Two views of Bluetooth security Different security modes Security mechanisms on the host side Linux and HCI sniffing Bluetooth security in action Looking at the BlueSnarf attack Bluetooth architecture Application specific security mechanisms Bluetooth host security mechanisms Security mechanisms on the Bluetooth chip Bluetooth security • Link manager security • All security routines are inside the Bluetooth chip • Nothing is transmitted in “plain text” • Host stack security Interface for link manager security routines Part of the HCI specification Easy interface No further encryption of pin codes or keys Security modes • Security mode 1 • No active security enforcement
Read the rest of this entry »

• 0 Comments

The security mechanisms Known vulnerabilities Tools that are used Live demonstration Who is investigating Adam Laurie CSO of The Bunker Secure Hosting Ltd. DEFCON staff and organizer Maintainer of the Linux Bluetooth stack Marcel Holtmann Martin Herfurt
Security researcher Founder of trifinite.org What is this about What is Bluetooth Bluetooth SIG Trade association Founded 1998 Owns and licenses IP Bluetooth technology A general cable replacement Using the ISM band at 2.4 GHz Protocol stack and application profiles How it works Data and voice transmission ACL data connections SCO and eSCO voice channels Piconet and scatternet topology Frequency hopping 79 channels 1600 hops per second Creating the topology Hopping sequence defines the piconet
Read the rest of this entry »

• 0 Comments

Project Two views of Bluetooth security Different security modes Security mechanisms on the host side Linux and HCI sniffing Bluetooth security in action Looking at the BlueSnarf attack Link manager security • All security routines are inside the Bluetooth chip • Nothing is transmitted in “plain text” • Host stack security • Interface for link manager security routines • Part of the HCI specification • Easy interface • No further encryption of pin codes or keys
Read the rest of this entry »

• 0 Comments