I thought this was cool. It may come in handy for Ham Radio.
Archives for : javascript
A blog posting on BoingBoing provides further discussion as to the
inappropriate deployment and of RFID chips within the existing payment
marketplace.
http://www.boingboing.net/2006/10/23/report_contactless_c.html
The underlying point of this article is, the card schemes and banks said they are using key rotating encryption of all data between the card and the acquirer/issuer, but this is clearly not the case in many situations.
Another interesting paper is ‘RFID Payment Card Vulnerabilities Technical Report’ located at:
http://www.nytimes.com/packages/pdf/business/20061023_CARD/techreport.pdf
I read a very interesting paper created by the University of Massachusetts, RSA Laboratories and Innealta, Inc.<<
This paper primarily relates to the compromise of contact less payment technologies (RFID) if the RFID and/or reader have not been implemented correctly or the solution provider has used an inappropriate type of RFID and discusses the challenges around Chip and Pin with respect to financial transactions e.g. EMV standards and compliance.
Additionally, the paper describes a RFID relay method which is being discussed within many forums around the world and we have now begun to see equipment being produced for the RFID skimmers/clonners to use for malicious means.
The overarching point of this paper is to use an appropriate RFID & Chip solutions which supports the security/privacy of the user and purpose of the transaction (financial or non financial)<<
The paper can be found at http://prisms.cs.umass.edu/~kevinfu/papers/RFID-CC-manuscript.pdf
In modern payment RFID & Chip solutions, newer devices can be used which possess a high degree of processing power and are therefore able to execute strong cryptographic methods (such as digital signatures) to protect the identification and payment information whilst the transaction is occurring.
These systems often utilise bidirectional authentication between the RFID/Chip scanner and the RFID tag/Chip prior to performing the transaction. These methods and cryptographic algorithms are accepted and proven to work within the traditional payment markets.
As mentioned in the paper, some solution store static digitally signed and/or encrypted data which is provided to the RFID/Chip reader when queried, but this data never changes from one transaction to another. This may allow a malicious individual to capture and re-inject the data into the reader at a later stage. The alternative to storing static digitally signed and/or encrypted data is to negotiate a key exchange at the time of the transaction in which the card/value information is encrypted and subsequently transmitted. With this method the transmitted data
changes on every transaction and therefore even if a malicious individual was to capture the encrypted transaction data from one transaction, this would not be accepted by the reader if re-injected at a later stage.
Although this is the case today, older RFID/Chip solutions often use technologies which are not appropriate for financial transactions and therefore may be compromised easily and in some cases without the knowledge of the card holder, merchant or acquirer.
I find this interesting how some of these less secure solution have been approved for use by acquiring banks and the card schemes around the world (if they were told) in recent years, where it has been seen that these solutions have utilised techniques or deployment methods which can be compromised. These technologies and techniques would never be approved within the Point of Sale (PoS) or traditional banking markets.
It can only be assumed that the need to get product to market quickly at the expense of proper testing, understanding and with due consideration to industry lessons learnt has succeeded again.
I recently had a couple of complaints in regards to the new Website. It turns out the site looks OK in Firefox but does not seem to work very well with Internet Explorer.
I ran the W3C Validator located at http://validator.w3.org/
When executed against the site it found 11 errors. The files and fixes (highlighted in RED) are described below.
File: Header.php
Error: required attribute “type” not specified
<script type=”text/javascript” src=”<?php bloginfo(‘template_directory’); ?>/js/addEvent.js”></script>
<script type=”text/javascript” src=”<?php bloginfo(‘template_directory’); ?>/js/sweetTitles.js”></script>
I have also seen some other errors in Header.php, but they don´t seem to be a big problem.
Error: document type does not allow element “li” here; missing one of “ul”, “ol”, “menu”, “dir” start-tag.
Update
I finally worked out what was going on…
It was the mod_rewrite (RewriteEngine) in the .htaccess file.
I´m running WPSuperCache, so I thought this may have caused some issues.
