5

Does what I'm calling a "barge-in attack" exist for Bluetooth Low Energy? This is a type of Man-in-the-Middle attack, I guess, but unlike in most discourse on BLE security, the attacker does not create two connections, one with the Central and one with the Peripheral, and forward packets between the two. The attacker "barges in" on an active, unencrypted connection by jamming certain packets such that one device drops the connection while the other continues communicating with the attacker, believing that it is the original peer.

For BLE, I think this can be done by jamming Device A's transmissions until Device B's supervision timeout elapses. Wouldn't Device A's Link Layer keep re-transmitting, as Device B's packets will be left intact, just with a non-incrementing Next Expected Sequence Number? Eventually, Device B will stop sending packets, and the attacker may substitute their own for the remainder of the connection.

Also, does this attack have a more common name?

0

Yes, this is possible I think. In a certain way. If you have a bluetooth SIG account: http://go.bluetooth.com/CRw0070Ut0UB04Qu3G04F02

Also already shown with proof of concept at DEF CON 26

If you search for BtleJack at google, you will also find a ready to use tool which is doing exactly what you are describing.

First step is to do a selective jamming: The response packets from slave to master at the beginning of each connection event are jammed. At master side a connection timeout will occur and the attacker can hijack the connection by spoofing the master.

This is not exactly a man-in-the-middle attack. It is replacing the master by your own device. In practice the master will now maybe try to reconnect and you could create the link from master to your device by spoofing the slave.

So this method is maybe not a "barge-in attack" but enforcing reconnect to the wrong device. Dependent on the scenario this may result in the same.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.