×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

New Way To Crack Secure Bluetooth Devices

Zonk posted more than 8 years ago | from the mind-what-you-say dept.

Security 137

moon_monkey writes "Cryptographers have discovered a way to hack Bluetooth-enabled devices even when security features are switched on, according to a report from New Scientist.com. The discovery may make it even easier for hackers to eavesdrop on conversations and charge their own calls to someone else's cellphone. From the article: 'Our attack makes it possible to crack every communication between two Bluetooth devices, and not only if it is the first communication between those devices,'"

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

137 comments

I love you! (-1, Offtopic)

Anonymous Coward | more than 8 years ago | (#12716308)

I love you so much!!!!

Re:I love you! (0)

Anonymous Coward | more than 8 years ago | (#12716459)

woohoo! finally a nerd got laid ;)

Re:I love you! (-1, Troll)

Anonymous Coward | more than 8 years ago | (#12716462)

Unfortunately, you have always been a useless piece of soggy dog shit. Nobody loves you.

Show me the code (2, Interesting)

Anonymous Coward | more than 8 years ago | (#12716312)


where are these cryptographers and their code ?
and why isnt this mentioned on Butraq or Full Disclosure ?

Re:Show me the code (0)

Anonymous Coward | more than 8 years ago | (#12716335)

I love you too!!!!

Re:Show me the code (-1, Offtopic)

Anonymous Coward | more than 8 years ago | (#12716396)

IN KAZAKHSTAN, I KISS YOU!!!

Re:Show me the code (2, Informative)

moyix (412254) | more than 8 years ago | (#12716871)

Well, here [tau.ac.il] might be a good place to look. The article doesn't actually tell you where to find the research, but it was posted on Schneier's blog this morning.

Cheers,
Brendan

TROLLTALK FAILS IT (-1, Troll)

Anonymous Coward | more than 8 years ago | (#12716317)

8===========D

_
/\)
/ /
( Y) _
"" (/\ _
\ \ /\)
(Y ) / /
"" ( Y)
""

8===========D ~~ ~ ~

Funny quote (3, Insightful)

MyLongNickName (822545) | more than 8 years ago | (#12716326)

"Too many people are thinking of security instead of opportunity. They seem more afraid of life than death. -- James F. Byrnes"

At bottom of Slashdot screen :)

I used to work with James F Byrnes (0)

Anonymous Coward | more than 8 years ago | (#12716356)

He is a really nice and very intelligent person, but had a really nasty habit of picking his nose and eating the booger at meetings. This really grossed people out, but still quite a nice person to work with.

Re:I used to work with James F Byrnes (0)

Anonymous Coward | more than 8 years ago | (#12716754)

No, you didn't.

Article is missing an important detail (2, Interesting)

plover (150551) | more than 8 years ago | (#12716328)

By forcing a re-pairing (as stated in the article) does it then rely on the user to re-pair his devices as a manual step? Or does this re-pair process happen in an automated fashion?

If it's a manual step, then it'll require education of the users to not pair their phones in public.

Re:Article is missing an important detail (3, Informative)

wyoung76 (764124) | more than 8 years ago | (#12716392)

From TFA:

Wool and Shaked have managed to force pairing by pretending to be one of the two devices and sending a message to the other claiming to have forgotten the link key.

So, it's an automatic and remote attack which doesn't rely upon any cooperation from either of the two original Bluetooth devices.

Re:Article is missing an important detail (1)

plover (150551) | more than 8 years ago | (#12716437)

The way I originally read it I didn't understand if this forced pairing required the input of the user to perform a "pairing" manually, (which was then intercepted by the attacker) or if the devices just agreed automatically to resend their pair information (which was then intercepted by the attacker.)

Thanks for the clarification.

Re:Article is missing an important detail (3, Insightful)

Sancho (17056) | more than 8 years ago | (#12716461)

The article isn't clear.

They imply that part of the pairing process is inputting the 4 digit PIN. If this is the case, user intervention would be required for re-pairing. Maybe the article wasn't as precise as possible regarding the process, but it distinctly uses the above terminology which, to me, implies manual input.

Perhaps the devices remember the PIN if the link-key is forgotten, thus removing the need for user intervention? That would explain the bit in the article about trying every PIN (a 4-digit PIN seems pretty ridiculously small, regardless).