As it turned out it was the WordPress section of the .htaccess which was causing the problems. I probably modified it at some stage…
Another Problem Found and Fixed
I have been having problems when placing graphics into a posting, where although the WYSIWYG editor shows the correct layout, the text below the image wraps around the graphic when the site is viewed.
After some looking around, I found a similar article written in relation to a different theme. As it turns out the fix for the DUST-317 Theme is the same.
Edit the DUST-317 Theme style.css located in the DUST-317 theme directory. Search for this line.
#content p img{float:left;border:none;margin-right:10px;margin-bottom:10px;}
Remove the float:left; for the above line, making it look like this.
#content p img{border:none;margin-right:10px;margin-bottom:10px;}
ThatÅ› it… now the text sits under the graphics OK.
http://www.eng.tau.ac.il/~yash/kw-usenix06/index.html </a>
Check it Out…
How to Build a Low-Cost, Extended-Range RFID Skimmer
Also some of the supporting documents.
A Practical Relay Attack on ISO 14443 Proximity Cards
S4100 Multi-Function Reader Module Data Sheet
Security Analysis of a Cryptographically-Enabled RFID’s
Summary
In November 2003, Adam Laurie of A.L. Digital Ltd. discovered that there are serious flaws in the authentication and/or data transfer mechanisms on some bluetooth enabled devices. Specifically, three vulnerabilities have been found:
Firstly, confidential data can be obtained, anonymously, and without the owner’s knowledge or consent, from some bluetooth enabled mobile phones. This data includes, at least, the entire phone book and calendar, and the phone’s IMEI.
Secondly, it has been found that the complete memory contents of some mobile phones can be accessed by a previously trusted (“paired”) device that has since been removed from the trusted list. This data includes not only the phonebook and calendar, but media files such as pictures and text messages. In essence, the entire device can be “backed up” to an attacker’s own system.
Thirdly, access can be gained to the AT command set of the device, giving full access to the higher level commands and channels, such as data, voice and messaging. This third vulnerability was identified by Martin Herfurt, and they have since started working together on finding additional possible exploits resulting from this vulnerability.
Finally, the current trend for “Bluejacking” is promoting an environment which puts consumer devices at greater risk from the above attacks.
Vulnerabilities
The SNARF attack:
It is possible, on some makes of device, to connect to the device without alerting the owner of the target device of the request, and gain access to restricted portions of the stored data therein, including the entire phonebook (and any images or other data associated with the entries), calendar, real-time clock, business card, properties, change log, IMEI (International Mobile Equipment Identity [6], which uniquely identifies the phone to the mobile network, and is used in illegal phone ‘cloning’). This is normally only possible if the device is in “discoverable” or “visible” mode, but there are tools available on the Internet that allow even this safety net to be bypassed[4]. Further details will not be released at this time (see below for more on this), but the attack can and will be demonstrated to manufacturers and press if required.
The BACKDOOR attack:
The backdoor attack involves establishing a trust relationship through the “pairing” mechanism, but ensuring that it no longer appears in the target’s register of paired devices. In this way, unless the owner is actually observing their device at the precise moment a connection is established, they are unlikely to notice anything untoward, and the attacker may be free to continue to use any resource that a trusted relationship with that device grants access to (but note that so far we have only tested file transfers). This means that not only can data be retrieved from the phone, but other services, such as modems or Internet, WAP and GPRS gateways may be accessed without the owner’s knowledge or consent. Indications are that once the backdoor is installed, the above SNARF attack will function on devices that previously denied access, and without the restrictions of a plain SNARF attack, so we strongly suspect that the other services will prove to be available also.
The BLUEBUG attack:
The bluebug attack creates a serial profile connection to the device, thereby giving full access to the AT command set, which can then be exploited using standard off the shelf tools, such as PPP for networking and gnokii for messaging, contact management, diverts and initiating calls. With this facility, it is possible to use the phone to initiate calls to premium rate numbers, send sms messages, read sms messages, connect to data services such as the Internet, and even monitor conversations in the vicinity of the phone. This latter is done via a voice call over the GSM network, so the listening post can be anywhere in the world. Bluetooth access is only required for a few seconds in order to set up the call. Call forwarding diverts can be set up, allowing the owner’s incoming calls to be intercepted, either to provide a channel for calls to more expensive destinations, or for identity theft by impersonation of the victim.
