Security researchers nibble at Bluetooth

[InfoSec News <isn () c4i org>]

http://www.theregister.co.uk/content/69/31297.html

By Kevin Poulsen, 
SecurityFocus
19/06/2003 

On Tuesday the organization responsible for the Bluetooth wireless
standard unveiled version 1.2 of its official spec at the Bluetooth
World Congress in Amsterdam. But for real evidence that that the
technology is finally gaining acceptance turn to the conference
program for this summer's DefCon hacker convention, or the front page
of the Packetstorm security tools site. After years of neglect,
security researchers are beginning to gently sink their teeth into the
technology.

Developed as a low-power, low-cost replacement for printer cables and
Palm-style infrared beaming, Bluetooth operates on the same unlicensed
2.4 GHz spectrum as 802.11, but has a much smaller range. It's found
mostly in Europe, in mobile phones, PDAs, laptops, and wireless
headsets, among other things.

The technology has been slower to infiltrate North America, but a slew
of Bluetooth-friendly announcements this month from the likes of HP,
Microsoft and, on Tuesday, cell phone-maker Qualcomm all suggest that
Bluetooth is poised for wide adoption in Canada and the States. At the
same time, June saw a Bluetooth announcement of a different kind in
the computer security world: the release of the first hacking tool
aimed at the technology.

Whimsically dubbed "Redfang," the Linux-based program is a
proof-of-concept tool created by @Stake researcher Ollie Whitehouse.  
It's designed to attack the lightest of several optional layers of
security built into Bluetooth: a stealth mode in which a device
ignores broadcast queries, rendering it invisible to any other devices
that don't know its specific eight-byte address.

Redfang decloaks such hidden devices using brute-force-- it sends
queries over a large range of addresses, and listens for replies. If
the user narrows the search range to the address space of a single
chip vendor, he can complete a scan in 90-minutes at a reliable
transfer rate, says Whitehouse. "It's information leakage, and it
allows you to discover devices you wouldn't normally know were there,"  
the researcher says.


Bluetooth Wardriving

With a reach of about two meters, Bluetooth scanning isn't going to
pick up a laser printer in the office building across the street, but
it might find targets in nearby pockets and purses. "If that two
meters is on a train where you've got lots of people around you with
laptops, cell phones and PDAs, that's a lot of targets to go after,"  
says Whitehouse.

> From there some devices are open books. Virginia-based computer
security consultant Bruce Potter, founder of the Shmoo Group of
security researchers, recalls installing a Bluetooth card for his
Compaq iPAQ handheld computer. When he finished installing the device
driver, he was dismayed to find that the handheld had been set by
default to share all his files with any other Bluetooth device that
had his address. "The only thing that was preventing people from
finding my PDA and accessing all the files on my PDA was that it
wasn't in broadcast mode," says Potter. Redfang could have stripped
him of that level of protection.

An expert on 802.11 security, Potter is scheduled to give a talk at
DefCon in August titled "Bluetooth -- The Future of Wardriving." He
says he expects Bluetooth to follow a similar security curve as Wi-Fi,
with weak defaults a problem at first, followed by the emergence of
sophisticated hacking tools that exploit weaknesses in the protocol
and its implementations. "It's a very complicated protocol that's
really apt to be misimplementation, and security is likely to be the
first thing that drops to the floor," says Potter.

For now, Redfang is just scratching the surface. Bluetooth has other
security layers that are likely to prove more resistant to attack,
including an optional 14-digit PIN code that one device uses to unlock
another. Further, the lowest layers of Bluetooth are implemented in
hardware, making eavesdropping far more difficult than in 802.11b. The
1.2 specification released Tuesday introduced a new optional
"Anonymity Mode," designed to complicate spoofing attacks by masking a
device's address.

Whitehouse says he wrote his tool to throw out the first ball. "I
wanted to get Redfang out there to say, 'Everybody, you've looked at
802.11 and that's all well and good... now we need to refocus away
from that and look at newer technologies.'" © SecurityFocus



-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn'
in the BODY of the mail.