New Way To Crack Secure Bluetooth Devices 137
moon_monkey writes "Cryptographers have discovered a way to hack Bluetooth-enabled devices even when security features are switched on, according to a report from New Scientist.com. The discovery may make it even easier for hackers to eavesdrop on conversations and charge their own calls to someone else's cellphone. From the article: 'Our attack makes it possible to crack every communication between two Bluetooth devices, and not only if it is the first communication between those devices,'"
The Paper: Cracking the Bluetooth PIN (Score:2, Informative)
Cracking the Bluetooth PIN [tau.ac.il]
This paper describes the implementation of an attack on the Bluetooth security mechanism. Specifically, we describe a passive attack, in which an attacker can find the PIN used during the pairing process. We then describe the cracking speed we can achieve through three optimizations methods. Our fastest optimization employs an algebraic representation of a central cryptographic primitive (SAFER+) used in Bluetooth. Our results show that a 4-digit PIN can be cracked in less than 0.3 sec on an old Pentium III 450MHz computer, and in 0.06 sec on a Pentium IV 3Ghz HT computer.
--AS
Re:Article is missing an important detail (Score:3, Informative)
So, it's an automatic and remote attack which doesn't rely upon any cooperation from either of the two original Bluetooth devices.
Re:A fix... (Score:5, Informative)
Then not only didn't you RTFA, but apparently you haven't used Bluetooth, either. Bluetooth is an extremely useful mechanism for many of us. It lets my PDA get on line; and when I hop in my vehicle, my car stereo magically becomes my car phone whenever it rings.
I just wish more devices were Bluetooth enabled (and that this security hole didn't exist.) As is, I'm not losing sleep over this as I don't have a public-transit commute (the sort of place where breaks seem most likely to happen.)
Re:Why, oh why ? (Score:2, Informative)
Now, if they maybe wanted to use more encryption so the key isn't as breakable, that would be an idea...but it would probably mean more expensive hardware, and longer PINs.
My boss always says security and ease of use are on two opposite ends of a line, and with any system you have to put the 'x' somewhere. Bluetooth chose to plant their 'x' pretty close to the Ease of Use side, which cost them security.
But then again, if I see the little "B" icon on my v600 and my headset's not on my ear, I know SOMETHING's up...
Re:Article is missing an important detail (Score:5, Informative)
If the attack is successful, the Bluetooth user will need to enter the PIN again - so a suspicious user may realize that his Bluetooth device is under attack and refuse to enter the PIN.
Not such a big threat (Score:4, Informative)
With this, you can force them to re-form at will.
Even so, you still need to bruteforce the PIN. The "PIN" is really a 16-byte field, and is not really limited to numeric (or even alphanumeric) characters.
So what can be done:
1) Start using long PIN codes (if your device is limited to numbers, at least use the maximum length)
2) Software update that notifies user of the "forced re-pairing"
3) Allow users to use PIN's beyond the numeric space or possibility to use some pre-shared secret keys.
This affects those of you who use "1234" or similar keys for pairing process for convenience.
Just take today's story... (Score:3, Informative)
Mmm... phreaky...
Re:Article is missing an important detail (Score:3, Informative)
Now a headset has only a limited set of functions it can perform -- they can't dial digits without a keypad, so they're usually restricted to voice recognition of pre-programmed names. So unless you wanted to steal a phonecall to my wife or my son, you probably won't find it very useful.
That is, if headsets are restricted to "no dialing, no OBEX, no service discovery". If headsets are allowed to "change" their profile to suddenly support network dialing, keypads, and all that, then you're in big trouble from spoofers without even worrying about cracking the crypto.
Re:Serious Flaw (Score:3, Informative)
RTFA. The hackers device tells the other device that it forgot the key. The pairing is deleted. The user has to re-pair the devices if he wants to use them again. The hacker can listen to that second pairing and use the previously discovered techniques to get the key.
Re:Serious Flaw (Score:3, Informative)
Paper describing the attack (Score:2, Informative)
Mike
Re:Show me the code (Score:3, Informative)
Well, here [tau.ac.il] might be a good place to look. The article doesn't actually tell you where to find the research, but it was posted on Schneier's blog this morning.
Cheers,
Brendan