Bluetooth Security Vulnerability

[digi]

I think I said a couple of years ago that Bluetooth was going to be a security issue. Now there is an exploit that interferes with the pairing process after the good guy authenticates his slave device and receives the "AU_RAND" confirmation from the master device . A malicious person can send a 'LMP_not_accepted' message to the master, and the master then thinks the slave has forgotten the authentication key. It can also send a IN_RAND, or a random SRES message After serveral invalid pairing attempts occur, the authentication process with the malicious device will restart and the master will pair with the malicious device. This is with any Bluetooth standard device. No fix is available yet.

Probably not the end of the world, but someday the Windows code in the I-Drive will probably need anti-virus protection!

[UCrewX5]

Very interesting, digi. BTW, I also copied this post in the Bluetooth forum - http://www.xoutpost.com/showthread.php?t=2485

Jeff

[digi]

Here is the Bugtraq ID 13854: http://www.securityfocus.net/bid/13854

[Juanted]

Pair with the malicious device, and then what...? They'll have my address book??? Big deal. I agree it's a security issue, but, there it not much they can do, now, is there?

Also, Bluetooth has a maximum range of 30 feet. My neighbors don't even KNOW what Bluetooth is. If a malicious person wants to mess up my Bluetooth connection, he'd have to do while I'm driving... and only if I am trying to pair my phone as I'm driving.

It just doesn't seem very plausible.

Juan

[digi]

Well, besides the phone book and disclosure of some fairly sensitive information, they can make calls, review your caller ID list of call you received, and a list of calls you made. With external antenna on the hostile device, Bluetooth has a range of up to 3300 feet. Still not much of an issue on your phone, but there ar other bluetooth devices (computers). Once they get into the phone, perhaps the interface would allow other opportunities for mischief in the GPS or Emergency Assist functions.

[Juanted]

I understand that... but it all seems a little far-fetched. Bluetooth devices have to be paired with each other to really do anything that could be considered serious. In other words, even you manage to hijack my pairing information from my phone to my car using a hostile device, it does not mean the hostile device will work with my PC -- that is assuming, of course, that you'd even KNOW where my PC is... or that I even use BT to communicate between my phone and my PC.

For the most part, Bluetooth is being used to pair phones with cars, phones with headphones, and phones with PCs (to transfer adressbooks). If you consider my mom's telephone number "sensitive" information, then yeah... otherwise, we may be making a mountain out of a molehill.

Wanna talk about security breaches? Download PC (or Mac) Stumbler, turn it on, and go driving around your neighborhood with your laptop on. Tell me how many wi-fi networks named "Linsys" you'll see... and ALL of them UNSECURED! Now, THAT'S dangerous.

Juan

[digi]

My original post said this was not the end of the world. Each can assess the risk according to their requirements. It doesn't seem to affect you much.