identification | madrock

Archives for : identification

SCADA Security Presentation

Posted by :Derek On : November 8, 2009

Category: SCADA

Tags:Derek, environment, Grocke, Guide, identification, Material, SCADA, security, sip, technology

This is a presentation I gave on SCADA security some time ago. It was originally set for about 2 hrs, although I broke it into 2 halves so if time permitted (or the partisipants wanted more inforamation), the backend of the presentation has many more areas and guidence relaing to SCADA, devices, environment security, etc.

I defined the following outcomes for the presentation:

Broaden the awareness and necessity of security within the SCADA environment.
Understanding of business role in the governance/risk identification process.
Heighten the understanding of technology risks.

I hope people find the material interesting and useful.

SCADA Security Presentation Derek Grocke

SCADA considerations

Posted by :Derek On : November 4, 2009

Category: SCADA

Tags:authentication, Corporate, data, encryption, environment, identification, Internet, mechanisms, network, password, Protection, SCADA, script, security, SMS, support, Vulnerabilities

Procedures

Corporate Information Protection
Security Management
Information Classification
Physical (and Environmental) Security
Personnel Security
Security Awareness Training
Security Incident Response
Security Monitoring
Network Security
PC/Workstation Security
Support and Operational Security Related
Encryption and Information Confidentiality
Authorization Controls
Identification and Authentication Mechanisms
Systems Life Cycle Security
Business Continuity Planning
Media Security
Third Party Services

Typical concerns and points discussion:

Inbound and out Bound FTP
Suggest use of DMZ
Suggest use of Secure FTP
Suggest use of restricted secure IP addresses / tunnelling
Suggest use of private feeds

Modem issues used with dial in services

No dial back
No Authentication
No Secure ID
Possibly automated scripts used, so hard coded usernames and passwords used.
Internet sharing may be turned on, allowing routing via workstations.

Increased data security and integrity considerations

Data backups
System redundancy
Site and content filtering
Virus protection
Standard system procurement (discounts and spares)
Network and services redundancy
Network monitoring
Service availability monitoring
Internal controls
Vendor / external service supplier
Capacity management
Change management system
Asset management system
Telecommunication and telephony bulk cost discounting
Etc.

Use and support for corporate application considerations

Email
Intranet
Internet
Corporate virus protection
Asset management
Change management
Project management
Performance / capacity management
Reduction of Cost
Use of corporate applications
Reduction of manual processes

Other things to keep in mind:

SCADA monitoring system must be isolated from network errors and systems events. This will prevent SCADA operational systems being effected by network or corporate system issues / outages.
Review Network topology to ensure internal and external vulnerabilities are not currently being and cannot be abused.
Review of router configurations
Use of change management system
Review remote dial in systems
Firewall SCADA systems off from corporate applications
Uncontrolled networks and systems within the SCADA environment will compromise the corporate environments integrity and security.
Determine if systems used within SCADA are built to a standard operating environment.

EFT Syetms and Device Considerations

Posted by :Derek On : August 5, 2008

EFT devices and systems differ depending on hardware vendor, country and bank / payment aggregator.
Below is a list of things you may like to consider. This list is off the top of my head so it is probably not complete.

Looking at the products and relationships us usually a good start.

Things to consider:

