Slashdot Mirror
How Good Is BlueTooth's Security?
maliabu writes "If (not when) BlueTooth becomes really popular or populated in all the personal devices, will we start experiencing another wave of frauds similar to the current credit card strip-reading, or ATM machine shoulder-spying incidents? In this article about BlueTooth Security, the author asks 'but is Bluetooth secure enough for larger ad hoc networks, money transfers and transferring other sensitive information?' Even when the security standard becomes higher in BlueTooth, will the end users become victims of themselves by neglecting simple security rules, similar to not covering the keypad when entering your pin number? Remember personal devices such as mobile phone, heartrate sensor, blood-pressure alarm, vision-correction lenses etc, are more 'forgettable' than laptops/computers on WiFi. And the chances of strangers getting close enough to it is also higher, such as in the train, bus, cinema etc."
it's all about protocol.
Timothy asks:
'will the end users become victims of themselves by neglecting simple security rules, similar to not covering the keypad when entering your pin number?'
I think that we all know the answer to that one...
As a matter of fact, the whole gist of this paper seems to point less to overt flaws in bt's implementation and more to simple user error/laziness.
A good read, though.
slomotion
...when you're dead.
To be honest, I never found much use for BlueTooth. The idea is nice, but... we're not ready for it, yet. And I've found other solutions which fit the bill better than BlueTooth.
Informatus Technologicus
wireless USB or you already know that ?
So, whatever encryption that can be used for USB can also be used for Bluetooth. Correct me if I am wrong.
I must get one of those
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
If there's any possibility of a security hole, someone is going to try and take advantage of it.
And probably will succeed.
And probably get their wrist slapped.
To celebrate the occasion of my 1000th post, I will post no more forever on Slashdot. Goodbye.
It really seems like the author decided what he wanted to conclude before he started his study. His conclusions are mostly fluff. Sure the out of band PIN exchange is a bit clunky, but this isn't really a vulnerability. Nothing seamless is going to happen without some sort of certificate authority. Anything else is going to require authentication off the wire.
Battery draining denial of service scheme? Seems like this will be an issue for any limited power mobile device that is listening for connections. As for no defense against it, leaving your device "undiscoverable" and only talking to trusted devices is a good start.
The mention of a divide-and-conquer attack that cannot in fact be used probably doesn't belong in the conclusions.
PINs are, I believe, alphanumeric in most user interfaces, giving us more like 1.7 million keys for a four-digit key length. Still not that great a key space, but that's why you're allowed 16 octets.
It seems like the remainder of the conculsions make the assumption of bad application-level choices of keys and key types. I will acknowledge that this can derail pretty much any encryption scheme.
Personally, I sort of wonder why more standard algorithms were not used, such as RC*, Diffie-Hellman, etc. Also, this seems like it could really use a certificate of PGP-like "web of trust" to support it.