bluetooth and security

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

Daniel Brose - 17 May 2004 17:04 GMT

Hi all!

Lately I've heard a lot about security leaks in bluetooth phones like
the SonyEricsson T610 e.g.. I've been told that without obvious pairing
people can use your phone for making calls or sending SMS or "download"
your addressbook. Of course I use "hidden mode" for BT, but that just
makes it more difficult yet not impossible.
What do you guys think about that? Do you switch of BT?

Thanks in advance
Daniel

Reply to this Message

Michael Schmidt - 18 May 2004 09:22 GMT

Hi Daniel,

Daniel Brose schrieb:

> Hi all!
>
[quoted text clipped - 4 lines]
> makes it more difficult yet not impossible.
> What do you guys think about that? Do you switch of BT?

From my understanding, running your BT phone in "non-discoverable mode"
(this is probably what you call "hidden mode") is sufficient. Guessing
the BT address (with "Redfang" or sth. comparable") takes (based on my
tests) about 20 secs per probed address. However, there is an address
space of (at least) 256 ^ 3 addresses (given the manufacturer of your
phone is known to the attacker). So you averagely need 256 ^ 3 * 20 secs
/ 2 = 5 years to find the address of a non-discoverable phone. This is
totally unrealistic.

I'm wondering whether anybody here has made other experiences with
"Redfang" that would make this tool appear more realistic.

Without knowing your device address an attacker is not able to attack
your non-discoverable BT phone.

Michael

Signature

Michael Schmidt
University of Siegen, Germany
http: www.nue.et-inf.uni-siegen.de/~schmidt/
e-mail: schmidt _at_ nue.et-inf.uni-siegen.de

Reply to this Message

Collin R. Mulliner - 18 May 2004 14:28 GMT

Hello,

> From my understanding, running your BT phone in "non-discoverable
> mode"
> (this is probably what you call "hidden mode") is sufficient. Guessing

yes, "hidden mode" should be ok.

> I'm wondering whether anybody here has made other experiences with
> "Redfang" that would make this tool appear more realistic.

not really

> Without knowing your device address an attacker is not able to attack
> your non-discoverable BT phone.

exactly!

... Collin

Signature

Collin R. Mulliner <collin@betaversion.net>
bluetooth device security database - http://betaversion.net/btdsd/

Reply to this Message

Daniel Brose - 18 May 2004 15:09 GMT

Hi all,

Collin R. Mulliner schrieb:

>>Without knowing your device address an attacker is not able to attack
>>your non-discoverable BT phone.
>
> exactly!

thanks a lot for your answers! I feel relieved now... :-)

Regards
Daniel

Reply to this Message

Nosve - 21 May 2004 09:43 GMT

There is a firmware version that correct the t610 behaviour, since the
weakness is in the implementation anche not intrinsic in the bluetooth
protocols.

In italy formware update is free under warranty
Regards.

> Hi all!
>
[quoted text clipped - 7 lines]
> Thanks in advance
> Daniel

Reply to this Message