Bluetooth hack shocks community
#76 I suppose this was inevitable. Everyone breathed a sigh of relief when the rumors of Lexus bluetooth car kits being hacked were dispelled(see blog entry on 16th May.)
But now, two researchers - Yaniv Shaked and Avishai Wool of Tel Aviv University in Israel - have come up with an exploit which allows hackers to pair with devices without alerting their owner, even with all the bluetooth security features turned on. The approach gets around limitations of a security attack first described by Ollie Whitehouse of security firm @Stake last year. This earlier method meant an attacker needed to eavesdrop the initial connection process (pairing) between two Bluetooth devices, which only occurs infrequently.
Shaked and Wool have worked out a way to force this pairing process by masquerading as a device, already paired with a target, that has supposedly forgotten a link key used to secure communications. This initiates a fresh pairing session which a hacker can exploit to snaffle the link key and thereby establish a pairing without needed to know PIN details. Once a connection is set up, an attacker could make eavesdrop on data transmitted between a target devices and a PC or (at least potentially) take control of someone's Bluetooth device. "Once an attacker has forced two devices to pair, they can work out the link key in just 0.06 seconds on a Pentium IV-enabled computer.
Shaked and Wool are scheduled to outline their research at the MobiSys conference in Seattle this week.
But now, two researchers - Yaniv Shaked and Avishai Wool of Tel Aviv University in Israel - have come up with an exploit which allows hackers to pair with devices without alerting their owner, even with all the bluetooth security features turned on. The approach gets around limitations of a security attack first described by Ollie Whitehouse of security firm @Stake last year. This earlier method meant an attacker needed to eavesdrop the initial connection process (pairing) between two Bluetooth devices, which only occurs infrequently.
Shaked and Wool have worked out a way to force this pairing process by masquerading as a device, already paired with a target, that has supposedly forgotten a link key used to secure communications. This initiates a fresh pairing session which a hacker can exploit to snaffle the link key and thereby establish a pairing without needed to know PIN details. Once a connection is set up, an attacker could make eavesdrop on data transmitted between a target devices and a PC or (at least potentially) take control of someone's Bluetooth device. "Once an attacker has forced two devices to pair, they can work out the link key in just 0.06 seconds on a Pentium IV-enabled computer.
Shaked and Wool are scheduled to outline their research at the MobiSys conference in Seattle this week.
posted by Dwaine at 6/09/2005
0 Comments:
Post a Comment
<< Home