Card skimming methods
Some EFT POS devices restrict the connection of a skimmer
Review levels of associated fraud
Review devices and EFT methods
Review terminal identification (merchant and customer)
Manual processing. (internal and external)
eCommerce products
PC based software
Dedicated server services (Nobil, etc.)
Web based engine (Custom objects, Web pop-ups, etc)
Authorisation / identification methods (Merchant and customer)
TCPIP session hijacking / session spoofing
Direct Debit as well as Credit Cards.
Swift (methods and controls)
Telegraphic transfer (methods and controls)
Payment aggregator relationships (eg. Payment Tech, manual processing, cheque scanning, etc.)
Internet banking facilities (attack / penetration,Â Certificate registration / management, ISP SLA’s, etc.)
Implementation of Smart Card and / or alternative customer recognition devices.
Outsourcing and associated risks / service level agreements
Payment processing
Payment clearance
Payment switching
Reporting (segregation of merchant / customers / aggregators / partners / local / international)
Fraud detection and reporting
3rd party acquiring risks
Single merchant ID many businesses
Allows moneys to be laundered if the payment aggregator does not place appropriate controls on the merchant.
Encryption used
Internet / trusted partner / inter-bank / extranet
Private and / or public certificates
Single use certificates
Client side certificates
Remittance advice processes and controls.
EFT disaster recovery and manual fall back procedures (associated security and reconciliation risks)
Trusted partner relationships, SLA’s, liabilities and risks.
EFT regulatory / legal requirements (inter-bank and government)
Refund processing / authorisation. (policies, procedures, controls, etc.)
CVV, CVV-2 / CVC-2 processing and management. (http://www.atlanticpayment.com/CVV.htm)
Fraud detection mechanism (neural networks, inter-bank / department customer checks, etc)
Supported card schemes (AMEX/Visa/Mastercard/Discover/etc )
Review EFT floor limits (corporate and SME merchants)
Review the ability to withhold merchant settlement until the presence of fraud has been determined.
Review customer identification details. Such as (This varies around the world depending on local regulations / privacy laws)
Review real-time and batched processing methods and controls (sequence numbers, access to raw data, etc.)
Review processing with and without expiry dates. (exception controls and policies)
Review exception / fraud reports.
Review payment store and forward policies and procedures.
Review Pre-Auth and Completion controls.
Token based payment (eCash, etc)
Merchant reconciliation, reporting methods and controls (paper, Internet, email, PDF, Fax, etc.) and associated security.
Real time gross settlement policies, procedures and controls. (IT and amounts)
Card issuing policies and procedures. (customer ID checks, etc)
Banking infrastructure (ingress / egress) controls and security. (Web, partner, payment switches, outsourced infrastructure, monitoring / reporting.)
Use of Internet technologies for inter-bank transfers and remote equipment.
Physical security and controls of devices, ATM,s, line encryptors, etc.

Internet Banking Security Assessment Considerations

Posted by :Derek On : August 5, 2008

I was asked some time ago to provide a list of things which may be considered when looking at Internet Banking.

Below is the list. It was just a brain dump and as such may not be complete.

Don’t underestimate the value of standards for your infrastructure, website configuration, database engine configuration/architecture,staging environment and development/QA environments.

Some thoughts:

Many don’t lock accounts after X failed logins, this is normally done for good customer service, but leaves the system vulnerable.

– And all the other things expected for a remote login session (forced password changes, aging, etc))
– Tools such as Brutus may be use to brute force hack authenticated sessions.

Many allow session sequence numbers to be incremented, allowing an authenticated user to view other customer session.

– These may be server side, client side, cookie based, etc.
– Get someone to check the development methodologies and the code being used.
– Database query strings can be placed into test entry fields, allowing table dumps to browser.
– Check all pages served are secure and contain user authentication flags.

Customer data may not be segregated, this needs to be checked.
Customer data should not reside on the Web Server.

Authentication databases / system data should not reside on the webserver.
The databases should reside on a private/semi-private network.

– A different segment to the main banking system.

Webserver should be dual homed or equivalent (some VLAN techniques are good)

– Separate private and public network cards, monitoring/backup/administration
– Infrastructure set-up to explicitly deny inbound/outbound ports, private IP & monitoring escaping from the network.

At all data segregation points ensure rules are in place which appreciates the traffic though that point.

All customer data where possible should be sourced from a secure back-end database.

– This may be a staging environment. i.e. no the main banking system.
– This usually allows for transactions to appear real time to the customer.
– Many transactions may be batched in reality. (internal or external to the bank)

Ensure suitable rules have been set-up on firewalls.

– There should be inbound and outbound rules on firewalls and filtering routers.

Don’t allow any infrastructure on the front end to allow remote administrative connections. (telnet, etc.)

– Use the serial console port to connect to a server or back-end terminal server.

Look for the segregation / staging of online customer content from main banking systems

Ensure that a separate development / QA / production environment system and suitable process is in place.

Services not used by the system are active

– These should be disabled.

Port scan of the supporting infrastructure (routers /switches) and server(s).

– Investigate the reasons for all open ports.

Don’t use the main gateway for trusted partner access (clearing / RAS / etc.)
Do all that standard IIS checks and NT checks (Sample scripts, change management, patching methodologies, etc.)
Ensure denial of service precaution have been taken into account for all infrastructure and server equipment.
Check the adequacy of the escalation procedures used.

– Look for real-time monitoring and alerting.
– Look for responsibility matrix.
– Look for ownership of issues.