Bluejacking:
Although known to the technical community and early adopters for some time, the process now known as “Bluejacking”[1] has recently come to the fore in the consumer arena, and is becoming a popular mechanism for exchanging anonymous messages in public places. The technique involves abusing the bluetooth “pairing”[2] protocol, the system by which bluetooth devices authenticate each other, to pass a message during the initial “handshake” phase. This is possible because the “name” of the initiating bluetooth device is displayed on the target device as part of the handshake exchange, and, as the protocal allows a large user defined name field – up to 248 characters – the field itself can be used to pass the message. This is all well and good, and, on the face of it, fairly harmless, but, unfortunately, there is a down side. There is a potential security problem with this, and the more the practice grows and is accepted by the user community, and leveraged as a marketing tool by the vendors, the worse it will get. The problem lies in the fact that the protocol being abused is designed for information exchange. The ability to interface with other devices and exchange, update and synchronise data, is the raison d’être of bluetooth. The bluejacking technique is using the first part of a process that allows that exchange to take place, and is therefore open to further abuse if the handshake completes and the “bluejacker” successfully pairs with the target device. If such an event occurs, then all data on the target device becomes available to the initiator, including such things as phone books, calendars, pictures and text messages. As the current wave of PDA and telephony integration progresses, the volume and quality of such data will increase with the devices’ capabilities, leading to far more serious potential compromise. Given the furore that irrupted when a second-hand Blackberry PDA was sold without the previous owner’s data having been wiped[3], it is alarming to think of the consequences of a single bluejacker gathering an entire corporate staff’s contact details by simply attending a conference or camping outside their building or in their foyer with a bluetooth capable device and evil intent. Of course, corporates are not the only potential targets – a bluejacking expedition to, say, The House of Commons, or The US Senate, could provide some interesting, valuable and, who’s to say, potentially damaging or compromising data.<<<
The above may sound alarmist and far fetched, and the general reaction would probably be that most users would not be duped into allowing the connection to complete, so the risk is small. However, in today’s society of instant messaging, the average consumer is under a constant barrage of unsolicited messages in one form or another, whether it be by SPAM email, or “You have won!” style SMS text messages, and do not tend to treat them with much suspicion (although they may well be sceptical about the veracity of the offers). Another message popping up on their ‘phone saying something along the lines of “You have won 10,000 pounds! Enter this 4 digit PIN number and then dial 0900-SUCKER to collect your prize!” is unlikely to cause much alarm, and is more than likely to succeed in many cases.
Workarounds and fixes
We are not aware of any workarounds for the SNARF or BLUEBUG attacks at this time, other than to switch off bluetooth. For permanent fixes, see the ‘Fixes’ section at the bottom of the page.
To permanently remove a pairing, and protect against future BACKDOOR attacks, it seems you must perform a factory reset, but this will, of course, erase all your personal data.
To avoid Bluejacking, “just say no”. 
The above methods work to the best of our knowledge, but, as the devices affected are running closed-source proprietary software, it not possible to verify that without the collaboration of the manufacturers. We therefore make no claims as to the level of protection they provide, and you must continue to use bluetooth at your own risk.
Who’s Vulnerable
To date the quantity of devices tested is not great. However, due to the fact that they are amongst the most popular brands, we still consider the affected group to be large. It is also assumed that there are shared implementations of the bluetooth stack, so what affects one model is likely to affect others. This table is accurate to the best of our knowledge, but without the cooperation of the manufacturers (which we currently do not have), it is not possible to conduct more extensive validation.
