were addressed in alterations made to the bluetooth spec for 2.1 and later and encryption was made a required portion with alterations made to the pairing process. Given a secure pairing (which can be ...


2

Technically there is no way to couple a MAC address to a person. MAC addresses are easily spoofed. In case the attackers were careless and didn't spoof their MAC address, you can at best try to identify the device vendor (http://www.macvendorlookup.com/). If your tablet or phone are compromised it's best to install them from scratch (from a computer you ...


2

The answer is TMSI generation in real systems is weak and hence it cannot protect from tracking. There is an excellent research done which answers your question. Here is the paper and here is the presentation slides. Here is an executive summary from that paper. Pesudonym (TMSI) changing mechanism impletented in realtime networks is flawed, and hence ...


2

can malware spread when sending a clean file to someone or receiving it via bluetooth ? As you mentioned, malware uses pair-wise communication mechanisms such as Bluetooth to spread. But whether the file you want to send is clean or not does not prevent you (or the destination deice) from being infected because one of the commun ways that malware ...


2

Bluetooth does not create a strong internet signal so anyone connecting to it would have to pair to his device that is tethered. They would have to be in a 60 foot radius of that device in most cases. I don't think there is anything on your home consumer based router that will allow you to block him. Since he connects the Bluetooth device to the computer he ...


1

Active jamming is highly illegal, and if you report it the FCC should respond rapidly. Of course, that depends on your usage model (and your threat model). The problem is that you'd have to determine if it was being deliberately jammed, and not simply interfered with. The nature of the unlicensed bands is that even legal devices can simply have faults ...


1

Discoverable is trying to bind connections, while advertising is broadcasting with only partial access to BLE protocol stack. Because it never connects, advertising should be more secure wherever applicable. The article below gives a very complete description of advertising. "A non-connectable undirected advertising type signals to scanning ...


1

At a bare minimum, you expose the account the service runs as. If the service is subject to attack, then that becomes a vulnerability. This is no different from exposing any other service, except that it is exposing a communications channel. The important question is, "what else on the box is using that communication channel?" You need to chase down the ...


1

The sub-section of the answer you are referring to indicates that refreshing the security pin frequently is a good idea. By no means is bluetooth a secure technology. You can read the rest of that answer or this article for some more info on how bluetooth is vulnerable. If you want specific attacks, just google "CVE bluetooth" and read through. In answer ...


1

Have you taken a look at the Ubertooth project? It's a hardware platform plus a good bit of code to get you started in Bluetooth analysis. Also, I found Mike Ryan's Black Hat presentation from last year to be helpful: (links directly to the pdf)


1

There are two options for this currently, the first is to use a software-defined radio that supports the ISM band (at least 2.4 to 2.485 GHz). This will allow you to grab any radio signals within the bluetooth range and will be especially useful if you're trying to identify interfering signals as you'll be able to look at the big picture of the nearby radio ...


1

One defense technique against jamming is to use frequency hopping. It means that you change your frequency of broadcast (It is an automated process and part of the communication protocol) but I am not sure if you would be able to do it in your case.


1

Jamming is a form of DoS attack on the services using these protocols. Unfortunately, it is very hard to prevent such attacks without doing something to the protocol in question that violates its standard (which also means that you could break compatibility with other devices using the same protocol. Specifically, for broadcasting devices the only way would ...


1

There is nothing you can do against a jammer. The only think I could think of is by somehow using a uni-directional antenna and boosting its signal so you can at least send (with a stronger signal than the jammer, which might even be illegal). However I'm not even sure that you will be able to receive. The only real option to prevent a jammer is by using ...



Only top voted, non community-wiki answers of a minimum length are eligible