Re:Article is missing an important detail (1)

MyLongNickName (822545) | more than 8 years ago | (#12716525)

My understanding is the INITIAL pairing required this, but subsequent pairings did not. Call me a skeptic, but I doubt it would really be that simple.

Re:Article is missing an important detail (2, Insightful)

BranMan (29917) | more than 8 years ago | (#12716625)

There are a few things that aren't clear in TFA, but look pretty alarming.

The article mentions a manual process for inputting a 4 digit PIN to seed the pairing process. Then goes on to state that bluetooth devices can send a 'whoops - forgot our secret key. Sorry. Can we pick a new one?' message that is honored without any intervention by, or alerting of, the user(s) involved. Just having that message - without any authentication or encrytion it seems - defeats the entire security process. WTF?

The second thing is the 4 digit PIN - if the 128 bit key is generated from a 4 digit PIN, and done without randomness (how else could both devices arrive at the same key?) - then you have less than 6 bit keys in effect. WTF?

If this article is accurate the bluetooth security protocols were designed by a bunch of frickin' morons.

<rant> Does getting paid to develop security software render people imbeciles??? It sure seems like it does to me. </rant>

Re:Article is missing an important detail (5, Informative)

MadRocketScientist (792254) | more than 8 years ago | (#12716480)

Digging up their paper [tau.ac.il], it seems that it is not automatic:

If the attack is successful, the Bluetooth user will need to enter the PIN again - so a suspicious user may realize that his Bluetooth device is under attack and refuse to enter the PIN.

Re:Article is missing an important detail (1)

plover (150551) | more than 8 years ago | (#12716699)

Ahh! Thank you for the link to the actual paper! (TFA suggested to me that since they were presenting it at a conference next week they hadn't published it yet. Yet another misread by me. I'm two for two today!)

So I really am safe as long as I'm not entering my PIN in a place where I can be eavesdropped upon. No worries! Whew.

Re:Article is missing an important detail (1)

Sancho (17056) | more than 8 years ago | (#12716407)

It would seem that way.

How does this work with headsets? Where do you enter the PIN on the headset? Or do you ONLY have to do it with the phone?

Also, I hear that some phones do an autonegotiation that doesn't require a PIN at all. It would seem that these would be the most vulnerable to the attack, although what happens when the legitimate device tries to pair at the same time as the spoofer?

Regardless, at the very least this looks like it could be a DOS.

Re:Article is missing an important detail (2, Informative)

plover (150551) | more than 8 years ago | (#12716509)

The headsets I'm familiar with have a preset PIN (something like 0000 or 1111) that you have to enter into the phone. But they can't initiate the pairing process -- it has to be driven from the phone side. I suppose it's entirely possible for an attacker who sees you use a headset to set up his device to sniff your headset's ID, then pretend to be that headset with PIN 1111.

Now a headset has only a limited set of functions it can perform -- they can't dial digits without a keypad, so they're usually restricted to voice recognition of pre-programmed names. So unless you wanted to steal a phonecall to my wife or my son, you probably won't find it very useful.

That is, if headsets are restricted to "no dialing, no OBEX, no service discovery". If headsets are allowed to "change" their profile to suddenly support network dialing, keypads, and all that, then you're in big trouble from spoofers without even worrying about cracking the crypto.

Re:Article is missing an important detail (1)

Badfysh (761833) | more than 8 years ago | (#12716554)

I think on most headsets the PIN is preset and the number is in the manual or on a separate piece of paper. As for auto negotiation, on some phones you can turn off the PIN request.

Re:Article is missing an important detail (0, Redundant)

brontus3927 (865730) | more than 8 years ago | (#12716615)

It's not automatic, but with social engineering, it might as well might me. Most people won't even blink when the message appears on the screen asking for their PIN.

I wonder if cell-phone companies will start having to provide fraud protection to protect if your phone is used fraudulently, like credit-card companies do.

Well... (0)

Anonymous Coward | more than 8 years ago | (#12716334)

Seems like they're keeping their hack top secret..is there anywhere we can find it out? *grins at prospect of free phonecalls*

first post (-1, Offtopic)

Anonymous Coward | more than 8 years ago | (#12716345)

first post

lcxen

A fix... (-1, Flamebait)

jazzman251 (887873) | more than 8 years ago | (#12716346)

Well i didnt RTFA so I dont know if this is a serious problem or not, but I do know of a great way to keep people from haking into my phones bluetooth.
Don't use bluetooth!

