Hacking Bluetooth Enabled Mobile Phones and Beyond
Short summary:
Bluetooth Scatternet. All security routines are inside the Bluetooth chip. Bluetooth Technology Data and voice transmission ACL data connections SCO and eSCO voice channels Symmetric and asymmetric connections Frequency hopping ISM band ...
Long summary:
Hacking Bluetooth enabled mobile phones and beyond Full Disclosure Adam Laurie, Marcel Holtmann, Martin Herfurt Hacking Bluetooth enabled mobile phones and beyond Full Disclosure Blackhat Security Briefings April 1st 2005, Amsterdam, the Netherlands Adam Laurie, Marcel Holtmann, Martin Herfurt Who we are Adam Laurie CSO of The Bunker Secure Hosting Ltd. Co-Maintainer of Apache-SSL DEFCON Staff/Organiser Marcel Holtmann Maintainer and core developer of the Linux Bluetooth Stack BlueZ Martin Herfurt Security Researcher Founder of trifinite.org Adam Laurie, Marcel Holtmann, Martin Herfurt Bluetooth Technology Overview Bluetooth SIG Trade Association Founded 1998 Owns & Licenses IP Individual membership free Promoter members: Agere, Ericsson, IBM, Intel, Microsoft, Motorola, Nokia and Toshiba Consumer http://www.bluetooth.com Technical http://www.bluetooth.org Adam Laurie, Marcel Holtmann, Martin Herfurt Adam Laurie, Marcel Holtmann, Martin Herfurt Bluetooth Technology Data and voice transmission ACL data connections SCO and eSCO voice channels Symmetric and asymmetric connections Frequency hopping ISM band at 2.4 GHz 79 channels 1600 hops per second Multi-Slot packets Adam Laurie, Marcel Holtmann, Martin Herfurt Bluetooth Piconet Bluetooth devices create a piconet One master per piconet Up to seven active slaves Over 200 passive members are possible Master sets the hopping sequence Transfer rates of 721 Kbit/sec Bluetooth 1.2 and EDR (aka 2.0) Adaptive Frequency Hopping Transfer rates up to 2.1 Mbit/sec Adam Laurie, Marcel Holtmann, Martin Herfurt Bluetooth Scatternet Connected piconets create a scatternet Master in one and slave in another piconet Slave in two different piconets Only master in one piconet Scatternet support is optional Adam Laurie, Marcel Holtmann, Martin Herfurt Bluetooth Architecture Hardware layer Radio, Baseband and Link Manager Access through Host Controller Interface Hardware abstraction Standards for USB and UART Host protocol stack L2CAP, RFCOMM, BNEP, AVDTP etc. Profile implementations Serial Port, Dialup, PAN, HID etc. Adam Laurie, Marcel Holtmann, Martin Herfurt Bluetooth Stack Security mechanisms on the Bluetooth chip Bluetooth host security mechanisms Application specific security mechanisms Adam Laurie, Marcel Holtmann, Martin Herfurt Bluetooth Security Link manager security All security routines are inside the Bluetooth chip Nothing is transmitted in plain text Host stack security Interface for link manager security routines Part of the HCI specification Easy interface No further encryption of pin codes or keys Adam Laurie, Marcel Holtmann, Martin Herfurt Security Mode Security mode 1 No active security enforcement Security mode 2 Service level security On device level no difference to mode 1 Security mode 3 Device level security Enforce security for every low-level connection Adam Laurie, Marcel Holtmann, Martin Herfurt Linux and Bluetooth hciconfig -a hci0: Type: USB BD Address: 00:02:5B:A1:88:52 ACL MTU: ...
Source: www.blackhat.com
Related
Bluetooth Security, have developed more sophisticated ways of
violating Bluetooth security, and the
problem ... Bluetooth is also ideal for
creating small wireless security ...,
more
Security Comparison: Bluetooth, security architectures. With the
differences between Bluetooth technology
and ... Accordingly practical studies on
Bluetooth security have been focused on
...,
more
Bluetooth - Threats and Security Measures, ... aimed at security officers and end
users of Bluetooth devices. It ... The
Bluetooth device does not itself initiate
any special security mechanisms, ...,
more