Consider upstream carrier(s) vulnerability (denial of service, IP spoofing, DNS hacking, etc)
Consider social engineering of customer, administrative, partner accounts / systems / infrastructure.

– Helpdesk procedures and policies and/or alternate technologies (Caller ID, Gateway IP, etc.).

Use dynamic passwords where possible (SecureID, TACACS, etc.).
Use encrypted tunnelling where needed (IPSec, Firewall 1, etc)
Consider looking at other customer authentication methods to enhance existing methods.

– Digital cert, IP address locked to account, etc.
– Consider use of CVV or CVN for bank issued cards.

Consider how passwords are distributed /changed for customers.

– Plain text email, telephone, etc.
– Can passwords be changed online?

Is additional authentication used between sections of the services once authenticated?
Consider what the customer has access to once authenticated.

– Look at SWIFT, RTGS, inter-bank transfers, access to credit cards, etc.
– If an attacker does get in, what can the do?

Use techniques to ensure pages, customer details are not cached at ISP, or client system.

– These are flags that can be set within pages.
– Normally SSL is cached, but some proxy vendors have been playing with techniques to do so.
– Caching of SSL pages on the client system can be turned on on some browsers.
– May banks use a Java (or similar) applet for all customer interaction, restricting all caching issues.

Ensure paper based and on-line liability clauses are available are address all effected areas.
Ensure within the customer sign-up process banking liability is reduced.

– I’ve seen statements like “use this system at your own risk, responsibility for any liability or claim will NOT……”
– Not very customer focused, but that’s what their legal department recommended.

All of the above can effect the security and/or operation of an on-line banking system.

Other things to consider:

External development and support of the application.
Ownership and management of the hardware/applications
Publishing points for new content (internal/private/trusted network or Internet)
Topology of front end.Â i.e. Security Architecture document should be in place and managed appropriately.
Are limited AP tests performed whenever changes are made to the environment? i.e. integrated AP into Change management process.
Database access. Is it buffered or is it live to the core banking systems.
What facilities are provided? Direct debit + Credit Card + SWIFT + ……. Consider different scenarios for your attack depending on the feature.
What other services are shared within the network segment that the Internet Banking service is running. Can this be used to compromise the Internet Banking site. eg. different support/business/development organisations with differing security strategies/profiles.
Consider all external supporting services within you AP. Look at internal/external DNS poisoning opportunities, mail relay, etc. What IPS’s do they use has the ISP any opportunity to access systems or supporting services which may affect Internet Banking.
Depending on the size of the Bank, many organisation do not use the same support groups for infrastructure and the application. As a result external connections to the infrastructure may be provided for an external support organisation to administer the infrastructure.
Look at the business and user authentication methods and paths (client side certs, secure ID, SMART Card, etc). Consider two factor authentication and modern user identification methods. eg. what is your favourite food in addition to normal usernames and passwords. Do system administration staff use dynamic passwords (secureID, etc)?
See if the Internet Banking application sends email to users which may contain interesting information.
Better access to the application can generally be gained after access to the system. i.e. get an legitimate account on the system. I have found that some sample/administration screens have been restricted to authenticated users only.
Consider social engineering the Help desk to have an account password reset.

Mobile Banking Security and Risk Assessment Considerations

Posted by :Derek On : August 5, 2008

Category: Banking & EFTPoS, Phones & VoIP, Radio General, Security

Tags:access, account, attack, bank, Banking, Banking and EFTPoS, Card, Credit, data, DUKPT, encapsulation, encryption, hack, identification, Injection, intelligent device, ipsec, JAVA, key logging, mobile banking, Pin, security, server, Shiraz, SMS, sql injection, standards, support, technique, technology, transaction, transmission, type

When considering Mobile Banking security and the associated risks, an assessment approach depends greatly on the solution being created or provided.
Generally the approach is based on layered standards, supporting and surrounding the technologies and techniques used.

Here are some things to consider.

Security assessments generally focuses on two main things.

1/ Sensitivity of the data
What is being sent. eg. Pin, credit card numbers, account balance, home address, bank account number, etc.
Data may not be sensitive to the bank, but may be considered by the client as sensitive.
etc……….