To me it seems very unnessesary to have a bt enabled phone. Just so long as I can talk to other people on my phone, then I'm happy.

Re:A fix... (4, Informative)

plover (150551) | more than 8 years ago | (#12716397)

Don't use bluetooth! To me it seems very unnessesary to have a bt enabled phone.

Then not only didn't you RTFA, but apparently you haven't used Bluetooth, either. Bluetooth is an extremely useful mechanism for many of us. It lets my PDA get on line; and when I hop in my vehicle, my car stereo magically becomes my car phone whenever it rings.

I just wish more devices were Bluetooth enabled (and that this security hole didn't exist.) As is, I'm not losing sleep over this as I don't have a public-transit commute (the sort of place where breaks seem most likely to happen.)

Re:A fix... (1)

Have Blue (616) | more than 8 years ago | (#12716482)

Bluetooth is also useful for multiple computers. I've paired my laptop and workstation, so I can send a file between them with a single command- no login/disconnect process, no navigation, just completely ad-hoc click and go. The only limitation is that it tops out around 30K/sec, so it can't be used with really large files.

Re:A fix... (0)

Anonymous Coward | more than 8 years ago | (#12716538)

Wait til you see this new bumper sticker on your daily commute:

"If you can read this, I'm hacking your Bluetooth"

Re:A fix... (1)

Le Marteau (206396) | more than 8 years ago | (#12716971)

As is, I'm not losing sleep over this as I don't have a public-transit commute

Well, as long as you don't get stuck in heavy traffic, you'll probably be OK. I can imagine guys right now, imagining and designing automated systems so they can drive around, hijacking devices, doing nefarious things. Basically a money machine, ala:

1) Create Automated Bluetooth Hack Box
2) ????
3) PROFIT!!!

man this ain't very good news (2, Interesting)

Adult film producer (866485) | more than 8 years ago | (#12716348)

this fucking depressing, can firmware updates fix these streams of bluetooth hacks? Or is the problem so close to the hardware that nothing but scrapping the device and building from ground-up fix it ?

Re:man this ain't very good news (1)

keesh (202812) | more than 8 years ago | (#12716435)

Firmware updates? Heh, good luck to all of you stuck with non-flashable Nokia phones. Even the high end Nokia kit isn't firware-upgradable, which really sucks for those of us with early 3650 models that crash every few hours.

Re:man this ain't very good news (0)

Anonymous Coward | more than 8 years ago | (#12716684)

If you get depressed over bluetooth devices, you may need to consider psychological thearapy or something..

Three words.... (1)

null etc. (524767) | more than 8 years ago | (#12716359)

Time for WUSB...

Re:Three words.... (0)

Anonymous Coward | more than 8 years ago | (#12716477)

You are the only WUSS here!

Re:Three words.... (2, Insightful)

Mike Buddha (10734) | more than 8 years ago | (#12716539)

... and a litany of new security issues. There is no "magic" technology. Get over it.

Why, oh why ? (1, Insightful)

Anonymous Coward | more than 8 years ago | (#12716366)

Why doesn't the telecom industry learn ?

Guys, what about hiring ONE competent cryptographer to design a wireless protocols ?

Re:Why, oh why ? (1)

null etc. (524767) | more than 8 years ago | (#12716408)

Why doesn't the telecom industry learn ? Guys, what about hiring ONE competent cryptographer to design a wireless protocols ?

As with most paid employees, a cryptographer's competence decreases as his job security increases.

It's only a hacker who has nothing legitimately to gain that would find an exploit like this. Unless he's a crazy researcher who put his life on hold to find some obscure flaw with hyperthreading processors.

Re:Why, oh why ? (2, Insightful)

fuzzybunny (112938) | more than 8 years ago | (#12716440)

Nope, most security professionals want to fix bugs. There will always be enough holes in software to make our lives difficult.

Bluetooth in and of itself is a fairly decent protocol for what it was originally designed for (ca. 15m range personal networking). It encounters a lot of limitations in the capabilities of how it is implemented (i.e. static shared PINs, etc.)

And you're mistaken about crazy hackers; I know of quite a few pretty top-end cryptographers still doing good research while employed as pet security bwanas by large banks, IT corporations, etc. Although, I don't know whether you could refer to "job security" when talking about an outfit like IBM research :(

Re:Why, oh why ? (2, Informative)

cebailey (849614) | more than 8 years ago | (#12716463)

Maybe I'm missing a beat here, but TFA says that the communications between Bluetooth devices ARE encrypted...it's simply a Bluetooth device's "heartbeat" that's unencrypted, and it allows for hacking.

Now, if they maybe wanted to use more encryption so the key isn't as breakable, that would be an idea...but it would probably mean more expensive hardware, and longer PINs.

My boss always says security and ease of use are on two opposite ends of a line, and with any system you have to put the 'x' somewhere. Bluetooth chose to plant their 'x' pretty close to the Ease of Use side, which cost them security.

But then again, if I see the little "B" icon on my v600 and my headset's not on my ear, I know SOMETHING's up...

Re:Why, oh why ? (1)

Darktan (817653) | more than 8 years ago | (#12716818)

But then again, if I see the little "B" icon on my v600 and my headset's not on my ear, I know SOMETHING's up...

I'd be more worried if I could see the display when the phone was up to my ear.

panic! Fear! Oh no! (2, Funny)

Matey-O (518004) | more than 8 years ago | (#12716372)

While the last dowzin times I've paired devices HAVE been on the bus. I've noticed the auto generating pins are now 5 to 8 digits long.

Further, it's extremely rare that I even SEE Another bluetooth device on the bos or train. While the phones may be popular, not a whole lotta people are using bluetooth, it seems.

Additionally, the phones I've got default to a Bluetooth radio-off mode...ya can't see them unless you a) turn them on (v600) or b) are already paired (nokia 9820)

Lastly, at 15 feet, there's not a large number of people around you that can pull this off (except that poindexter across the aisle with the laptop and dish antenna pointed at you)

Now, if you're being shadowed at less than 20 feet by a guy with a BT headset, get worried...or turn off your phone...or ignore it, you've got a blue bajillion minutes anyway.

Re:panic! Fear! Oh no! (1)

Profane MuthaFucka (574406) | more than 8 years ago | (#12716533)

You can't hack a bluetooth easily unless you are within 15 feet of a person who also has bluetooth. You also can't catch a cold easily beyond that distance. Yet, my nose is running right now. The odds against me having a runny nose are mind boggling!

Or, maybe not...

Re:panic! Fear! Oh no! (1)

TripMaster Monkey (862126) | more than 8 years ago | (#12716751)


You can't hack a bluetooth easily unless you are within 15 feet of a person who also has bluetooth.

Is that a fact? [tomsnetworking.com]

Re:panic! Fear! Oh no! (1)

Matey-O (518004) | more than 8 years ago | (#12716773)

And there are exactly HOW many 'Toothers out there with a gun shaped antenna?

The article says it can be done. The odds of it happening are _Vanishingly_ small.

Re:panic! Fear! Oh no! (1)

TripMaster Monkey (862126) | more than 8 years ago | (#12716797)


And there are exactly HOW many 'Toothers out there with a gun shaped antenna?

That information is classified. What's your security clearance, Citizen?

The article says it can be done. The odds of it happening are _Vanishingly_ small.

The odds of being struck by lightning are small, too, but sensible people still refrain from golfing in thunderstorms.

Re:panic! Fear! Oh no! (1)

damiangerous (218679) | more than 8 years ago | (#12716889)

Yes, it is a fact. Spending a couple hundred dollars on parts and then requiring a diverse range of skills from welding to electronics assembly is by no stretch of the imagination considered "easily".

Re:panic! Fear! Oh no! (1)

FauxPasIII (75900) | more than 8 years ago | (#12716550)

> Additionally, the phones I've got default to a Bluetooth radio-off mode...
> ya can't see them unless you turn them on

Wouldn't you have to leave it on (and vulnerable) in order to use one of those
fancy wireless headsets tho?

Re:panic! Fear! Oh no! (1)

scd (541350) | more than 8 years ago | (#12716891)

Grandparent is a bit off on the v600. Bluetooth itself needs to be on to use headsets and so forth, but discovery is turned off by default (and can only be turned on for 60 seconds at a time, after which it turns back off).

This means that under usual operating conditions, only devices that have previously paired with the phone can talk to it.

Re:panic! Fear! Oh no! (1)

Dragee (881700) | more than 8 years ago | (#12716692)

15 to 20 feet? Try over a mile away with a BlueSniper Rifle [tomsnetworking.com].

If that gets slashdotted, just UTFSE--bluetooth sniper hack gets you tons of relevant info.

Yes, that's pretty visible on a bus, but what if I stand by the window of my 11-floor office and snipe the mindless drones walking the streets?

