BluetoothBluetooth

ByBy Andrew Breen Andrew Breen andand Chris Backo Chris Backo

Presentation OverviewPresentation Overview

Bluetooth overviewBluetooth overviewBluetooth vs. WiFiBluetooth vs. WiFiProductsProductsInstallationInstallationDemonstrationDemonstrationSecurity IssuesSecurity Issues

What is Bluetooth?What is Bluetooth?

Bluetooth devices allow wireless communication. Bluetooth devices allow wireless communication. It operates at 2.4 GHz and is capable of It operates at 2.4 GHz and is capable of transmitting voice and data. transmitting voice and data. The effective range of Bluetooth devices is 32 The effective range of Bluetooth devices is 32 feet. Some devices may have an extended feet. Some devices may have an extended rangerangeBluetooth transfers data at the rate of 721 Kbps.Bluetooth transfers data at the rate of 721 Kbps.It uses similar frequencies to microwave ovens It uses similar frequencies to microwave ovens and cordless phones, but it should not interfere and cordless phones, but it should not interfere or be interrupted as a result.or be interrupted as a result.

What is it for?What is it for?

Bluetooth can be used to wirelessly Bluetooth can be used to wirelessly transfer data among devices. transfer data among devices. Some examples of it’s use are:Some examples of it’s use are:– synchronizing contact and calendar synchronizing contact and calendar

information among desktop and notebook information among desktop and notebook computers as well as cell phones and palm computers as well as cell phones and palm pilots. pilots.

– accessing a network or the Internet with a accessing a network or the Internet with a notebook computer by connecting wirelessly notebook computer by connecting wirelessly to a cellular phone. to a cellular phone.

Bluetooth vs Wi-FiBluetooth vs Wi-Fi

Both use same frequency rangeBoth use same frequency rangeWi-Fi has greater range and higher Wi-Fi has greater range and higher bandwidth (meaning greater power usage bandwidth (meaning greater power usage and more expensive hardware)and more expensive hardware)Wi-Fi analogous to Ethernet, Bluetooth Wi-Fi analogous to Ethernet, Bluetooth analogous to USBanalogous to USB

Product InformationProduct Information

Some products that are sold Bluetooth Some products that are sold Bluetooth enabled are:enabled are:– Cell phones and wireless headsetsCell phones and wireless headsets– Desktops and laptopsDesktops and laptops– PDAsPDAs– PrintersPrinters– keyboards and micekeyboards and mice– Kitchen appliances such as refrigerators, and Kitchen appliances such as refrigerators, and

microwave ovensmicrowave ovens– CarsCars

Installation ProcessInstallation Process

We installed Bluetooth on a machine using We installed Bluetooth on a machine using a windows operating system.a windows operating system.We used software included with a Belkin We used software included with a Belkin USB bluetooth adapterUSB bluetooth adapterOnce installed, software allows you to find Once installed, software allows you to find other Bluetooth devices and communicate other Bluetooth devices and communicate with themwith them

DemonstrationDemonstration

We will now attempt to locate another We will now attempt to locate another Bluetooth device and communicate with itBluetooth device and communicate with itDoes anyone have a Bluetooth enabled Does anyone have a Bluetooth enabled device? (such as a cellphone)device? (such as a cellphone)

Security MeasuresSecurity Measures

Conversations over Bluetooth are Conversations over Bluetooth are encrypted.encrypted.They also use Frequency-Hopping Spread They also use Frequency-Hopping Spread Spectrum (FHSS). The two machines Spectrum (FHSS). The two machines switch frequencies (randomly out of 79 switch frequencies (randomly out of 79 total) in a synchronized fashion 1,600 total) in a synchronized fashion 1,600 times per second. However, this is times per second. However, this is pointless if an intruder can obtain the pointless if an intruder can obtain the proper synchronization.proper synchronization.

Security RisksSecurity RisksBluetooth allows short passwords and pin numbers.The master encryption key is shared openly, thus worthless because everyone can decrypt.Unit keys are dangerous to use more than once because they become publicly accessible once they are used.There is no user authentication, only device authentication. Thus, an unauthorized user with an authorized device can obtain access to the network.

Security AttacksSecurity Attacks

Man in the Middle AttackMan in the Middle Attack– 3 devices, A, B, and C.3 devices, A, B, and C.– A talks to B and C and shares it’s unit key with A talks to B and C and shares it’s unit key with

both.both.– The user on device C can easily eavesdrop The user on device C can easily eavesdrop

on A and B’s conversation, because A uses on A and B’s conversation, because A uses the same unit key to communicate with both the same unit key to communicate with both devices.devices.

Denial of Service AttackDenial of Service Attack– Include flooding techniques, battery

exhaustion, and jamming techniques.

Security BreachesSecurity BreachesDiscovered in June 2004, SYMBOS_CABIR was the 1st virus said to have spread only via the Bluetooth-enabled devices.Cell phone viruses are becoming more common.They can delete/change information, drain batteries, and make long-distance phone calls.