u8.16 Bluetooth vulnerabilities

u8.16 Bluetooth vulnerabilities

1. The Pin

   • Can be up to 16 digits
     • Long pins = higher security
   • Required in both devices to work correctly
   • Usually left to user to chose so ends up being short so easy to remember
     • reused from other pins
     • Short pins vulnerable to brute force
     • Long complex pins are impractical to enter

2. Unit keys can be reused

   • if 2 devices use 1 key and a 3rd device comes along and the same key is used
     • Then device 3 can intercept any encryption keys passed between device 1 & 2
   • As unit keys last a lifetime any device that shares it can store it for future use

3. Unique Addressing

   • unique BD_ADDR lead to traceability

4. denial of service

   • it’s possible for anyone to transmit on the ISM band & jam bluetooth signal
     • frequency hopping forces a lot more power to be used for a successful jamming attack

5. Man in the middle

   • are possible at lower security levels
     • However an attacker must interrupt the frequency hopping
       • Theoretically possible but not practical

6. Only device is authenticated

   • no guarantee its a legitimate user operating the device
     • if a BT device is stolen the thief can still operate it and use it to authenticate other devices or use exisitng connections