Most people probably buy a Bluetooth headset for their cellphone without worrying too much about its security. There are just so many of these devices that it’s not unnatural to assume that any risks would be well publicized. But, Finnish company Codenomicon Defensics claims in a white paper entitled “Fuzzing Bluetooth” that there could be cause for concern:
Lately, more attention has been paid to security of Bluetooth systems, but the focus has been on pairing and authentication. Handling of malformed data has been Lately, more attention has been paid to security of Bluetooth systems, but the focus has been on pairing and authentication. Handling of malformed data has been largely ignored. Yet it is the malformed data, broken inputs that Bluetooth systems have little tolerance for. Test results from plugfest events are worrying: failure rate of over 80% is devastating.
The technique of deliberately overloading devices with erroneous data to make them crash is commonly used by hackers in a variety of situations. The “fuzz testing” used by Codenomicon is claimed to track the effects of “broken input” to find potential security vulnerabilities. There has been less focus on Bluetooth than other forms of networking because it works on an individual short-range basis, one person and one cellphone, for instance.
However, these devices often house very sensitive personal data and the number of devices in active use is nothing short of astronomical: almost everyone owns a mobile phone, many modern cars have a Bluetooth enabled edutainment systems, many people use Bluetooth enabled handsfree equipment for phone calls and so on. as a result, any discovered vulnerability can potentially be used against a very vast number of devices.
The tests involved 15 car kits, five cellphones, thee headsets and a Bluetooth-enabled picture frame.
Most of the equipment tested crashed within the first 100 cases of L2CAP protocol tests. this is a problem in particular since L2CAP does not require pairing. This means, that L2CAP can be targeted without the user accepting or even noticing the connection.
Ars Technica reports this is not a novel problem.
Security gaps in Bluetooth aren’t a new concern — tools like Blooover have demonstrated an exploit called Bluebug, which allowed remote access to text messages, call records and address books on some handsets, and even allowed eavesdropping and placing of phone calls. Changes to phone firmware from handset makers have largely corrected that security hole.
But they haven’t gone away — in July, Microsoft issued a patch to fix a Bluetooth vulnerability in Windows 7and Windows Vista that allows an attacker to transmit packets to remotely execute code allowing them to “install programs; view, change, or delete data; or create new accounts with full user rights.”