Feeds

Security researchers nibble at Bluetooth

Say hello to Redfang

  • alert
  • submit to reddit

Business security measures using SSL

On Tuesday the organization responsible for the Bluetooth wireless standard unveiled version 1.2 of its official spec at the Bluetooth World Congress in Amsterdam. But for real evidence that that the technology is finally gaining acceptance turn to the conference program for this summer's DefCon hacker convention, or the front page of the Packetstorm security tools site. After years of neglect, security researchers are beginning to gently sink their teeth into the technology.

Developed as a low-power, low-cost replacement for printer cables and Palm-style infrared beaming, Bluetooth operates on the same unlicensed 2.4 GHz spectrum as 802.11, but has a much smaller range. It's found mostly in Europe, in mobile phones, PDAs, laptops, and wireless headsets, among other things.

The technology has been slower to infiltrate North America, but a slew of Bluetooth-friendly announcements this month from the likes of HP, Microsoft and, on Tuesday, cell phone-maker Qualcomm all suggest that Bluetooth is poised for wide adoption in Canada and the States. At the same time, June saw a Bluetooth announcement of a different kind in the computer security world: the release of the first hacking tool aimed at the technology.

Whimsically dubbed "Redfang," the Linux-based program is a proof-of-concept tool created by @Stake researcher Ollie Whitehouse. It's designed to attack the lightest of several optional layers of security built into Bluetooth: a stealth mode in which a device ignores broadcast queries, rendering it invisible to any other devices that don't know its specific eight-byte address.

Redfang decloaks such hidden devices using brute-force-- it sends queries over a large range of addresses, and listens for replies. If the user narrows the search range to the address space of a single chip vendor, he can complete a scan in 90-minutes at a reliable transfer rate, says Whitehouse. "It's information leakage, and it allows you to discover devices you wouldn't normally know were there," the researcher says.

Bluetooth Wardriving

With a reach of about two meters, Bluetooth scanning isn't going to pick up a laser printer in the office building across the street, but it might find targets in nearby pockets and purses. "If that two meters is on a train where you've got lots of people around you with laptops, cell phones and PDAs, that's a lot of targets to go after," says Whitehouse.

From there some devices are open books. Virginia-based computer security consultant Bruce Potter, founder of the Shmoo Group of security researchers, recalls installing a Bluetooth card for his Compaq iPAQ handheld computer. When he finished installing the device driver, he was dismayed to find that the handheld had been set by default to share all his files with any other Bluetooth device that had his address. "The only thing that was preventing people from finding my PDA and accessing all the files on my PDA was that it wasn't in broadcast mode," says Potter. Redfang could have stripped him of that level of protection.

An expert on 802.11 security, Potter is scheduled to give a talk at DefCon in August titled "Bluetooth -- The Future of Wardriving." He says he expects Bluetooth to follow a similar security curve as Wi-Fi, with weak defaults a problem at first, followed by the emergence of sophisticated hacking tools that exploit weaknesses in the protocol and its implementations. "It's a very complicated protocol that's really apt to be misimplementation, and security is likely to be the first thing that drops to the floor," says Potter.

For now, Redfang is just scratching the surface. Bluetooth has other security layers that are likely to prove more resistant to attack, including an optional 14-digit PIN code that one device uses to unlock another. Further, the lowest layers of Bluetooth are implemented in hardware, making eavesdropping far more difficult than in 802.11b. The 1.2 specification released Tuesday introduced a new optional "Anonymity Mode," designed to complicate spoofing attacks by masking a device's address.

Whitehouse says he wrote his tool to throw out the first ball. "I wanted to get Redfang out there to say, 'Everybody, you've looked at 802.11 and that's all well and good... now we need to refocus away from that and look at newer technologies.'" © SecurityFocus

Security and trust: The backbone of doing business over the internet

More from The Register

next story
Brit telcos warn Scots that voting Yes could lead to HEFTY bills
BT and Co: Independence vote likely to mean 'increased costs'
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
ISPs' post-net-neutrality world is built on 'bribes' says Tim Berners-Lee
Father of the worldwide web is extremely peeved over pay-per-packet-type plans
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
Radio hams can encrypt, in emergencies, says Ofcom
Consultation promises new spectrum and hints at relaxed licence conditions
Turnbull: NBN won't turn your town into Silicon Valley
'People have been brainwashed to believe that their world will be changed forever if they get FTTP'
Google+ GOING, GOING ... ? Newbie Gmailers no longer forced into mandatory ID slurp
Mountain View distances itself from lame 'network thingy'
Blockbuster book lays out the first 20 years of the Smartphone Wars
Symbian's David Wood bares all. Not for the faint hearted
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.