The Paper: Cracking the Bluetooth PIN (2, Informative)

Anonymous Coward | more than 8 years ago | (#12716376)



Cracking the Bluetooth PIN [tau.ac.il]


This paper describes the implementation of an attack on the Bluetooth security mechanism. Specifically, we describe a passive attack, in which an attacker can find the PIN used during the pairing process. We then describe the cracking speed we can achieve through three optimizations methods. Our fastest optimization employs an algebraic representation of a central cryptographic primitive (SAFER+) used in Bluetooth. Our results show that a 4-digit PIN can be cracked in less than 0.3 sec on an old Pentium III 450MHz computer, and in 0.06 sec on a Pentium IV 3Ghz HT computer.


--AS

Them's the breaks... (0)

Anonymous Coward | more than 8 years ago | (#12716378)

Them's the breaks of using a wireless medium. Anyone can participate without jacking-on.

Score +10 pseudo insightful!

Finally... (3, Funny)

Mattygfunk1 (596840) | more than 8 years ago | (#12716380)

...an excuse for my "adult" calls on my phone bills.

__
free funny videos [laughdaily.com]

Re:Finally... (3, Insightful)

MyLongNickName (822545) | more than 8 years ago | (#12716423)

Does your mom make you do chores until you pay them off? You'd think once you hit 32, she'd stop doing that.

Re:Finally... (1)

Mattygfunk1 (596840) | more than 8 years ago | (#12716470)

No, but my nosey girlfriend with a headache does. Grrrrrrr.

__
free funny videos [laughdaily.com]

Re:Finally... (2, Funny)

MyLongNickName (822545) | more than 8 years ago | (#12716491)

:) Maybe suggest spankings as an alternative correction measure?

(thank goodness for the 'Post Anonymously' option)

Re:Finally... (2, Funny)

Mike Buddha (10734) | more than 8 years ago | (#12716691)

by MyLongNickName (822545) Alter Relationship on 11:40 AM June 3rd, 2005 (#12716491)

(thank goodness for the 'Post Anonymously' option)


Doh!

Not even surprised (0)

Anonymous Coward | more than 8 years ago | (#12716387)

I'm not even surprised.

What about keyboards (2, Insightful)

Anonymous Coward | more than 8 years ago | (#12716401)

The more important issue here is bluetooth keyboards. Can people use this hack to get my password that I'm typing on a wireless keyboard. (Distance issues aside.)

The article doesn't seem to say.

Serious Flaw (1)

Nytewynd (829901) | more than 8 years ago | (#12716427)

That is an extremely serious flaw. The device sends its key to anyone claiming to forgot theirs? That is a great design. Why wouldn't it only resend the key if it recognized the ID as something it already paired with?

It's like your online bank site giving someone else your password, just because they said they forgot it.

While I doubt this is a widespread serious issue with the small number of bluetooth devices now, it could be an issue on something like a train, where there are a lot of business commuters with both bluetooth gadgets and laptops.

Re:Serious Flaw (1)

ElQuesoEsViejo (81308) | more than 8 years ago | (#12716484)

The hacking device spoofs the ID of the known device, then says "whoopsie, I forgot our pin" causing the repairing, it said that in the article.

Re:Serious Flaw (1)

geekagent (887637) | more than 8 years ago | (#12716519)

It's because the ID is spoofed. IE, it thinks it's sending it to someone they've already paired with, and because it's over the wire, the spoofing device can pick up the re-pairing.

Re:Serious Flaw (2, Informative)

Mike Buddha (10734) | more than 8 years ago | (#12716529)

The device sends its key to anyone claiming to forgot theirs? That is a great design. Why wouldn't it only resend the key if it recognized the ID as something it already paired with? \

RTFA. The hackers device tells the other device that it forgot the key. The pairing is deleted. The user has to re-pair the devices if he wants to use them again. The hacker can listen to that second pairing and use the previously discovered techniques to get the key.

Re:Serious Flaw (1)

amliebsch (724858) | more than 8 years ago | (#12716531)

That is an extremely serious flaw. The device sends its key to anyone claiming to forgot theirs? That is a great design. Why wouldn't it only resend the key if it recognized the ID as something it already paired with?

This has to be Microsoft's fault somehow.

Re:Serious Flaw (1)

Nytewynd (829901) | more than 8 years ago | (#12716540)

Thanks guys. The serious flaw was with my reading comprehension. I must have missed the spoofing part somehow.

