Monday, January 14, 2008

Bluetooth scanners.

Bluetooth scanners exploit insecure implementations of the Bluetooth system software on some phone models. Several Nokia phone models are known to be vulnerable (e.g., Nokia 7650, 6310i, etc.). You can get more information, including an updated vulnerable-device list, from http://www.thebunker.net/security/bluetooth.htm.

Bluetooth exploits were first discovered by Adam Laurie, of A.L. Digital Ltd., in 2003.

A Bluetooth scanner has to be physically close to your phone (e.g., in a conference hall or classroom) for Bluetooth to work. There are three known types of Bluetooth attacks:

Bluesnarf
This type of attack can be launched from untrusted (a.k.a. unpaired) devices. The attacker can steal information, including your Contacts list, calendar, photos, etc., from your phone.

Backdoor
This type of attack has to be launched from a previously paired device. The attacker can get access to almost all the functionality on your phone.

Bluebug
This type of attack involves creating a Bluetooth serial profile to your phone, and then hijacking the phone's voice and data connections.

Bluejacking
is often cited as a fourth type of Bluetooth attack. But it is really just a prank. It works as follows. The prankster creates a contact entry on her own phone and enters a prank message into the "name" field. For instance, the "name" of this contact might be "Your phone belongs to us." Then, the prankster sends the contact to random Bluetooth phones as a business card. The recipient suddenly sees an unsolicited prank message"Your phone belongs to us"on his phone screen.

No comments: