Abstract:ABSTRACTBluetooth is a short-range wireless communication technology widely used by billions of personal computing, IoT, peripheral, and wearable devices. Bluetooth devices exchange commands and data, such as keyboard/mouse inputs, audio, and files, through a secure communication channel that is established through a pairing process. Due to the sensitivity of those commands and data, security mechanisms, such as encryption, authentication, and authorization, have been developed and adopted in the standards. Nevertheless, vulnerabilities continue to be discovered. In the literature, few successful attacks against the Bluetooth connection establishment stage have been reported. Many attacks simply assume that connections are already established or use a compromised agent, e.g, a malicious app or a careless user, to initialize the connection. We argue that such assumptions are strong and impractical. A stealthily established connection is a critical starting point for any practical attack against Bluetooth devices. In this paper, we demonstrate that the Bluetooth Specification contains a series of vulnerabilities that will enable an attacker to impersonate a Bluetooth device and successfully establish a connection with a victim device. The entire process does not require any involvement of the device owner/user or any malicious app on the victim device. The attacker could further escalate permissions by switching Bluetooth profiles to retrieve sensitive information from the victim device and inject arbitrary commands. We name our new attack as the Blacktooth Attack. To demonstrate the effectiveness and practicality of the Blacktooth attack, we evaluate it against 21 different Bluetooth devices with diverse manufacturers and operating systems, and all major Bluetooth versions. We show that the newly proposed attack is successful on all victim devices.

Echoes of Fingertip: Unveiling POS Terminal Passwords Through Wi-Fi Beamforming Feedback

Detecting Rogue Access Points Using Client-agnostic Wireless Fingerprints.

Accurate and Robust Rogue Access Point Detection with Client-Agnostic Wireless Fingerprinting

Demo: WISP-based Access Control Combining Electronic and Mechanical Authentication

Key Listener: Inferring Keystrokes on QWERTY Keyboard of Touch Screen Through Acoustic Signals

Combating Password Vulnerability with Keystroke Dynamics Featured by WiFi Sensing

Wi-attack: Cross-technology Impersonation Attack against iBeacon Services

Secure User Authentication Leveraging Keystroke Dynamics via Wi-Fi Sensing

Wi-Crack: a smartphone keystroke recognition system based on multi-dimensional information

Adversarial WiFi Sensing Using a Single Smartphone

No More Free Riders: Sharing WiFi Secrets with Acoustic Signals

Stay Connected, Leave no Trace: Enhancing Security and Privacy in WiFi via Obfuscating Radiometric Fingerprints

Recognizing Keystrokes Using Wifi Devices

BackLip: Passphrase-Independent Lip-reading User Authentication with Backscatter Signals.

Blacktooth: Breaking through the Defense of Bluetooth in Silence

Peek-a-Boo: I see your smart home activities, even encrypted!

An Imperceptible Eavesdropping Attack on WiFi Sensing Systems

Keystroke Recognition Using WiFi Signals

SpiderMon: Towards Using Cell Towers As Illuminating Sources for Keystroke Monitoring

Robust Multi-Beam Secure mmWave Wireless Communication for Hybrid Wiretapping Systems

Niffler: A Context-Aware and User-Independent Side-Channel Attack System for Password Inference