It still isn't good, but at least it's not as bad as I thought.

Re:Serious Flaw (2, Informative)

sPaKr (116314) | more than 8 years ago | (#12716561)

It doesn't resend the key. The problem is that an unencrypted easily spoofable message can force the device to renegotiate a new key. This renegotiation is the vulnerable state. Really this just makes the orignal hack easier to preform in that it can happen when at any time instead of initial pairing of the two devices.

Re:Serious Flaw (1)

BandwidthHog (257320) | more than 8 years ago | (#12716748)

The device sends its key to anyone claiming to forgot theirs? [...] It's like your online bank site giving someone else your password, just because they said they forgot it.

It's all a case of "be careful what you wish for..."

Apparently a senior security researcher, in an effort to get an overzealous junior security researcher out of his hair, set him to the task of solving the problem of social engineering, and just to make sure he was occupied until nearly the end of time, told him he had to do it entirely within the existing protocol.

4-digit PIN is the heart of the problem (3, Insightful)

G4from128k (686170) | more than 8 years ago | (#12716448)

Reading between the lines, it seems that the short nature of the PIN code is a key to the exploit. The attacker forces a re-pairing, listens to the re-pairing exchange, and then tries all possible PIN codes to determine which one is the right one. Because a 4-digit PIN has only 10,000 possibilities, it's easy to brute force it.

A longer alphanumeric PIN might be a first step to making this exploit much less practical -- increasing the PIN search time from a fraction of a second to hours or days.

This looks like another classic example of the fundemental tradeoff between usability and security.

Re:4-digit PIN is the heart of the problem (0)

Anonymous Coward | more than 8 years ago | (#12716632)

My BT Pone uses an 8-16 digit PIN when connecting to my PC.

Re:4-digit PIN is the heart of the problem (0)

scrappy64 (824485) | more than 8 years ago | (#12716680)

creating an alpha-numeric pin increases the available characters to 10 digits + 26 letters = 36 characters. That'll increase the number of possible pin combinations to 1,679,616. Furth increasing the pin length to 5 or 6 digits would make 60,466,176 and 2,176,782,336. Then agin this might have an impact on the performance/functionalily...

Not such a big threat (3, Informative)

Zarhan (415465) | more than 8 years ago | (#12716483)

Ok, before this the attacker could only attack when the target link was forming.

With this, you can force them to re-form at will.

Even so, you still need to bruteforce the PIN. The "PIN" is really a 16-byte field, and is not really limited to numeric (or even alphanumeric) characters.

So what can be done:

1) Start using long PIN codes (if your device is limited to numbers, at least use the maximum length)
2) Software update that notifies user of the "forced re-pairing"
3) Allow users to use PIN's beyond the numeric space or possibility to use some pre-shared secret keys.

This affects those of you who use "1234" or similar keys for pairing process for convenience.

peripheral devices (0)

Anonymous Coward | more than 8 years ago | (#12716682)

It is often very easy to find the pin code, as most peripheral dumb devices such as BT headsets come programmed with the pin set to 0000 and cannot be changed.

Whitehouse? (1)

halfelven (207781) | more than 8 years ago | (#12716568)

In April 2004, UK-based Ollie Whitehouse, at that time working for security firm @Stake, showed that even Bluetooth devices in secure mode could be attacked.

He must be a relative to the Whitehouse family in Cryptonomicon and The Baroque Trilogy - everyone in that family was supposed to be a hacker, after all. ;-)

Re:Whitehouse? (0)

Anonymous Coward | more than 8 years ago | (#12716832)

that would be "Waterhouse". noone in BT or Crypto is named whitehouse.

Re:Whitehouse? (0)

Anonymous Coward | more than 8 years ago | (#12716848)

WATERhouse.

P4-eneabled (1)

brontus3927 (865730) | more than 8 years ago | (#12716569)

they can work out the link key in just 0.06 seconds on a Pentium IV-enabled computer

I wonder how long it would take with Pentium 4 disabled.

Maybe a crack - but not really useful (1)

myrashka (452794) | more than 8 years ago | (#12716623)

Ok, so I went and look at my bluetooth devices again (a Motorola cell phone and a Logitech keyboard/mouse) - in both cases, I don't see how this crack would actually work:

- With the Logitech keyboard, you actually have to type in the PIN from the keyboard in order for it to pair.

