Bluetooth Pin And Link Keys Cracker
Fanny Lococo
A quick look at reveals that bluetooth is used in everything from phones to printers to medical equipment. Someone grabbing the pin to and linking up with a bluetooth heartmonitor will have a different agenda than someone hacking your phone. My question is: is there anyway to determine how much control an attacker will have over a device by only knowing what the device does? Is a bluetooth attack like this an all-or-nothing proposition? If you break a bluetooth system, do you control it, or is bluetooth communication/control typically limited to only certain features of the device?
This is very interesting! I was wondering how he did it with bluetooth. Is it possible to use DOS attack on bluetooth device to disconnect it, instead of waiting for the device to be disconnected by user to get this important link-key? It would make the entire process much faster. Also you said that one of the computers must have had autorun enabled for this hack to work, but didn't you forget about Bad USB? They could make the flash drives to install malware for them and the victim's system and it's configuration wouldn't even matter. Tell me if I'm wrong. Great article as always.
Bluetooth implements confidentiality, authentication and key derivation with custom algorithms based on the SAFER+ block cipher. Bluetooth key generation is generally based on a Bluetooth PIN, which must be entered into both devices. This procedure might be modified if one of the devices has a fixed PIN (e.g., for headsets or similar devices with a restricted user interface). During pairing, an initialization key or master key is generated, using the E22 algorithm.[132]The E0 stream cipher is used for encrypting packets, granting confidentiality, and is based on a shared cryptographic secret, namely a previously generated link key or master key. Those keys, used for subsequent encryption of data sent via the air interface, rely on the Bluetooth PIN, which has been entered into one or both devices.
In October 2006, at the Luxemburgish Hack.lu Security Conference, Kevin Finistere and Thierry Zoller demonstrated and released a remote root shell via Bluetooth on Mac OS X v10.3.9 and v10.4. They also demonstrated the first Bluetooth PIN and Linkkeys cracker, which is based on the research of Wool and Shaked.[149]