2/ Opportunity to access the data.
What medium is being used?
Is it technology/technique easy or trivial to hack?
What encryption is being used?
Are all data paths secure (client and back end)?
Is there a 3rd party involved in the switching of the transactions?
etc………

Things to consider:

Pin resets sent via SMS to client, should not be used as the only method of accessing accounts. An additional client specific (possibly static) pass word/phrase should be used in addition to a dynamically generated pin. SMS can be sniffed (depending on mode and location).
If WAP is used, are all devices capable of encryption? If devices are not capable of encryption, do we deny access to these devices? If client side JAVA or intelligent device (win CE, etc), ensure this can not be compromised by a Trojan’s and other key logging techniques.
Has the organisation considered client side certificates to verify the device prior to transactions being accepted? Consider multiple device and user identification methods (very solution dependant).
Most mobile POS terminals encrypt the client entered Pin number, but do not encrypt everything within the transaction. If the transmission medium is compromised, we should consider if the encryption can be cracked and if unencrypted data is sensitive. Consider additional data encryption encapsulation i.e. use of all of message encryption (SSL, IPSEC) or use a terminal that utilises Derived Unique Key Per Transaction (DUKPT).
Many banking applications have been affected by typical hacks such as session hijacking, SQL injection, non random session keys (client side and server side), etc… These typical hacks should be considered in your Secure SDLC and QA Processes once you are aware of the technology used and/or deployed.
PBX systems and cabling distribution frames can have devices connected to collect transactions. Wireless devices are now being connected to these systems. The attacker sits in their car in the car park outside. This is often done in super markets.
Wireless transaction gateways if not encrypted are easily collected by anyone within wireless range. 802.11 and other wireless/infra-red mediums are being used (assess the technology and medium being used).
Has the organisation considered dynamic keys for mobile users? There are some very low cost SecureID type solutions available today, but customers need to have these devices on them when they want to do a transaction.

Technology is always being challenged

Posted by :Derek On : June 18, 2008

Category: RFID

Tags:acquirer, algorithm, authentication, bank, Banking, bidirectional, Card, card schemes, Chip, chip solutions, cryptographic algorithms, data, DES, Digital, digital signatures, Dust, EMV, financial transaction, identification, javascript, Merchant, payment, Pin, privacy, processing, Reader, Relay, RFID, rfid chip, RFID-enabled, RSA, rsa laboratories, script, security, security privacy, Shiraz, Skimmer, skimmers, SMS, standards, support, technique, technology, transaction, type, Vulnerabilities

I read a very interesting paper created by the University of Massachusetts,Â RSA Laboratories and Innealta, Inc.<<

This paper primarily relates to the compromise of contact less payment technologies (RFID) if the RFID and/or reader have not been implemented correctly or the solution provider has used an inappropriate type of RFID and discusses the challenges around Chip and Pin with respect to financial transactions e.g. EMV standards and compliance.

Additionally, the paper describes a RFID relay method which is being discussed within many forums around the world and we have now begun to see equipment being produced for the RFID skimmers/clonners to use for malicious means.

The overarching point of this paper is to use an appropriate RFID & Chip solutions which supports the security/privacy of the user and purpose of theÂ transaction (financial or non financial)<<

The paper can be found at http://prisms.cs.umass.edu/~kevinfu/papers/RFID-CC-manuscript.pdf

In modern payment RFID & Chip solutions, newer devices can be used which possess a high degree of processing power and are therefore able to execute strong cryptographic methods (such as digital signatures) to protect the identification and payment information whilst the transaction is occurring.

These systems often utilise bidirectional authentication between the RFID/Chip scanner and the RFID tag/Chip prior to performing the transaction. These methods and cryptographic algorithms are accepted and proven to work within the traditional payment markets.

As mentioned in the paper, some solution store static digitally signed and/or encrypted data which is provided to the RFID/Chip reader when queried, but this data never changes from one transaction to another. This may allow a malicious individual to capture and re-inject the data into the reader at a later stage. The alternative to storing static digitally signed and/or encrypted data is to negotiate a key exchange at the time of the transaction in which the card/value information is encrypted and subsequently transmitted. With this method the transmitted data
changes on every transaction and therefore even if a malicious individual was to capture the encrypted transaction data from one transaction, this would not be accepted by the reader if re-injected at a later stage.

Although this is the case today, older RFID/Chip solutions often use technologies which are not appropriate for financial transactions and therefore may be compromised easily and in some cases without the knowledge of the card holder, merchant or acquirer.

I find this interesting how some of these less secure solution have been approved for use by acquiring banks and the card schemes around the world (if they were told) in recent years, where it has been seen that these solutions have utilised techniques or deployment methods which can be compromised. These technologies and techniques would never be approved within the Point of Sale (PoS) or traditional banking markets.