- The motorola must be told to pair specifically - so if it loses connection with a device, it won't automatically re-pair because I haven't made my phone pairable. To make the phone pairable requires a specific menu sequence and then it's only valid for about 30 seconds (and shuts off again).

In both these cases, I don't see a hacker getting in even with spoofing, because both of those events require user intervention (so perhaps the dumb user won't understand...)

I tried one more thing to confirm this - I got another laptop and named it identically to the first one...so it acted as the first one but without a pairing. Again, the phone ignored the request until I said it could pair (a manual interaction) and the keyboard required me to type in the pin from the keyboard. Btw, my laptop also doesn't allow pairing without explicit user intervention.

So great, they found a theoretical vulnerability, but one with an easy work around and one vendors have already seemed to predict. Besides, how useful can this be? As someone said, if you see someone stalking you, you have bigger problems. And if your keyboard stops working because it's paired to another device, it's unlikely you're going to be typing anything on it.

Find something else to worry about...

Re:Maybe a crack - but not really useful (1)

craftsman (145221) | more than 8 years ago | (#12716759)

Presumably Bluetooth car keys are not open to this attack? anyone know?

Security should not optional (1)

AAeyers (857625) | more than 8 years ago | (#12716669)

...even when security features are switched on.

Why does everything come with security 'features'? Shouldn't everything be as secure as possible out of the box? If it was made inherently secure, it wouldn't need 'features'.

flaw in the article (1)

Keruo (771880) | more than 8 years ago | (#12716676)

FTA: The first step requires the legitimate users to type the same secret, four-digit PIN into both devices.

Pin length isn't fixed in bluetooth.
It can be anything between 1 to 16 numbers.
Sure it's easy to crack if you use one or two digit length,
but with 8 digits or more, it will take much longer to crack using brute force.

Besides, bluetooth always requires authorization before allowing network/dialup access from the modem device, even if it's already paired with the client machine.
Annoying, but gives extra security step.

I didn't know anyone took bluetooth security... (1)

exp(pi*sqrt(163)) (613870) | more than 8 years ago | (#12716758)

...seriously. The giveaway is the 4 digit pin. Of course it's crackable. You don't even have to look at the specs to deduce that.

Solution is longer PIN lengths (1)

mamer-retrogamer (556651) | more than 8 years ago | (#12716768)

By looking at the timing results for their fastest algorithm (algebraic manipulation), it appears that adding a single PIN digit increases the calculation time 10-fold.

Just by making the pin 8 digits, this crack would take over 12 minutes.

And then there's this little tid-bit:

"Note that the attack, as described, is only fully successful against PIN values of under 64 bits. If the PIN is longer, then with high probability there will be multiple PIN candidates, since the two SRES values only provide 64 bits of data to test against. A 64 bit PIN is equivalent to a 19 decimal digits PIN."

-Mike

ok, so what (1)

recharged95 (782975) | more than 8 years ago | (#12716913)

this is really a flaw in the reconnection process. All they need to do is change the reconnection procedure--make it more complex (mathematically that is). For instance, during reconnect the sender's PIN must be encoded and resent (with the previously setup key stored on the sending device--which is likely not on the hackers device).


With the relibility of bluetooth, peer reconnect is uncommon unless a guy w/a big antenna is sitting right next to you trying to disrupt your connection (as mentioned). It's not the PIN nor encryption at fault, just the [lazy] way of reconnecting.

the obvious answer to these Bluetooth hacks... (0)

Anonymous Coward | more than 8 years ago | (#12716973)

and most wireless hacks, actually is this:

Obviously, we all need to carry a small EMP generator and periodically, without warning, suddenly shield our device and the device we're trying to legitimately connect to, then POW blast the EMP and destroy any "outside" devices that may possibly be listening it.
No, this is not impractical. Please begin taking these precautions immediately!

Didn't Apple invent Bluetooth 2.0? (1)

callipygian-showsyst (631222) | more than 8 years ago | (#12716977)

I know Apple was the first to start shipping Bluetooth 2.0? What did they have to do with these security problems?

Few people realize how Apple's responsible for many of the technologies that plague personal computers today. For example, the first computer virus recorded came out in 1982 on Apple hardware [wikipedia.org] and exploited flaws in Apple's early operating system. Apple also had a key role in the development of the MIME attachemnt protocol (via their NeXT subsidiary) that allowed malicious executable software to be mailed around with ease.

Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...