.

• Attacker gains access to target device over Bluetooth connection
• Devices not updated after December 2019 are vulnerable
• Turn OFF your phone’s Bluetooth

Bluetooth Definition

What is Bluetooth?
Bluetooth is a wireless technology that powers wireless communication. It connects your phone to other electronic devices through Internet of Things (IoT). A Bluetooth connection involves connection between a host and a client device.

The term “Bluetooth” is coined after the Viking king, Harald Bluetooth Gormsson. This is due to his work to unite different 10th-century European factions.

Bluetooth is simple & productive in file sharing, but has major security risks. While most of the bugs have been fixed a decade ago, some still remain.

Even the new smartphones have yet-undiscovered problems.

Bluetooth Impersonation AttackS or BIAS

What is BIAS?
Bluetooth Impersonation AttackS (BIAS) is a vulnerability in which the attacker impersonates the secret key or address and connect to a Bluetooth device without any authentication.

BIAS vulnerability is usually found in the Bluetooth Classic devices.

These follows the Bluetooth Basic Rate Extended Data Rate (BR/EDR) wireless technology. This technology is the standard for a wireless personal area network (PAN).

Bluetooth Impersonation AttackS comes into picture while configuring Bluetooth Devices for the first time.

When two devices are paired for the first time, a key or address is generated. This secret key works as Authentication and allows Bluetooth connections between the two devices to be seamless.

The Bluetooth Standard provides security features to protect against any eavesdropping, manipulation of information, malicious file download etc.

Despite these security features, a BIAS attack can impersonate the key or address, and connect to a device without the need of authentication.

Since it appears as if it had been previously paired, it do not require further cross check. This makes the devices prone to eavesdropping and Data manipulation.

In addition, the researchers Daniele Antonioli, Kasper Rasmussen, and Nils Ole Tippenhauer have noted that the attack is standard compliant.

This means that any standard-compliant Bluetooth devices are vulnerable to this attack.

Bluetooth vulnerability

Is Bluetooth technology vulnerable?
“Bluetooth technology is dying out”, the narration comes out more often. But this is far from the truth.

There are billions of devices in the world that use the Bluetooth technology. Big Data, Hadoop, Cloud Technologies etc have helped technogiants modernize their offerings.

Though WiFi is gradually replacing Bluetooth to transfer files, people still use Bluetooth with their headsets, speakers, and other devices.

Since Bluetooth allows an automatic wireless connection, it leaves data vulnerable to interception. Connecting devices over Bluetooth encourages High Security Risks.

The research team discovered a critical bug in Android’s Bluetooth implementation. The Bug allowed remote code execution without User interaction.

The testing included smartphones from manufacturers like Apple, Google, Nokia, Samsung; laptops from HP, Apple MacBook; headphones from Philips.

Researchers tried a BIAS attack on 31 Bluetooth devices with 28 unique Bluetooth chips from Intel, Apple, Qualcomm, Samsung, Cypress, CSR, Broadcom, and others.

All the sample devices were vulnerable to the BIAS attack.

Who could hack your phone?

• Government spies
• Politician
• National Security agencies
• Business rivals
• Spouse
• Employer

Bluetooth Guidelines by SIG

What are the major Guidelines by SIG to prevent Bluetooth attacks?
The researchers found the vulnerability in December 2019.

They informed the Bluetooth Special Interest Group (Bluetooth SIG).

SIG is the standards organization that oversees Bluetooth protocols.

According to Special Interest Group – “a Bluetooth bug puts User’s phone prone to high end security risks. Any Bluetooth standard compliant devices have this vulnerability”.

Bluetooth SIG directed the manufacturers to fix the Bugs. SIG recommended that users get the latest updates for their devices.

In light of these directions, Google rolled out an update to the bug.

Worth Reading : Titan Pay: SBI, Titan launch India’s first contactless payment watch-Here is how to use it

Common Bluetooth Security Problems

(01). Blueborne

Blueborne is a data vector that invades users’ devices via Bluetooth. It can infect Android, iOS, Windows, Linux devices.

