What is "BlueSnarfing?" BlueSnarfing is the identification of
Bluetooth devices in "discoverable" mode in order to connect and steal
personal data such as: photos, SMS messages, phonebook contacts or the
phone's IMEI. If you possess a vulnerable device and your Bluetooth is
on and 'discoverable', anyone within 10 meters of you could potentially
connect to your device and download its' data without your authorization
using easy-to-use tools.
Bluetooth is a popular way to exchange data between enabled devices, commonly including mobiles phones, PDAs, laptops, etc. BlueSnarfing is a technique of abusing the Bluetooth "pairing" protocol, which is the essence of the technology that allows devices to recognise and authenticate each other in order to transmit data between them.
The technique is simple, more so than traditional systems Hacking, with the advances in telephony and PDA functionality and storage capability, the volume and targeting of BlueSnarfing attacks will increase and lead to far more serious compromises than Paris Hilton's address book.
The following is a summary of the three most prominently recognised BlueSnarfing attack methodologies:
BACKDOOR: The Backdoor Attack is the method of establishing an unrecognized "trust relationship" between device "pairing" mechanisms. If the device is on default and does not require connectivity authorization, an attacker may make the connection undetected - unless of course the owner of the device is actually looking at the phone screen at the exact moment of the attack. Not only can an attacker retrieve data from the device through this attack, he can also access other services deployed on the device such as: modems or Internet connections, WAP and GPRS gateways without the owner's knowledge.
BLUEBUG: The Bluebug Attack is the technique of creating a serial profile connection to the device to commandeer the AT command protocol. Once access to the AT command set is obtained, it can be exploited by the use of easy to use freeware tools to control, to initiate, intercept or forward telephone calls and SMS' or connect to data services such as the Internet (and if this is accomplished theoretically, an attacker can theoretically listen in on your calls from anywhere in the world). This attack for instance would allow an attacker to set up call diverts to 900 numbers or to impersonate the victim.
SNARF: The Snarfing Attack is the technique used to connect to a Bluetooth device without alerting its' owner to gain access to (and use of) restricted portions of its' stored data using freeware. This would include access to your: phone menu, call, configuration and security settings, profile, display, and ring tones, calendar and clock properties and settings. The attack also allows access to the phone IMEI number (the unique number which identifies your phone to its' network) and may be used to "clone" your number to make fraudulent calls.
BlueSnarfing is easily prevented and no reason for the blues, simple configuration changes can prevent the attacks reducing the costs of Penetration Testing or Ethical Hacking activities in this area to ensure your workforce or your personal device is secure. Just keep in mind that behind every "convenience" is a potential vulnerability and never leave your phone (or any technology) on "default."
Bluetooth is a popular way to exchange data between enabled devices, commonly including mobiles phones, PDAs, laptops, etc. BlueSnarfing is a technique of abusing the Bluetooth "pairing" protocol, which is the essence of the technology that allows devices to recognise and authenticate each other in order to transmit data between them.
The technique is simple, more so than traditional systems Hacking, with the advances in telephony and PDA functionality and storage capability, the volume and targeting of BlueSnarfing attacks will increase and lead to far more serious compromises than Paris Hilton's address book.
The following is a summary of the three most prominently recognised BlueSnarfing attack methodologies:
BACKDOOR: The Backdoor Attack is the method of establishing an unrecognized "trust relationship" between device "pairing" mechanisms. If the device is on default and does not require connectivity authorization, an attacker may make the connection undetected - unless of course the owner of the device is actually looking at the phone screen at the exact moment of the attack. Not only can an attacker retrieve data from the device through this attack, he can also access other services deployed on the device such as: modems or Internet connections, WAP and GPRS gateways without the owner's knowledge.
BLUEBUG: The Bluebug Attack is the technique of creating a serial profile connection to the device to commandeer the AT command protocol. Once access to the AT command set is obtained, it can be exploited by the use of easy to use freeware tools to control, to initiate, intercept or forward telephone calls and SMS' or connect to data services such as the Internet (and if this is accomplished theoretically, an attacker can theoretically listen in on your calls from anywhere in the world). This attack for instance would allow an attacker to set up call diverts to 900 numbers or to impersonate the victim.
SNARF: The Snarfing Attack is the technique used to connect to a Bluetooth device without alerting its' owner to gain access to (and use of) restricted portions of its' stored data using freeware. This would include access to your: phone menu, call, configuration and security settings, profile, display, and ring tones, calendar and clock properties and settings. The attack also allows access to the phone IMEI number (the unique number which identifies your phone to its' network) and may be used to "clone" your number to make fraudulent calls.
BlueSnarfing is easily prevented and no reason for the blues, simple configuration changes can prevent the attacks reducing the costs of Penetration Testing or Ethical Hacking activities in this area to ensure your workforce or your personal device is secure. Just keep in mind that behind every "convenience" is a potential vulnerability and never leave your phone (or any technology) on "default."
Penny Reyes is an analyst at Orthus limited . Orthus is a leading provider of information
risk professional services, helping organizations globally to measure,
minimize and manage the information risks they face. Orthus provide end
to end services for clients to comprehensively address risk in their
environments including Insider Threats addressing issues including data
leakage, sabotage and fraud; External Threats including penetration testing,
virtualization security, vulnerability management and Secure Software
Development Life-Cycle; Supply Chain Threats including securing cloud
services and data processed by third parties; and Legal and Regulatory
challenges including Payment Card Industry (PCI) Data Security Standard
(DSS).
No comments:
Post a Comment