The devices known to be vulnerable at this time are:
| Vulnerability Matrix (* = NOT Vulnerable) | ||||||
| Make | Model | Firmware Rev | BACKDOOR | SNARF when Visible | SNARF when NOT Visible | BUG |
| Ericsson | T68 | 20R1B 20R2A013 20R2B013 20R2F004 20R5C001 | ? | Yes | No | No |
| Sony Ericsson | R520m | 20R2G | ? | Yes | No | ? |
| Sony Ericsson | T68i | 20R1B 20R2A013 20R2B013 20R2F004 20R5C001 | ? | Yes | ? | ? |
| Sony Ericsson | T610 | 20R1A081 20R1L013 20R3C002 20R4C003 20R4D001 | ? | Yes | No | ? |
| Sony Ericsson | T610 | 20R1A081 | ? | ? | ? | Yes |
| Sony Ericsson | Z1010 | ? | ? | Yes | ? | ? |
| Sony Ericsson | Z600 | 20R2C007 20R2F002 20R5B001 | ? | Yes | ? | ? |
| Nokia | 6310 | 04.10 04.20 4.07 4.80 5.22 5.50 | ? | Yes | Yes | ? |
| Nokia | 6310i | 4.06 4.07 4.80 5.10 5.22 5.50 5.51 | No | Yes | Yes | Yes |
| Nokia | 7650 | ? | Yes | No (+) | ? | No |
| Nokia | 8910 | ? | ? | Yes | Yes | ? |
| Nokia | 8910i | ? | ? | Yes | Yes | ? |
| * Siemens | S55 | ? | No | No | No | No |
| * Siemens | SX1 | ? | No | No | No | No |
| Motorola | V600 (++) | ? | No | No | No | Yes |
| Motorola | V80 (++) | ? | No | No | No | Yes |
+ We now believe the 7650 is only vulnerable to SNARF if it has already been BACKDOORed.
++ The V600 and V80 are discoverable for only 60 seconds, when first powered on or when this feature is user selected, and the window for BDADDR discovery is therefore very small. Motorola have stated that they will correct the vulnerability in current firmware.
Disclosure
What is the Philosophy of Full Disclosure, and why are we providing the tools and detailing the methods that allow this to be done? The reasoning is simple – by exposing the problem we are achieving two goals: firstly, to alert users that the dangers exist, in order that they can take their own precautions against compromise, and secondly, to put pressure on manufacturers to rectify the situation. Consumers have a right to expect that their confidential data is treated as such, and is not subject to simple compromise by poorly implemented protocols on consumer devices. Manufacturers have a duty of care to ensure that such protection is provided, but, in practice, commercial considerations will often take precedence, and, given the choice, they may choose to simply supress or hide the problem, or, even worse, push for laws that prevent the discovery and/or disclosure of such flaws[5]. In our humble opinion, laws provide scant consumer protection against the lawless.
After 13 months, and in consideration of the fact that affected manufacturers had acknowledged the issues and made updated firmware available, Full Disclosure took place at the Chaos Computer Club’s annual congress – 21C3, in Berlin, 2004.
Slides from the disclosure talk can be found here: http://trifinite.org/Downloads/21c3_Bluetooth_Hacking.pdf
Tools
Proof of concept utilities have been developed, but are not yet available in the wild. They are:
- bluestumbler – Monitor and log all visible bluetooth devices (name, MAC, signal strength, capabilities), and identify manufacturer from MAC address lookup.
- bluebrowse – Display available services on a selected device (FAX, Voice, OBEX etc).
- bluejack – Send anoymous message to a target device (and optionally broadcast to all visible devices).
- bluesnarf – Copy data from target device (everything if pairing succeeds, or a subset in other cases, including phonebook and calendar. In the latter case, user will not be alerted by any bluejack message).
- bluebug – Set up covert serial channel to device.
Tools will not be released at this time, so please do not ask. However, if you are a bona-fide manufacturer of bluetooth devices that we have been otherwise unable to contact, please feel free to get in touch for more details on how you can identify your device status.
Credits
The above vulnerabilities were discovered by Adam Laurie, during the course of his work with A.L. Digital, in November 2003, and this announcement was prepared thereafter by Adam and Ben Laurie for immediate release.
Adam Laurie is Managing Director and Chief Security Officer of A.L. Digital Ltd.