The Palo Alto-based cybersecurity firm Armis confirms that the Blueborne is spread through the air.

It can recognize the vulnerabilities in the system and use them against the target device.

Blueborne targets the weakest spot. Blueborne can penetrate into computers, smartphones, tablets, televisions, remote controls etc.

What makes Blueborne Dangerous?

The Dangerous conern about Blueborne is that the two devices does not require to be paired together to launch an assault.

Attackers can even target the devices that are not in Discovery mode.

New machine learning tools have helped them learn to penetrate security more easily than ever.

They are then able to take complete control over the device and access any data stored within.

(02). Bluejacking

The bluejacking refers to sending a message to a nearby Bluetooth user.

Bluejacking messages includes text, images, sounds etc.

If targeted, your smartphone then adds the sender to the address book as a contact.

The hacker can use this position to send harmful messages that open automatically on your screen.

Bluejacking is relatively harmless but is vey annoying. It causes some confusions when users start receiving messages.

(03). Bluebugging

Bluebugging attacks allow a Hacker to take full accessibility and control of the target mobile phone.

This is possible when its Bluetooth is in Turn On mode.

This attack takes over control of mobile phone to make calls, send texts, read messages.

Attackers use a variety of data mining tools to make this possible. These messages encourage the recipient to take some action. This leads to further data exploitation.

What makes Bluebugging Dangerous?

The main Dangerous concern about Bluebugging is that the real owner of the device doesn’t even know that their number is being used to send those texts.

The real owner cannot even warn the recipient to ignore the content they receive.

(04). Bluesnarfing

Bluesnarfing refers to the stealing of data through unauthorized access via Bluetooth.

Combining the methods of Bluebugging and Bluesnarfing are a deadly combination to enter a user’s device via Bluetooth.

Bluesnarfing Attackers can steal data such as call information, text messages, email, passwords, contacts etc.

Attackers use tools like obexftp, hcitool etc.

Bluetooth attacks : Signs your phone may have been hacked

How we can say my Bluetooth device is under attack?

(01). Draining battery life

A smartphone that has been compromised starts to deplete phone’s lifespan drastically.

This is because the Spy App uses phone resources to scan the device. It then, transmits the information back to the Hacker’s server.

(02). High data usage

When your device is under attack, Spy Apps running in the background, sends information back to the Hacker’s server.

This process requires internet connection and data usage.

If your device is under attack, you get high data bill.

(03). Sluggish performance

A device under attack starts to overload the phone’s resources.

It leads to two applications clashing, over phone’s resources usage.

Frequent freezing, certain applications crashing are the signs of your device being hacked.

Sometimes it happens, despite our efforts to close, some applications runs continuously, beware your device may be under attack.

(04). High phone bills

The attacker can use your phone to contact someone, you don’t even know. Make sure to analyse your phone bill, for any costs you don’t recognize.

(05). Pop-up Alerts

A constant pop-up alerts could indicate that your phone has been infected with some Adware.

Adware is a form of malware that forces devices to view certain specific pages that drive revenue through clicks.

Many pop-ups are phishing links that attempt to get users to type-in sensitive information.

It may also encourage to download more malwares into your system.

(06). Unusual Account Activity

If your phone is under attack, hacker have access to phone’s accounts. These accounts may include your social media Login credentials, email etc.

Now, one may guess, upto what extent Hacker can exploit your confidential information. In this case, you could be at risk for identity fraud.

So, it’s a good idea to frequently change your passwords, something hard to guess.

Also Read : 235 Million TikTok, Instagram And YouTube User Profiles Data Leak

SOLUTION

How to Reduce Bluetooth Security Risks?

(a).Turn Off Bluetooth when Not in Use
When a device is in Visible or Discovery mode for a longer time, it has higher chances of Bluetooth Security risks.
Make sure to turn off Bluetooth, when not in use. It helps to minimize the risk of an attack.

