Slashdot Mirror
Bluesnarfing At CeBIT 2004
La^2 writes "The Austrian research company Salzburg Research did a field trial at the CeBIT 2004 that confirms the seriousness of the recently discovered bluetooth security loophole in the firmware of popular mobile phones. In this trial, 1269 unique bluetooth-enabled devices were discovered, and their vulnerability to the so-called SNARF attack checked. The report on this bluesnarfing at large scale has interesting statistics, which may not please some of the vendors." (And the CeBIT version of Knoppix was apparently being used to slurp up and display Bluetooth phone information, too.)
I had to google for this one ...
Basically, Bluesnarfing is an exploit of a Bluetooth vulnerability to access data stored on the mobile device.
A more detailed explanation can be found here
I hear there's rumors on the Slashdots
It looks like they were just testing phones with this.
If you're interested, I'd suggest running some tests yourself - find some Palms with BT, try to get some data, and see if they ask the user first.
I've got more mod points and GMail invi
I have the SE t68i. You are only supposed to be able to connect to it via bluetooth when the phone is in discoverable mode. The window for discoverable mode is 3 minutes on my phone, and when any device tries to pair with it, I put in a password (ie, it's not a stored password) and the other device has to enter the same password.
I think the point of bluesnarfing is exploiting a bug in the bluetooth stack that bypasses the discoverable mode requirement and the one time password pairing step.
Knoppix 3.4 is out, (but not yet on mirrors).
Anyone have a torrent
this only impacts phones and the data on them... go get your keyboard http://www.blueserker.com
http://www.blueserker.com
As the author of the bluesnarf report and an important member of the team that did the experiment, I can tell you that Slackware Linux 9.0 distribution was used as a basis. In addition to this, Bluez and a recent linux kernel (linux-2.6.2) has been installed on this system. I like Knoppix very much, though. It gives Microsoft users a fair chance to seriously think about getting rid of their expensive bugware. Linux forever ;)
Confirm. SMS-spamming from other people's phones is possible!
To put it into perspective, out of 1269 Bluetooth enabled phones detected, only 46 were vulnerable to the attack. And the manufacturers are upgrading the firmware so that newer models are immune.