Ben Laurie is Technical Director of A.L. Digital, and author of Apache-SSL and contributor to many other open source projects, too numerous to expand on here.
A.L. Digital Ltd. are the owner operators of The Bunker, the world’s most secure data centre(s).
e: adam@algroup.co.uk
w: http://www.aldigital.co.uk
e: ben@algroup.co.uk
w: http://www.apache-ssl.org/ben.html
Further information relating to this disclosure will be updated at http://www.bluestumbler.org
References:
[1]
- http://www.bluejackq.com/
- http://www.theregister.co.uk/content/6/33781.html
- http://news.bbc.co.uk/1/hi/technology/3237755.stm
[2]
[3]
- www.outlaw.com
[4]
- bluesniff
- btscanner
- redfang
[5]
[6]
- http://www.babt.com/gsm-imei-number-allocation.asp
- http://www.mobiledia.com/glossary/68.html
- BBC News Technology Page
- The Register
- ZDNet UK (Original Coverage)
- ZDNet UK (Nokia response)
- ZDNet (Sony Ericsson response)
- Slashdot
- The Times
- The Times (Palace of Westminster)
- The Bluetooth SIG.
- Bruce Potter’s Defcon-11 presentation [Powerpoint].
- @Stake’s Bluetooth Discovery Paper [PDF].
- Marcel Holtmann’s German papers.
- Marcel Holtmann’s other papers.
- Bluetooth Device Security Database.
- Martin Herfurt’s CeBIT snarfing expedition.
- Slides from Blackhat/DEFCON talk.
In the news
Other related links
Fixes
This article is about the Bluetooth wireless specification. For King Harold Bluetooth, see Harold I of Denmark
Bluetooth is an industrial specification for wireless personal area networks (PANs).
Bluetooth provides a way to connect and exchange information between devices like personal digital assistants (PDAs), mobile phones, laptops, PCs, printers and digital cameras via a secure, low-cost, globally available short range radio frequency.
Bluetooth lets these devices talk to each other when they come in range, even if they’re not in the same room, as long as they are within 10 metres (32 feet) of each other.
The spec was first developed by Ericsson, later formalised by the Bluetooth Special Interest Group (SIG). The SIG was formally announced on May 20, 1999. It was established by Sony Ericsson, IBM, Intel, Toshiba and Nokia, and later joined by many other companies as Associate or Adopter members.
Table of contents* 1 About the name |
About the name
The system is named after a Danish king Harald Blåtand (<arold Bluetooth in English), King of Denmark and Norway from 935 and 936 respectively, to 940 known for his unification of previously warring tribes from Denmark, Norway and Sweden. Bluetooth likewise was intended to unify different technologies like computers and mobile phones. The Bluetooth logo merges the Nordic runes for H and B.
General information
A typical Bluetooth mobile phone headset
The latest version currently available to consumers is 2.0, but few manufacturers have started shipping any products yet. Apple Computer, Inc. offered the first products supporting version 2.0 to end customers in January 2005. The core chips have been available to OEMs (from November 2004), so there will be an influx of 2.0 devices in mid-2005. The previous version, on which all earlier commercial devices are based, is called 1.2.
Bluetooth is a wireless radio standard primarily designed for low power consumption, with a short range (up to 10 meters [1], ) and with a low-cost transceiver microchip in each device.
It can be used to wirelessly connect peripherals like printers or keyboards to computers, or to have PDAs communicate with other nearby PDAs or computers.
Cell phones with integrated Bluetooth technology have also been sold in large numbers, and are able to connect to computers, PDAs and, specifically, to handsfree devices. BMW was the first motor vehicle manufacturer to install handsfree Bluetooth technology in its cars, adding it as an option on its 3 Series, 5 Series and X5 vehicles. Since then, other manufacturers have followed suit, with many vehicles, including the 2004 Toyota Prius and the 2004 Lexus LS 430. The Bluetooth car kits allow users with Bluetooth-equipped cell phones to make use of some of the phone’s features, such as making calls, while the phone itself can be left in a suitcase or in the boot/trunk, for instance.