It can only be assumed that the need to get product to market quickly at the expense of proper testing, understanding and with due consideration to industry lessons learnt has succeeded again.

Bluetooth Wireless Specification

Posted by :madrock.net On : March 24, 2008

Category: Bluetooth, Radio General, Security

Tags:access, algorithm, antenna, architecture, ASP, attack, authenticate, authentication, Bluejacking, Bluetooth, bluetooth profiles, bluetooth special interest group, broadcast, Card, Chip, Communications, Cryptographically, data, DES, Digital, Dust, EDR, EFT, Electronic, encryption, environment, Ericsson, Ethernet, frequency, GHz, Guide, hardware, HCI, identification, identity, interface, ISP, JAVA, javascript, Mall, mobile phones, network, personal area networks, phone, php, Pin, Radio, RSA, SAP, scatternet, script, security, security concerns, Serious, Shiraz, SLA, SNARF, standards, support, Technical, technology, template, transmission, trunk, USB, VOIP, Vulnerable, web, wireless personal area, wireless personal area networks

Source

This article is about the Bluetooth wireless specification. For King Harold Bluetooth, see Harold I of Denmark

Bluetooth is an industrial specification for wireless personal area networks (PANs).

Bluetooth provides a way to connect and exchange information between devices like personal digital assistants (PDAs), mobile phones, laptops, PCs, printers and digital cameras via a secure, low-cost, globally available short range radio frequency.

Bluetooth lets these devices talk to each other when they come in range, even if they’re not in the same room, as long as they are within 10 metres (32 feet) of each other.

The spec was first developed by Ericsson, later formalised by the Bluetooth Special Interest Group (SIG). The SIG was formally announced on May 20, 1999. It was established by Sony Ericsson, IBM, Intel, Toshiba and Nokia, and later joined by many other companies as Associate or Adopter members.

* 1 About the name
* 2 General information
o 2.1 Embedded Bluetooth
* 3 Features by version
o 3.1 Bluetooth 1.0 and 1.0B
o 3.2 Bluetooth 1.1
o 3.3 Bluetooth 1.2
o 3.4 Bluetooth 2.0
* 4 Future Bluetooth uses
* 5 Security concerns
* 6 Bluetooth profiles
* 7 See also
* 8 External links

About the name

The system is named after a Danish king Harald BlÃ¥tand (<arold Bluetooth in English), King of Denmark and Norway from 935 and 936 respectively, to 940 known for his unification of previously warring tribes from Denmark, Norway and Sweden. Bluetooth likewise was intended to unify different technologies like computers and mobile phones. The Bluetooth logo merges the Nordic runes for H and B.

General information

A typical Bluetooth mobile phone headset

The latest version currently available to consumers is 2.0, but few manufacturers have started shipping any products yet. Apple Computer, Inc. offered the first products supporting version 2.0 to end customers in January 2005. The core chips have been available to OEMs (from November 2004), so there will be an influx of 2.0 devices in mid-2005. The previous version, on which all earlier commercial devices are based, is called 1.2.

Bluetooth is a wireless radio standard primarily designed for low power consumption, with a short range (up to 10 meters [1], ) and with a low-cost transceiver microchip in each device.

It can be used to wirelessly connect peripherals like printers or keyboards to computers, or to have PDAs communicate with other nearby PDAs or computers.

Cell phones with integrated Bluetooth technology have also been sold in large numbers, and are able to connect to computers, PDAs and, specifically, to handsfree devices. BMW was the first motor vehicle manufacturer to install handsfree Bluetooth technology in its cars, adding it as an option on its 3 Series, 5 Series and X5 vehicles. Since then, other manufacturers have followed suit, with many vehicles, including the 2004 Toyota Prius and the 2004 Lexus LS 430. The Bluetooth car kits allow users with Bluetooth-equipped cell phones to make use of some of the phone’s features, such as making calls, while the phone itself can be left in a suitcase or in the boot/trunk, for instance.

The standard also includes support for more powerful, longer-range devices suitable for constructing wireless LANs.

A Bluetooth device playing the role of “master” can communicate with up to 7 devices playing the role of “slave”. At any given instant in time, data can be transferred between the master and one slave; but the master switches rapidly from slave to slave in a round-robin fashion. (Simultaneous transmission from the master to multiple slaves is possible, but not used much in practice). These groups of up to 8 devices (1 master and 7 slaves) are called piconets.

