Bluesnarfing: Difference between revisions
ClueBot NG (talk | contribs) m Reverting possible vandalism by 197.186.15.207 to version by InternetArchiveBot. Report False Positive? Thanks, ClueBot NG. (4289759) (Bot) |
HerBauhaus (talk | contribs) Linked to other articles, corrected typos. |
||
| Line 14: | Line 14: | ||
==Prevalence== |
==Prevalence== |
||
Attacks on wireless systems have increased along with the popularity of [[wireless network]]s. Attackers often search for rogue access points, or unauthorized wireless devices installed in an organization's network and allow an attacker to circumvent [[network security]]. Rogue access points and unsecured wireless networks are often detected through war driving, which is using an automobile or other means of transportation to search for a wireless signal over a large area. Bluesnarfing is an attack to access information from wireless devices that transmit using the Bluetooth protocol. With mobile devices, this type of attack is often used to target the [[international mobile equipment identity]] (IMEI). Access to this unique piece of data enables the attackers to divert incoming calls and messages to another device without the user's knowledge. |
Attacks on wireless systems have increased along with the popularity of [[wireless network]]s. Attackers often search for [[Rogue access point|rogue access points]], or unauthorized wireless devices installed in an organization's network and allow an attacker to circumvent [[network security]]. Rogue access points and unsecured wireless networks are often detected through war driving, which is using an automobile or other means of transportation to search for a wireless signal over a large area. Bluesnarfing is an attack to access information from wireless devices that transmit using the Bluetooth protocol. With mobile devices, this type of attack is often used to target the [[international mobile equipment identity]] (IMEI). Access to this unique piece of data enables the attackers to divert incoming calls and messages to another device without the user's knowledge. |
||
==Response== |
==Response== |
||
| Line 22: | Line 22: | ||
==Bluesniping== |
==Bluesniping== |
||
''Bluesniping'' has emerged as a specific form of Bluesnarfing that is effective at longer ranges than normally possible. According to ''Wired'' magazine, this method surfaced at the [[Black Hat Briefings]] and [[DEF CON (convention)|DEF CON]] hacker conferences of 2004 where it was shown on the [[G4techTV]] show ''[[The Screen Savers]]''.<ref>{{cite web |url=http://www.wired.com/news/privacy/0%2C1848%2C64463%2C00.html |title=Wired News: Security Cavities Ail Bluetooth |website=www.wired.com |access-date=12 January 2022 |archive-url=https://web.archive.org/web/20050316041953/http://www.wired.com/news/privacy/0%2C1848%2C64463%2C00.html |archive-date=16 March 2005 |url-status=dead}}</ref> For example, a "rifle" with a directional antenna, [[Linux]]-powered embedded [[Personal computer|PC]], and [[Bluetooth]] module mounted on a [[Ruger 10/22]] folding stock has been used for long-range Bluesnarfing.<ref>{{Cite web | url=https://www.npr.org/templates/story/story.php?storyId=4599106 | title='Rifle' Sniffs Out Vulnerability in Bluetooth Devices | website=NPR.org }}</ref> |
''Bluesniping'' has emerged as a specific form of Bluesnarfing that is effective at longer ranges than normally possible. According to ''[[Wired (magazine)|Wired]]'' magazine, this method surfaced at the [[Black Hat Briefings]] and [[DEF CON (convention)|DEF CON]] hacker conferences of 2004 where it was shown on the [[G4techTV]] show ''[[The Screen Savers]]''.<ref>{{cite web |url=http://www.wired.com/news/privacy/0%2C1848%2C64463%2C00.html |title=Wired News: Security Cavities Ail Bluetooth |website=www.wired.com |access-date=12 January 2022 |archive-url=https://web.archive.org/web/20050316041953/http://www.wired.com/news/privacy/0%2C1848%2C64463%2C00.html |archive-date=16 March 2005 |url-status=dead}}</ref> For example, a "rifle" with a directional antenna, [[Linux]]-powered embedded [[Personal computer|PC]], and [[Bluetooth]] module mounted on a [[Ruger 10/22]] folding stock has been used for long-range Bluesnarfing.<ref>{{Cite web | url=https://www.npr.org/templates/story/story.php?storyId=4599106 | title='Rifle' Sniffs Out Vulnerability in Bluetooth Devices | website=NPR.org }}</ref> |
||
== In popular culture == |
== In popular culture == |
||
In the TV series ''[[Person of Interest (TV series)|Person of Interest]]'', Bluesnarfing, often mistakenly referred to as Bluejacking in the show and at other times forced pairing and phone cloning, is a common element in the show used to spy on and track the people the main characters are trying to save or stop. |
|||
== See also== |
== See also== |
||
Revision as of 06:29, 25 April 2024
 | This article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these messages)
|
Bluesnarfing is the unauthorized access of information from a wireless device through a Bluetooth connection, often between phones, desktops, laptops, and PDAs (personal digital assistant).[1] This allows access to calendars, contact lists, emails and text messages, and on some phones, users can copy pictures and private videos. Both Bluesnarfing and Bluejacking exploit others' Bluetooth connections without their knowledge. While Bluejacking is essentially harmless as it only transmits data to the target device, Bluesnarfing is the theft of information from the target device.[2]
Description
Current mobile software generally must allow a connection using a temporary state initiated by the user in order to be 'paired' with another device to copy content. There seem to have been, in the past, available reports of phones being Bluesnarfed without pairing being explicitly allowed. After the disclosure of this vulnerability, vendors of mobile phone patched their Bluetooth implementations and, at the time of writing[when?], no current phone models are known to be vulnerable to this attack.
