Skip to main content
15 votes
Accepted

Doubts about Bluetooth Secure Authentication

The information in this publication seems to be wrong. Specifically it states Step 4. The slave returns the most significant 32 bits of the h5 output as the computed response, the Signed Response (...
Steffen Ullrich's user avatar
12 votes

Difference between Secure Simple Pairing and Secure Connections in Bluetooth?

Most answers to your questions are given in the spec Bluetooth Core, VOL1.PartA.5 Timeline The following suites exist: BR/EDR Prior to version 2.1 => BR/EDR legacy Version 2.1 => BR/EDR (uses ...
Michael's user avatar
  • 5,493
9 votes

Is it safe to use Bluetooth headphones?

When asking a question of the form "How vulnerable does (thing X) make me?", you first need to consider what kinds of attacks you're at risk of being victimized by. Possible Attacks When using ...
AZB's user avatar
  • 171
8 votes

WiFi Deauth Attack equivilent for bluetooth?

Not that i have ever heard of. Bluetooth communication is not designed like wifi communication. When we drop clients via the method you speak of the communication happens at the 2.4Ghz (or more ...
Nalaurien's user avatar
  • 1,654
7 votes
Accepted

Difference between Bluetooth LE Secure Connections security mode 1 and level 3 and 4?

Intro In relation to another question LE has two main occurrences: Secure Simple Pairing (4.0) Secure Connections (4.2) Both occurrences specify the algorithms that can/must be used in the ...
Michael's user avatar
  • 5,493
7 votes

What is BlueBorne and how to protect myself?

This my condensed notes of the official BlueBorne documentation page published by Armis Labs. General Overview BlueBorne is an attack vector by which hackers can leverage Bluetooth connections to ...
Mike Ounsworth's user avatar
7 votes
Accepted

MAC randomization for Bluetooth?

For bluetooth low energy (BLE), this site mostly explains the problem: https://blog.bluetooth.com/bluetooth-technology-protecting-your-privacy To safeguard user privacy, manufacturers can make use ...
maze's user avatar
  • 301
6 votes

Intercept data sent via bluetooth

There is a better method today if you are using android. The developer tools offer a way to sniff Bluetooth packets into a log that can be opened in Wireshark. Go to Developer Options on your phone ...
Ziv's user avatar
  • 201
6 votes
Accepted

Can I find out what encryption is used by my Android Bluetooth keyboard?

Your specific keyboard uses two-level E0 for encryption and P-192 for key exchange. Bluetooth always uses encryption. However, the different versions use different encryption protocols: So, what ...
forest's user avatar
  • 66.9k
5 votes
Accepted

Is a no-pairing, no-password Bluetooth RFCOMM connection secure?

Chances are you have no resistance against man-in-the-middle attacks. There are two standards here, Bluetooth (BT) and Bluetooth Low Energy (LE). Each has a different approach to encryption and ...
Polynomial's user avatar
  • 135k
5 votes
Accepted

Is bluetooth keyboard more secure than USB keyboard for a malicious firmware?

It doesn't matter whether the device is USB or Bluetooth, nor does it even matter if the device is a keyboard - the same potential attack vector applies. I'll focus on USB here since I'm more familiar ...
Polynomial's user avatar
  • 135k
5 votes
Accepted

Do wireless (2.4 ghz) headphones use encryption?

Bluetooth MAY be encrypted. There are unencrypted modes of both classic bluetooth and BLE which would expose one's audio streams. Let us also not forget that custom BLE profiles may be used however ...
foreverska's user avatar
  • 2,067
4 votes
Accepted

Is it possible to spoof a paired Bluetooth device?

It has been in the past with various devices. It entirely depends on the BT version and implementation on the device. Modern versions of BT (4.x) have good feature sets to prevent these things from ...
HackSlash's user avatar
  • 277
4 votes
Accepted

Is Apple compromising network security with its default settings, which allow users to provide network credentials to other users with one tap?

First off - why would anyone consider this a security risk? Apple's implementation of the WiFi password sharing feature is much better implemented than Microsoft's attempt from a while ago. For ...
thel3l's user avatar
  • 3,404
4 votes

Can a bluetooth speaker contain malware?

