Hacking Bluetooth

Having your name and number in Paris Hilton's cell phone directory is like openly publishing them on the Web. The miscreants who posted the heiress' contacts online last winter got them by hacking into her smart phone through a Bluetooth radio.Is Bluetooth technology, the underutilized short-range wireless communications you might currently have in your cell phone, PDA or notebook PC, vulnerable to attack? In short, yes'but then again, everything is vulnerable to attack. Despite erroneous reports that Paris' smart phone was leaking info like a sieve (turns out it didn't even have a Bluetooth radio), the good news is that current Bluetooth wireless products are'for the most part'safe and secure under most conditions. After weeks of trying to break into Bluetooth devices, the GCN Lab knows. Here's what we found out.Bluetooth, like its equally scrutinized wireless cousin WiFi, uses radio frequencies to move data. But that's where the similarities end. WiFi establishes a fixed connection between a node and a network that relies on an exchange of IP addresses. Bluetooth was developed to create a simpler, smaller connection between two peripherals. As such, Bluetooth connections bypass several network protocols and don't require an exchange of IP addresses. This characteristic of Bluetooth alone makes it more secure than WiFi because the connection is ephemeral and independent of IP addresses.Bluetooth is like a sonar connection between two peripherals. Data hops to and from devices during each periodic ping. WiFi, on the other hand, represents a constant stream of data between an access point and a wireless client. Such a steady stream could be intercepted by a third party.Bluetooth exploits are well known [see sidebar], but as with other networking communications, as long as Bluetooth users keep their devices up-to-date with the latest technologies, including patches and fixes, and follow up with a good dose of common sense, they can be kept fairly secure.Admittedly, it hasn't always been that way. Early versions of Bluetooth, like early versions of WiFi, had significant vulnerabilities. But that's changing. Prior to our Bluetooth hacking binge, we sat down with an expert to understand the current state of Bluetooth and the nature of attacks.Spencer Parker, European technical director for AirDefense Inc. of Alpharetta, Ga., said threats to Bluetooth devices have decreased over the last two years thanks to firmware redesigns and upgrades. That's no small admission from an expert whose company benefits from more Bluetooth security vulnerabilities, not fewer.Other reasons for the drop in Bluetooth attacks are that the software needed to mount an attack is often difficult to obtain, the hardware and programs designed to attack devices are expensive, and sophisticated Bluetooth hacks normally require advanced knowledge of Linux and command prompt code, Parker said. And when vast quantities of personal data seem increasingly vulnerable through other means (ChoicePoint, Bank of America, etc.), why would a hacker bother breaking into a PDA that might or might not yield useful information?Of course, no one should take a laissez faire stance on Bluetooth. Many experts still warn the technology is insecure, and the Bluetooth Special Interest Group (www.bluetooth.com), the standard's leading trade association, continues to refine its security models to stay ahead of the bad guys. At last summer's most prominent hacker conference, DefCon in Las Vegas, security experts demonstrated how they could take over Bluetooth-enabled devices, sending vendors scrambling to update their products.Last month, two Israeli experts explained how Bluetooth is vulnerable to eavesdropping. No one has yet exploited the vulnerability, and to do so, they said, would require $2,000 worth of equipment.Parker said the greatest danger to Bluetooth users today lies in out-of-date software. In addition, agencies often don't know what Bluetooth-enabled devices they have. The list could include not only PDAs and cell phones, but also notebooks, desktops and peripherals that the IT staff either doesn't know have Bluetooth radios or doesn't know are broadcasting a signal.AirDefense makes software called BlueWatch ($320 for government buyers) that scans offices for rogue Bluetooth signals and reports information back to the network administrator.BlueWatch can also identify what services, such as network access, are available on Bluetooth devices so agencies can identify devices that pose a security risk and shut them down.Parker and others offer a list of recommendations for securing Bluetooth connections [see sidebar], chief among which is to make sure your mobile device is running the vendor's latest firmware. Even more basic advice: Know if the mobile device you plan to use has a Bluetooth radio and then immediately learn how to deactivate it. If you must turn it on, pair up only with other trusted devices.The National Institute of Standards and Technology also issued Bluetooth guidance. To read it, go to and enter 457 in the GCN.com/box.In the early 1990s, network security expert Dan Farmer and a colleague wrote an important paper that essentially laid out how hackers could break into networks. Shortly after, they created the Security Administrator's Tool for Analyzing Networks. The underlying premise was that you couldn't protect your networks unless you thought like a hacker.In that spirit, the GCN Lab set about hacking Bluetooth devices. We pulled together a variety of systems, including a Hewlett-Packard iPaq, an MPC TransPort X3100 notebook, an old Nokia 3650 cell phone and a much newer Sony Ericsson P910a smart phone. As Parker and others suggested, we found that hacking a Bluetooth device grows harder the newer the product we tried to crack, although launching denial-of-service attacks was fairly easy. A Bluetooth DOS attack means simply sending requests to another Bluetooth device (provided you can locate it) until you wear it down, but it doesn't involve stealing information.We also found that you don't need to hack a device to gain access to its contents. By merely requesting a hook-up from our iPaq to the Nokia 3650 (and simulating the 3650 user accepting the link) we were able to access all the contents of the Nokia device. Newer handhelds offer security measures to restrict access.We ended up using the iPaq and the TransPort to launch most of our attacks. Both come with Bluetooth locators for finding nearby devices. The iPaq uses AirDefense's BlueWatch; the TransPort comes with BlueSoleil from IVT Corp. We also downloaded a pair of Bluetooth hacking tools, namely BlueSniffer and RedFang.We first trained our sights on the Nokia 3650. Legitimately pairing with the phone was easy, but we wanted to launch a bluesnarf (in which we access contents) or bluebug (in which we gain control) attack. No luck. None of the software we tried got us access to the device, which isn't to say there isn't software out there that could.Even when we established a legitimate connection to the 3650, we couldn't manipulate its controls.So we turned to bluejacking (basically sending unwanted data to a target device). It took us seconds to bluejack the 3650. Once we sent the unwanted message, the hypothetical recipient could accept or deny it. When we simulated a rational person denying the bluejack message, we then easily launched a DOS attack by repeatedly sending the same message. We were able to run down the 3650's battery in just 15 minutes.Overall, it was much harder to attack the Sony Ericsson P910a. The BlueSoleil program on the TransPort notebook was unable to determine the maker of the P910a, and the BlueWatch software on the iPaq successfully ID'd the smart phone but could not turn up the list of services running on it. Still, we encountered one interesting vulnerability.It turned out the P910a did not require personal information number pairing to set up certain services, such as dial-up networking and file transfer. PIN pairing is a fairly basic security precaution in Bluetooth devices designed to ensure connections only between trusted devices.Using the TransPort notebook, we were able simply to request file transfer services from the P910a. The hypothetical P910a users still had to tap 'accept' on the smart phone screen, but did not have to use a PIN. If the user didn't know what he was doing or accidentally tapped the accept button, a crude bluesnarf attack could ensue.We were unable to bluebug the P910a. However, as with the 3650, we could bluejack it and launch a DOS attack that ran down its battery and emptied its memory in 25 minutes. Keep in mind, though, that bluejacking requires the hacker be within 10 meters of his target. If you ever think you're being bluejacked, the best security measure is to walk away.Yes, Bluetooth is imperfect. Yes, it can be attacked. But in our experience, hacking Bluetooth is more trouble than it's worth. If you keep your devices updated and take fairly simple precautions, you're unlikely to become a target.