Schneier on Security

65535 • July 25, 2018 4:19 PM

There is an interesting list of “Affected” devices and Microsoft is not affected [on all products?].

Apple Affected
Broadcom Affected
Google Affected
QUALCOMM Incorporated Affected
Microsoft Not Affected
RSA Security LLC Not Affected
Bluetooth SIG Unknown
Linux Kernel Unknown

see:
Vulnerability Notes Database

https://www.kb.cert.org/vuls/id/304725

I would assume that Microsoft would be affected because of it wide use of Intel chips. Now, maybe Microsoft’s OS is not affected but the Intel chips associated with the key exchange would be. How odd.

65335 • July 26, 2018 12:36 AM

@ echo and Hmm

I am not so sure that pairing or bonding is a small issue for early or pre v2.1 Bluetooth devices. Bluetooth is a corner of the security field I don’t know much about.

Some people have said the Paris Hilton nude photos were due to a bluetooth attack or a leak at the mobile phone company. Who knows. I don’t use bluetooth but I guess the man-in-middle attacks or stingray attacks is somewhat similar.

[Wikipedia]

“Pairing and bonding
“Pairing mechanisms changed significantly with the introduction of Secure Simple Pairing in Bluetooth v2.1. The following summarizes the pairing mechanisms: “Legacy pairing: This is the only method available in Bluetooth v2.0 and before. Each device must enter a PIN code; pairing is only successful if both devices enter the same PIN code. Any 16-byte UTF-8 string may be used as a PIN code; however, not all devices may be capable of entering all possible PIN codes.” -Wkipedia

“Security concerns
“Prior to Bluetooth v2.1, encryption is not required and can be turned off at any time. Moreover, the encryption key is only good for approximately 23.5 hours; using a single encryption key longer than this time allows simple XOR attacks to retrieve the encryption key.”- wikipedia

https://en.wikipedia.org/wiki/Bluetooth#Pairing_and_bonding

and

https://en.wikipedia.org
/wiki/Mobile_security#Attacks_based_on_communication_networks

“Principle of Bluetooth-based attacks
“Security issues related to Bluetooth on mobile devices have been studied and have shown numerous problems on different phones. One easy to exploit vulnerability: unregistered services do not require authentication, and vulnerable applications have a virtual serial port used to control the phone. An attacker only needed to connect to the port to take full control of the device.[23] Another example: a phone must be within reach and Bluetooth in discovery mode. The attacker sends a file via Bluetooth. If the recipient accepts, a virus is transmitted. For example: Cabir is a worm that spreads via Bluetooth connection.[13] The worm searches for nearby phones with Bluetooth in discoverable mode and sends itself to the target device. The user must accept the incoming file and install the program. After installing, the worm infects the machine.” -Wikipedia

[See bottom of section and Bluetooth]

https://en.wikipedia.org/wiki/Mobile_security#Attacks_based_on_vulnerabilities_in_software_applications

“Any device with its Bluetooth connection turned on and set to “discoverable” (able to be found by other Bluetooth devices in range) may be susceptible to Bluejacking and possibly to Bluesnarfing if there is a vulnerability in the vendor’s software. By turning off this feature, the potential victim can be safer from the possibility of being Bluesnarfed; although a device that is set to “hidden” may be Bluesnarfable by guessing the device’s MAC address via a brute force attack. As with all brute force attacks, the main obstacle to this approach is the sheer number of possible MAC addresses. Bluetooth uses a 48-bit unique MAC Address, of which the first 24 bits are common to a manufacturer.[1] The remaining 24 bits have approximately 16.8 million possible combinations, requiring an average of 8.4 million attempts to guess by brute force. Attacks on wireless systems have increased along with the popularity of wireless networks. Attackers often search for rogue access points, or unauthorized wireless devices installed in an organization’s network and allow an attacker to circumvent network security. Rogue access points and unsecured wireless networks are often detected through war driving, which is using an automobile or other means of transportation to search for a wireless signal over a large area. Bluesnarfing is an attack to access information from wireless devices that transmit using the Bluetooth protocol. With mobile devices, this type of attack is often used to target the international mobile equipment identity (IMEI). Access to this unique piece of data enables the attackers to divert incoming calls and messages to another device without the user’s knowledge.”- Wikipedia

https://en.wikipedia.org/wiki/Bluesnarfing

“Bluebugging manipulates a target phone into compromising its security, this to create a backdoor attack before returning control of the phone to its owner. Once control of a phone has been established, it is used to call back the hacker who is then able to listen in to conversations. The Bluebug program also has the capability to create a call forwarding application whereby the hacker receives calls intended for the target phone… further development of Bluebugging has allowed for the control of target phones through Bluetooth phone headsets, It achieves this by pretending to be the headset and thereby “tricking” the phone into obeying call commands. Not only can a hacker receive calls intended for the target phone, he can send messages, read phonebooks, and examine calendars.”-wikipedia

https://en.wikipedia.org/wiki/Bluebugging

I would like to hear from somebody knowledgeable about Bluetooth security and how to know when one is using a Bluetooth v2.1 device and the related risks. I am guessing that scamming Bluetooth is about as easy as a fake radio AP device as a man in the middle, or the stingray spoofing attacks that are documented. Any Bluetooth experts out there care to speak up?

[note]: some urls may not word wrap correctly and you will have to make the corrections.