Any device with its Bluetooth connection turned on and set to "discoverable" (able to be found by other Bluetooth devices in range) may be susceptible to Bluejacking and possibly to Bluesnarfing if there is a vulnerability in the vendor's software. By turning off this feature, the potential victim can be safer from the possibility of being Bluesnarfed; although a device that is set to "hidden" may be Bluesnarfable by guessing the device's MAC address via a brute force attack. As with all brute force attacks, the main obstacle to this approach is the sheer number of possible MAC addresses. Bluetooth uses a 48-bit unique MAC Address, of which the first 24 bits are common to a manufacturer.[3] The remaining 24 bits have approximately 16.8 million possible combinations, requiring an average of 8.4 million attempts to guess by brute force.
Prevalence
Attacks on wireless systems have increased along with the popularity of wireless networks. Attackers often search for rogue access points, or unauthorized wireless devices installed in an organization's network and allow an attacker to circumvent network security. Rogue access points and unsecured wireless networks are often detected through war driving, which is using an automobile or other means of transportation to search for a wireless signal over a large area. Bluesnarfing is an attack to access information from wireless devices that transmit using the Bluetooth protocol. With mobile devices, this type of attack is often used to target the international mobile equipment identity (IMEI). Access to this unique piece of data enables the attackers to divert incoming calls and messages to another device without the user's knowledge.
Response
Bluetooth vendors advise customers with vulnerable Bluetooth devices to either turn them off in areas regarded as unsafe or set them to undiscoverable.[4] This Bluetooth setting allows users to keep their Bluetooth on so that compatible Bluetooth products can be used but other Bluetooth devices cannot discover them.
Because Bluesnarfing is an invasion of privacy, it is illegal in many countries.
Bluesniping
Bluesniping has emerged as a specific form of Bluesnarfing that is effective at longer ranges than normally possible. According to Wired magazine, this method surfaced at the Black Hat Briefings and DEF CON hacker conferences of 2004 where it was shown on the G4techTV show The Screen Savers.[5] For example, a "rifle" with a directional antenna, Linux-powered embedded PC, and Bluetooth module mounted on a Ruger 10/22 folding stock has been used for long-range Bluesnarfing.[6]
In popular culture
In the TV series Person of Interest, Bluesnarfing, often mistakenly referred to as Bluejacking in the show and at other times forced pairing and phone cloning, is a common element in the show used to spy on and track the people the main characters are trying to save or stop.
See also
References
- ^ Dagon, D.; Martin, T.; Starner, T. (2004-01-01). "Mobile Phones as Computing Devices: The Viruses are Coming!". IEEE Pervasive Computing. 3 (4): 11–15. doi:10.1109/MPRV.2004.21. ISSN 1536-1268. S2CID 14224399.
- ^ Okazaki, Shintaro; Navarro-Bailón, María Ángeles; Molina-Castillo, Francisco-Jose (2012). "Privacy Concerns in Quick Response Code Mobile Promotion: The Role of Social Anxiety and Situational Involvement". International Journal of Electronic Commerce. 16 (4): 91–119. doi:10.2753/JEC1086-4415160404. hdl:10486/669231. ISSN 1086-4415. JSTOR 41739750. S2CID 33349618.
- ^ Bialoglowy, Marek, Bluetooth Security Review, Part 1, http://www.symantec.com/connect/articles/bluetooth-security-review-part-1
- ^ Fuller, John, How Bluetooth Surveillance Works, http://electronics.howstuffworks.com/bluetooth-surveillance1.htm
- ^ "Wired News: Security Cavities Ail Bluetooth". www.wired.com. Archived from the original on 16 March 2005. Retrieved 12 January 2022.
- ^ "'Rifle' Sniffs Out Vulnerability in Bluetooth Devices". NPR.org.
Mark Ciampa (2009), Security+ Guide to Network Security Fundamentals Third Edition. Printed in Canada.
Roberto Martelloni's home page Archived 2017-12-27 at the Wayback Machine with Linux source code of released Bluesnarfer proof-of-concept.