Bluetooth Security
With popular television shows like CSI Cyber and Mr. Robot showcasing cybercriminals exploiting Bluetooth to gain access to their victims’ devices, Bluetooth security has become increasingly popular in the consumer market. But do you really know how safe you are from Bluetooth attacks?
Analysis
Bluetooth is a wireless protocol that works by transferring data between devices using radio waves, making connections faster and easier to establish. This wireless standard encapsulates a large range of devices from wireless locks and hands-free calling devices to IOT devices such as smart light bulbs and smart pressure cookers. Our entire life can be controlled over Bluetooth with a one time verification for added security. Over the course of the past couple years, Bluetooth has solidified its reputation as one of the most popular forms of wireless connectivity. One of the direct results of this popularity is an increased urgency to address the security vulnerabilities present in the protocol.
Due to Bluetooth’s wide variety of applications and its functional range constantly expanding with each new release, maintaining its security is a growing concern. The current Bluetooth build, 4.0, has a maximum range of approximately 200 feet (60.96 meters). However, the soon-to-release Bluetooth 5.0 claims to double its speed and quadruple its range. This is to expected to be rolled out late 2016 – early 2017.
Process
The Bluetooth Team has been conducting research on two tools: Pwnie Express’s BlueHydra and Econocom Digital Security’s Btlejuice, both of which are used to exploit current vulnerabilities in Bluetooth’s framework. In order to increase awareness regarding the security of Bluetooth enabled devices, various tests will be conducted to understand the amount of information that can be collected and taken advantage of using these tools. To do so, the LCDI has gathered an array of devices that will be tested throughout the project, such as Bluetooth locks, trackers, and keyboards.
Conclusion
As Bluetooth compatible devices become increasingly popular, its exploits put a wider range of personal devices at risk. We hope to gather information regarding each tool’s features and what exactly an attacker can do to a Bluetooth-enabled device. With many exciting tests coming up and our experience with BlueHydra and Btlejuice increasing, we hope to publish an interesting final report to share with you for the end of the semester. Stay tuned!
Questions or comments? Please share with us in the comment section below! You can also reach out to our Twitter and Facebook or email us at champforensics@gmail.com.