Abstract:ABSTRACTBluetooth is a short-range wireless communication technology widely used by billions of personal computing, IoT, peripheral, and wearable devices. Bluetooth devices exchange commands and data, such as keyboard/mouse inputs, audio, and files, through a secure communication channel that is established through a pairing process. Due to the sensitivity of those commands and data, security mechanisms, such as encryption, authentication, and authorization, have been developed and adopted in the standards. Nevertheless, vulnerabilities continue to be discovered. In the literature, few successful attacks against the Bluetooth connection establishment stage have been reported. Many attacks simply assume that connections are already established or use a compromised agent, e.g, a malicious app or a careless user, to initialize the connection. We argue that such assumptions are strong and impractical. A stealthily established connection is a critical starting point for any practical attack against Bluetooth devices. In this paper, we demonstrate that the Bluetooth Specification contains a series of vulnerabilities that will enable an attacker to impersonate a Bluetooth device and successfully establish a connection with a victim device. The entire process does not require any involvement of the device owner/user or any malicious app on the victim device. The attacker could further escalate permissions by switching Bluetooth profiles to retrieve sensitive information from the victim device and inject arbitrary commands. We name our new attack as the Blacktooth Attack. To demonstrate the effectiveness and practicality of the Blacktooth attack, we evaluate it against 21 different Bluetooth devices with diverse manufacturers and operating systems, and all major Bluetooth versions. We show that the newly proposed attack is successful on all victim devices.

Man-in-the-middle attacks on Secure Simple Pairing in Bluetooth standard V5.0 and its countermeasure

A Novel Bluetooth Man-In-The-Middle Attack Based On SSP using OOB Association model

Enhancing the Security of Numeric Comparison Secure Simple Pairing in Bluetooth 5.0

Hash-Based Secure Simple Pairing for Preventing Man-in-the-Middle Attacks in Mobile Cloud Computing

An Enhanced Passkey Entry Protocol for Secure Simple Pairing in Bluetooth

A Lightweight Key Management Scheme For 60 Ghz Wpan

Authenticating Smart Home Devices Via Home Limited Channels

Blacktooth: Breaking through the Defense of Bluetooth in Silence

Happy MitM: Fun and Toys in Every Bluetooth Device

On the (In)security of Bluetooth Low Energy One-Way Secure Connections Only Mode

MagicPairing: Apple's Take on Securing Bluetooth Peripherals

BLESA: Spoofing Attacks Against Reconnections in Bluetooth Low Energy.

MitM Attack: CCMP Data-Confidentiality Targeting Wi-Fi

Men-in-the-Middle Attack Simulation on Low Energy Wireless Devices using Software Define Radio

BLEKeeper: Response Time Behavior Based Man-In-The-Middle Attack Detection

Side-Channel Analysis for the Re-Keying Protocol of Bluetooth Low Energy

Blockchain Technology to Secure Bluetooth

A Scalable Transitive Human-Verifiable Authentication Protocol for Mobile Devices.

Use One-Way Hash Function To Solve The Reused Unit Key Problem In Bluetooth Security

BLURtooth: Exploiting Cross-Transport Key Derivation in Bluetooth Classic and Bluetooth Low Energy

Analog Physical-Layer Relay Attacks with Application to Bluetooth and Phase-Based Ranging