The standard also includes support for more powerful, longer-range devices suitable for constructing wireless LANs.
A Bluetooth device playing the role of “master” can communicate with up to 7 devices playing the role of “slave”. At any given instant in time, data can be transferred between the master and one slave; but the master switches rapidly from slave to slave in a round-robin fashion. (Simultaneous transmission from the master to multiple slaves is possible, but not used much in practice). These groups of up to 8 devices (1 master and 7 slaves) are called piconets.
The Bluetooth specification also allows connecting two or more piconets together to form a scatternet, with some devices acting as a bridge by simultaneously playing the master role in one piconet and the slave role in another piconet. These devices have yet to come, though are supposed to appear within the next two years.
Any device may perform an “inquiry” to find other devices to which to connect, and any device can be configured to respond to such inquiries.
Pairs of devices may establish a trusted relationship by learning (by user input) a shared secret known as a “passkey”. A device that wants to communicate only with a trusted device can cryptographically authenticate the identity of the other device. Trusted devices may also encrypt the data that they exchange over the air so that no one can listen in.
The protocol operates in the license-free ISM band at 2.45 GHz. In order to avoid interfering with other protocols which use the 2.45 GHz band, the Bluetooth protocol divides the band into 79 channels (each 1 MHz wide) and changes channels up to 1600 times per second. Implementations with versions 1.1 and 1.2 reach speeds of 723.1 kbit/s. Version 2.0 implementations feature Bluetooth Enhanced Data Rate (EDR), and thus reach 2.1 Mbit/s. Technically version 2.0 devices have a higher power consumption, but the three times faster rate reduces the transmission times, effectively reducing consumption to half that of 1.x devices (assuming equal traffic load).
Bluetooth differs from Wi-Fi in that the latter provides higher throughput and covers greater distances but requires more expensive hardware and higher power consumption. They use the same frequency range, but employ different multiplexing schemes. While Bluetooth is a cable replacement for a variety of applications, Wi-Fi is a cable replacement only for local area network access. A glib summary is that Bluetooth is wireless USB whereas Wi-Fi is wireless Ethernet.
Many USB Bluetooth adapters are available, some of which also include an IrDA adapter.
Embedded Bluetooth
Bluetooth devices and modules are increasingly being made available which come with an embedded stack and a standard UART port. The UART protocol can be as simple as the industry standard AT protocol, which allows the device to be configured to cable replacement mode. This means it now only takes a matter of hours (instead of weeks) to enable legacy wireless products that communicate via UART port.
Features by version
Bluetooth 1.0 and 1.0B
Versions 1.0 and 1.0B had numerous problems and the various manufacturers had great difficulties in making their products interoperable. 1.0 and 1.0B also had mandatory Bluetooth Hardware Device Address (BD_ADDR) transmission in the handshaking process, rendering anonymity impossible at a protocol level, which was a major set-back for services planned to be used in Bluetooth environments, such as Consumerism.
Bluetooth 1.1
In version 1.1 many errata found in the 1.0B specifications were fixed. There was added support for non-encrypted channels.
Bluetooth 1.2
This version is backwards compatible with 1.1 and the major enhancements include
- Adaptive Frequency Hopping (AFH), which improves resistance to radio interference by avoiding using crowded frequencies in the hopping sequence
- Higher transmission speeds in practice
- extended Synchronous Connections (eSCO), which improves voice quality of audio links by allowing retransmissions of corrupted packets.
- Received Signal Strength Indicator (RSSI)
- Host Controller Interface (HCI) support for 3-wire UART
- HCI access to timing information for Bluetooth applications.
Bluetooth 2.0
This version is backwards compatible with 1.x and the major enhancements include
- Non-hopping narrowband channel(s) introduced. These are faster but have been criticised as defeating a built-in security mechanism of earlier versions; however frequency hopping is hardly a reliable security mechanism by today’s standards. Rather, Bluetooth security is based mostly on cryptography.
