0

I have reason to believe that there may be ongoing audio/wireless/Bluetooth hijacking occurring in my network environment.

The issue appears to involve unauthorized access to Bluetooth and wireless devices, potentially leading to audio interception. I've been monitoring network traffic and have observed patterns of unusual or suspicious activities, including unexpected data transfers.

Devices on the local network, particularly Bluetooth headphones and speakers, have exhibited abnormal behavior, such as audio interruptions or unauthorized connections.

I've noticed a significant increase in "Protected Payload" traffic in packet captures. The suspect activity may have been ongoing for an extended period, but I'm unsure about the extent or source of the intrusion.

I've conducted packet captures and network monitoring to gather evidence of the issue.

I've reviewed firewall rules and security configurations to ensure no unauthorized access. I've examined logs and event records for any unusual or unauthorized connections. I've attempted to isolate and troubleshoot affected devices to no avail.

I'm seeking expert advice on how to further investigate, mitigate, and secure my network against these potential audio/wireless/Bluetooth security threats.

3
  • 1
    Can you confirm that the devices send data to a malicious server?
    – v-g
    Commented Sep 8, 2023 at 2:49
  • Why do you think that there is audio interception? What is suspicious? From the few details you have provided, there is nothing malicious, so we can't advise on what to do next. Leaving is with the question "how do I secure my network?" Which is too broad.
    – schroeder
    Commented Sep 8, 2023 at 7:34
  • For next steps in investigation, put the suspected devices in their own network. Analyse from there.
    – schroeder
    Commented Sep 8, 2023 at 7:58

1 Answer 1

1

Your question is too broad to be answered in a helpful way. But

Some generic guidelines:

You suspect eavesdropping over your network and potentially infected devices. A first step to ensure security at all costs is to stop using the devices using an internet connection, but it may not be possible.

A general goal is to ensure that malware is no longer active, and then protect the assets from vulnerability exploitation.

You may check if the devices are correctly configured to provide secure communications:

Do an assessment of how many assets use wireless networks. For each interface (including access points), check which standard is effectively used, which interface and firmware is used.

If the devices provide an OS, AV scanning is a basic thing that no one should avoid. After that, depending on the outcomes, you may need to wipeout the memory and or reset the devices to factory settings.

Wireless devices should use encryption to prevent eavesdropping. This with a secure cipher used by the interface. For example, Wifi devices must use the most secured primitive they can support, WPA2 with AES at a minimum, WPA3 in better cases. Turn off WPS. Use the most up-to-date firmware. Do the same kind of (much more) in deep checks for Bluetooth and NFC devices.

Don't forget the basics of protecting your wireless internet access with a strong password. Also, try to restrict access to devices to only users with Role Based Access Control. It is not impossible that those devices can be manipulated by someone from inside the network first.

Not the answer you're looking for? Browse other questions tagged .