Two views of Bluetooth security Different security modes Security mechanisms on the host side Linux and HCI sniffing Bluetooth security in action Looking at the BlueSnarf attack Bluetooth architecture Application specific security mechanisms Bluetooth host security mechanisms Security mechanisms on the Bluetooth chip Bluetooth security • Link manager security • All security routines are inside the Bluetooth chip • Nothing is transmitted in “plain text” • Host stack security Interface for link manager security routines Part of the HCI specification Easy interface No further encryption of pin codes or keys Security modes • Security mode 1 • No active security enforcement

• Security mode 2 • Service level security • On device level no difference to mode 1 • Security mode 3 • Device level security • Enforce security for every low-level connection HCI abstraction Upper HCI (protocol stack) Commands Events ACL Lower HCI (hardware interface) SCO
ACL = L2CAP data SCO = Audio data Security commands HCI_Create_New_Unit_Key HCI_{Read|Write}_Pin_Type HCI_{Read|Write|Delete}_Stored_Link_Key HCI_{Read|Write}_Authentication_Enable HCI_{Read|Write}_Encryption_Mode HCI_Authentication_Requested HCI_Set_Connection_Encryption HCI_Change_Local_Link_Key HCI_Master_Link_Key

Download pdf Understanding Bluetooth Security with Linux