The Bluetooth specification also allows connecting two or more piconets together to form a scatternet, with some devices acting as a bridge by simultaneously playing the master role in one piconet and the slave role in another piconet. These devices have yet to come, though are supposed to appear within the next two years.

Any device may perform an “inquiry” to find other devices to which to connect, and any device can be configured to respond to such inquiries.

Pairs of devices may establish a trusted relationship by learning (by user input) a shared secret known as a “passkey”. A device that wants to communicate only with a trusted device can cryptographically authenticate the identity of the other device. Trusted devices may also encrypt the data that they exchange over the air so that no one can listen in.

The protocol operates in the license-free ISM band at 2.45 GHz. In order to avoid interfering with other protocols which use the 2.45 GHz band, the Bluetooth protocol divides the band into 79 channels (each 1 MHz wide) and changes channels up to 1600 times per second. Implementations with versions 1.1 and 1.2 reach speeds of 723.1 kbit/s. Version 2.0 implementations feature Bluetooth Enhanced Data Rate (EDR), and thus reach 2.1 Mbit/s. Technically version 2.0 devices have a higher power consumption, but the three times faster rate reduces the transmission times, effectively reducing consumption to half that of 1.x devices (assuming equal traffic load).

Bluetooth differs from Wi-Fi in that the latter provides higher throughput and covers greater distances but requires more expensive hardware and higher power consumption. They use the same frequency range, but employ different multiplexing schemes. While Bluetooth is a cable replacement for a variety of applications, Wi-Fi is a cable replacement only for local area network access. A glib summary is that Bluetooth is wireless USB whereas Wi-Fi is wireless Ethernet.

Many USB Bluetooth adapters are available, some of which also include an IrDA adapter.

Embedded Bluetooth

Bluetooth devices and modules are increasingly being made available which come with an embedded stack and a standard UART port. The UART protocol can be as simple as the industry standard AT protocol, which allows the device to be configured to cable replacement mode. This means it now only takes a matter of hours (instead of weeks) to enable legacy wireless products that communicate via UART port.

Features by version

Bluetooth 1.0 and 1.0B

Versions 1.0 and 1.0B had numerous problems and the various manufacturers had great difficulties in making their products interoperable. 1.0 and 1.0B also had mandatory Bluetooth Hardware Device Address (BD_ADDR) transmission in the handshaking process, rendering anonymity impossible at a protocol level, which was a major set-back for services planned to be used in Bluetooth environments, such as Consumerism.

Bluetooth 1.1

In version 1.1 many errata found in the 1.0B specifications were fixed. There was added support for non-encrypted channels.

Bluetooth 1.2

This version is backwards compatible with 1.1 and the major enhancements include

Adaptive Frequency Hopping (AFH), which improves resistance to radio interference by avoiding using crowded frequencies in the hopping sequence
Higher transmission speeds in practice
extended Synchronous Connections (eSCO), which improves voice quality of audio links by allowing retransmissions of corrupted packets.
Received Signal Strength Indicator (RSSI)
Host Controller Interface (HCI) support for 3-wire UART
HCI access to timing information for Bluetooth applications.

Bluetooth 2.0

This version is backwards compatible with 1.x and the major enhancements include

Non-hopping narrowband channel(s) introduced. These are faster but have been criticised as defeating a built-in security mechanism of earlier versions; however frequency hopping is hardly a reliable security mechanism by today’s standards. Rather, Bluetooth security is based mostly on cryptography.
Broadcast/multicast support. Non-hopping channels are used for advertising Bluetooth service profiles offered by various devices to high volumes of Bluetooth devices simultaneously, since there is no need to perform handshaking with every device. (In previous versions the handshaking process takes a bit over one second.)
Enhanced Data Rate (EDR) of 2.1 Mbit/s.
Built-in quality of service.
Distributed media-access control protocols.
Faster response times.
Halved power consumption due to shorter duty cycles.

Future Bluetooth uses

One of the ways Bluetooth technology may become useful is in Voice over IP. When VOIP becomes more widespread, companies may find it unnecessary to employ telephones physically similar to today’s analogue telephone hardware. Bluetooth may then end up being used for communication between a cordless phone and a computer listening for VOIP and with an infrared PCI card acting as a base for the cordless phone. The cordless phone would then just require a cradle for charging. Bluetooth would naturally be used here to allow the cordless phone to remain operational for a reasonably long period.