It is technically possible, because a Bluetooth device will likely contain firmware and a small CPU (so it's not just a dumb variable resistor and speaker driver). In a purely theoretical sense, it ...
forest's user avatar
  • 66.9k
4 votes
Accepted

What could MitM'ed U2F do?

If the transport security between the User Agent and the Authenticator is broken there are some (debatably minor) issues: The AppID is disclosed when you log into a site (this is usually the domain ...
AndrolGenhald's user avatar
4 votes
Accepted

Can neighbour hear my bluetooth headset?

Can a neighbour with a bluetooth headset hear my TV's bluetooth emission through a wooden wall? If you're asking about if the signal can get through, then the answer is yes. To block a bluetooth ...
AleksanderCH's user avatar
4 votes

Doubts about Bluetooth Secure Authentication

Found the answer. Section 4.2.1.4 of the Bluetooth Core Specification (Version 5.4): they are two different values that are computed independently by each device. In other words, the document explains ...
StefanoTrv's user avatar
3 votes

Is it possible to find the manufacturer of a BLE device from it's mac address?

You can refer to this Wikipedia writeup And yes, Hardware Manufacturer can be identified from the first 3 octet aka OUI Sources: Wikipedia What is an OUI then? An OUI {Organizationally Unique ...
Lester T.'s user avatar
  • 1,293
3 votes
Accepted

Is Bluetooth a secure protocol?

First I would citate @TeunVink 's pretty comment. I don't have anything to give it to... There's a difference between the bluetooth protocol and its implementations. You get patches on the ...
peterh's user avatar
  • 3,030
3 votes

What algorithms are used in Bluetooth Secure Simple Pairing LE for authentication, key generation and encryption?

From NIST, updated October 2016.
Michael's user avatar
  • 5,493
3 votes

What can an attacker do with Bluetooth and how should it be mitigated?

Is it a good idea to remove & re-pair my devices on a set interval (thinking that this is changing the Bluetooth PIN) No, it might not be a good idea. There is an exchange of information during ...
user474708's user avatar
3 votes

Sharing a JWT between devices in close proximity of each other

Answer to Q2: You are not really inventing something here as far as I can see. You are using a very simple One-Time-Code generator. Generate the code locally on the Pi, keep it valid for a ...
Julian Knight's user avatar
3 votes

What things can the other person see about my phone when I pair it using bluetooth?

All information that is available through your phones supported profiles. For modern smart phones this will most likely include: SIM and device contacts SMS messages Your phone uinique bluetooth MAC ...
Jonas Köritz's user avatar
3 votes
Accepted

What can an attacker know with knowledge of a device's BD_ADDR?

It varies by device but in a nutshell with the BD_ADDR attackers can now make use of knowing the devices hopping pattern allowing extracting of data to be possible. The attacker can then force a ...
ISMSDEV's user avatar
  • 3,280
3 votes
Accepted

Wired VS Wireless Mouse & Keyboard Security

USB mice and keyboards are generally "safe" from known vendors and distributors, but then again you cannot really trust anything. nation state etc etc. The Bastille research is based on wireless ...
TheHidden's user avatar
  • 4,345
3 votes
Accepted

Bluetooth low energy encryption using chacha20-poly1305

TLS 1.3 has not removed AES-CCM, and it is not insecure. The issue with CCM modes is simply that they are very inefficient, requiring two invocations of the block cipher for every encryption of a ...
forest's user avatar
  • 66.9k
3 votes

Can code be transmitted through computers’ antennas?

It is a long way from being able to sniff wireless networks out to actively inserting code in an operating system during runtime. Yes, hypothetically this can be done, but it would rely on additional ...
Maarten Bodewes's user avatar
3 votes

Proprietary RF Protocol Security

This is a great question and very important as companies move to industrial IoT, which is where I see this come up the most. I can say, from first hand pentesting experience, that proprietary ...
bashCypher's user avatar
  • 1,885
3 votes
Accepted

Proprietary RF Protocol Security

That article's security advice is so wrong that presenting it borders on engineering negligence. "Security through obscurity" has been known to be a flawed approach for over 160 years. Pretending ...
John Deters's user avatar
  • 34.3k

Only top scored, non community-wiki answers of a minimum length are eligible