(b). Regular Update
Updates carry important bug fixes and solutions. Regular device update can prevent security risks.

Use the latest version of Bluetooth and make sure the Operating System is up to date.

(c). Use a VPN
A Virtual Private Network or simply VPN, helps to encrypt your data and secure the device. A VPN increases the security levels of your device.

A VPN allows to browse the internet anonymously, thus prevents the attacker of getting your phone’s access.

Select a VPN that offers a strong encryption protocol with plenty of server locations.

(d). Trusted Pairing
When using Bluetooth, only pair your phone with devices that you are familiar with.

Make sure the other device is also using the latest version of Bluetooth updates. It will reduce the risk of data interception and security risks.

BONUS TIPS

What are the major steps to prevent devices from Bluetooth attack?
Tips to secure your mobile devices from Bluetooth attacks or BIAS attacks.

1. Threat : Bluetooth Discovery Mode
   While pairing two devices, Bluetooth uses MAC addresses for first time configuration. This is done under Discovery Mode. This is the interval for a possible attack by a potential Hacker.
   Attackers can eavesdrop on your conversations, by exploiting these vulnerabilities.

Solution : Switch Off Bluetooth when not in use.
Use Hidden mode as much possible.
When you enable Bluetooth, make sure it is in Hidden mode. This does not disconnect your Bluetooth devices. The Hidden mode prevents Bluetooth devices from recognizing your device. This prevents possible Bluetooth attacks.

2. Threat : Eavesdropping
   Eavesdropping should not be a problem in any communication. However, older Bluetooth devices face the threat of unpatched security holes. The device becomes a medium of transmitting everything it hears to an attacker.

Bluetooth Encryption helps to Stop criminals listening in to your phone calls.

Solution : Ban devices that use Bluetooth 1.x, 2.0, 4.0-LE.
Use latest Bluetooth versions.

3. Threat : Software vulnerabilities
   Software installed in Bluetooth devices are security vulnerable.

In 2011, Reasearchers demonstrated that it’s easy for attackers to discover new Bluetooth devices, with some security loop holes. Potential impacts could include data stealing, huge ransom demands etc.

Solution : Switch off Bluetooth when not in use

4. Threat : Bluetooth range
   Harald “Bluetooth” Gormsson designed Bluetooth for Personal Area Network. PAN ensures devices that are away from Bluetooth Range, should not be accessible via Bluetooth. A typical Bluetooth has a range of around 10 feets.

However, Attackers use directional, high-gain antennas to communicate over much greater distances successfully.
Security researcher Joshua Wright demonstrated the use of Directional, High-Gain Antenna to hack a Bluetooth device in a Starbucks from across the street.

Solution : Switch off Bluetooth when not in use

5. Threat : Denial of Service
   Attackers can crash your devices with some malicious files or malwares. This makes your device un-responsive to your command. Draining battery quickly is also a sign of some malware attacks.

Solution : Switch off Bluetooth when not in use.

6. Threat : Bluetooth headsets / car kits
   Some popular Bluetooth headsets have several serious flaws. Attackers can eavesdrop on your phone calls, chats, video calls etc by exploiting possible vulnerabilities.

Solution : Change the default PIN code to something hard to guess.
Switch off your Bluetooth when not in use.

Must Read : New Meow attack that Destroys unsecured Database of MongoDB

CONCLUSION

Although there are improvements in Bluetooth devices.

The companies are eager to fix Bluetooth related bugs. It includes steps such as using PIN codes or passwords, its still important to ensure that Discovery mode is disabled after pairing them.

With Discovery mode disabled, the device doesn’t broadcast information regarding MAC address of your phone.

When Discovery mode is disabled, devices add encryption to the communication process. This encryption ensures a secured connection.

Mobile devices has several security risks that need to be fixed. Bluetooth security is often under-rated. Ensure mobile device security as part of cybersecurity protection.

The best protection against bluetooth attacks is to keep Bluetooth devices Turn off.