Security concerns

In November 2003, Ben and Adam Laurie from A.L. Digital Ltd. discovered that serious flaws in Bluetooth security lead to disclosure of personal data (see http://bluestumbler.org). It should be noted however that the reported security problems concerned some poor implementations of Bluetooth, rather than the protocol itself.

In a subsequent experiment, Martin Herfurt from the trifinite.group was able to do a field-trial at the CeBIT fairgrounds showing the importance of the problem to the world. A new attack called BlueBug was used for this experiment.

In April 2004, security consultants @Stake revealed a security flaw that makes it possible to crack into conversations on Bluetooth based wireless headsets by reverse engineering the PIN.

This is one of a number of concerns that have been raised over the security of Bluetooth communications. In 2004 the first purported virus using Bluetooth to spread itself among mobile phones appeared for the Symbian OS. The virus was first described by Kaspersky Labs and requires users to confirm the installation of unknown software before it can propagate. The virus was written as a proof-of-concept by a group of virus writers known as 29a and sent to anti-virus groups. Because of this, it should not be regarded as a security failure of either Bluetooth or the Symbian OS. It has not propagated ‘in the wild’.

In August 2004, a world-record-setting experiment (see also Bluetooth sniping) showed that with directional antennas the range of class 2 Bluetooth radios could be extended to one mile. This enables attackers to access vulnerable Bluetooth-devices from a distance beyond expectation.

Bluetooth uses the SAFER+ algorithm for authentication and key generation.

Bluetooth profiles

In order to use Bluetooth, a device must be able to interpret certain Bluetooth profiles. These define the possible applications. Following profiles are defined:

Generic Access Profile (GAP)
Service Discovery Application Profile (SDAP)
Cordless Telephony Profile (CTP)
Intercom Profile (IP)
Serial Port Profile (SPP)
Headset Profile (HSP)
Dial-up Networking Profile (DUNP)
Fax Profile
LAN Access Profile (LAP)
Generic Object Exchange Profile (GOEP)
Object Push Profile (OPP)
File Transfer Profile (FTP)
Synchronisation Profile (SP)

This profile allows synchronisation of Personal Information Manager (PIM) items. As this profile originated as part of the infra-red specifications but has been adopted by the Bluetooth SIG to form part of the main Bluetooth specification, it is also commonly referred to as IrMC Synchronisation.

Hands-Free Profile (HFP)
Human Interface Device Profile (HID)
Hard Copy Replacement Profile (HCRP)
Basic Imaging Profile (BIP)
Personal Area Networking Profile (PAN)
Basic Printing Profile (BPP)
Advanced Audio Distribution Profile (A2DP)
Audio Video Remote Control Profile (AVRCP)
SIM Access Profile (SAP)

Compatibility of products with profiles can be verified on the Bluetooth Qualification website.

External links

Bluetooth Tutorial Includes information on Architecture, Protocols, Establishing Connections, Security and Comparisons
Bluetooth connecting and paire guide
The Official BluetoothÂ® Wireless Info Site<SIG public pages
Howstuffworks.com explanation of bluetooth
The Bluetooth Car Concept
A series of guides on how-to connect devices like mobile phones, PDAs, desktop/laptops, headsets and use different Bluetooth services
Mapping Salutation Architecture APIs to Bluetooth Service Discovery Layer
Bluetoothâ„¢ Security White Paper
Security Concerns
Laptops, PDA and mobile (cell) phones with Bluetooth(TM) and Linux
Bluetooth qualified products
Bluecarkit discussion forum about Bluetooth car handsfree
Bluetooth in spanish
Radio-Electronics.ComÂ â€“ Overview of Bluetooth and its operationi>
Bluetooth Background information about bluetooth (German)
Bluetooth.orgÂ â€“ The Official Bluetooth Membership Sitei>

Archives for : identification

SCADA Security Presentation

SCADA considerations

EFT Syetms and Device Considerations

Mobile Banking Security and Risk Assessment Considerations

Technology is always being challenged

Bluetooth Wireless Specification

Table of contents

About the name

General information

Embedded Bluetooth

Features by version

Bluetooth 1.0 and 1.0B

Bluetooth 1.1

Bluetooth 1.2

Bluetooth 2.0

Future Bluetooth uses

Security concerns

Bluetooth profiles

See also

External links

Categories

Archives

Blogrolls