- Broadcast/multicast support. Non-hopping channels are used for advertising Bluetooth service profiles offered by various devices to high volumes of Bluetooth devices simultaneously, since there is no need to perform handshaking with every device. (In previous versions the handshaking process takes a bit over one second.)
- Enhanced Data Rate (EDR) of 2.1 Mbit/s.
- Built-in quality of service.
- Distributed media-access control protocols.
- Faster response times.
- Halved power consumption due to shorter duty cycles.
Future Bluetooth uses
One of the ways Bluetooth technology may become useful is in Voice over IP. When VOIP becomes more widespread, companies may find it unnecessary to employ telephones physically similar to today’s analogue telephone hardware. Bluetooth may then end up being used for communication between a cordless phone and a computer listening for VOIP and with an infrared PCI card acting as a base for the cordless phone. The cordless phone would then just require a cradle for charging. Bluetooth would naturally be used here to allow the cordless phone to remain operational for a reasonably long period.
Security concerns
In November 2003, Ben and Adam Laurie from A.L. Digital Ltd. discovered that serious flaws in Bluetooth security lead to disclosure of personal data (see http://bluestumbler.org). It should be noted however that the reported security problems concerned some poor implementations of Bluetooth, rather than the protocol itself.
In a subsequent experiment, Martin Herfurt from the trifinite.group was able to do a field-trial at the CeBIT fairgrounds showing the importance of the problem to the world. A new attack called BlueBug was used for this experiment.
In April 2004, security consultants @Stake revealed a security flaw that makes it possible to crack into conversations on Bluetooth based wireless headsets by reverse engineering the PIN.
This is one of a number of concerns that have been raised over the security of Bluetooth communications. In 2004 the first purported virus using Bluetooth to spread itself among mobile phones appeared for the Symbian OS. The virus was first described by Kaspersky Labs and requires users to confirm the installation of unknown software before it can propagate. The virus was written as a proof-of-concept by a group of virus writers known as 29a and sent to anti-virus groups. Because of this, it should not be regarded as a security failure of either Bluetooth or the Symbian OS. It has not propagated ‘in the wild’.
In August 2004, a world-record-setting experiment (see also Bluetooth sniping) showed that with directional antennas the range of class 2 Bluetooth radios could be extended to one mile. This enables attackers to access vulnerable Bluetooth-devices from a distance beyond expectation.
Bluetooth uses the SAFER+ algorithm for authentication and key generation.
Bluetooth profiles
In order to use Bluetooth, a device must be able to interpret certain Bluetooth profiles. These define the possible applications. Following profiles are defined:
- Generic Access Profile (GAP)
- Service Discovery Application Profile (SDAP)
- Cordless Telephony Profile (CTP)
- Intercom Profile (IP)
- Serial Port Profile (SPP)
- Headset Profile (HSP)
- Dial-up Networking Profile (DUNP)
- Fax Profile
- LAN Access Profile (LAP)
- Generic Object Exchange Profile (GOEP)
- Object Push Profile (OPP)
- File Transfer Profile (FTP)
- Synchronisation Profile (SP)
This profile allows synchronisation of Personal Information Manager (PIM) items. As this profile originated as part of the infra-red specifications but has been adopted by the Bluetooth SIG to form part of the main Bluetooth specification, it is also commonly referred to as IrMC Synchronisation.
- Hands-Free Profile (HFP)
- Human Interface Device Profile (HID)
- Hard Copy Replacement Profile (HCRP)
- Basic Imaging Profile (BIP)
- Personal Area Networking Profile (PAN)
- Basic Printing Profile (BPP)
- Advanced Audio Distribution Profile (A2DP)
- Audio Video Remote Control Profile (AVRCP)
- SIM Access Profile (SAP)
Compatibility of products with profiles can be verified on the Bluetooth Qualification website.
See also
- Bluechat
- Bluejacking – a form of communication via Bluetooth
- Bluetooth sniping
- Bluesnarfing
- Blunt – Bluetooth protocol stack for Newton OS 2.1
- Cable spaghetti – a problem wireless technology hopes to solve
- IrDA
- OBEX
- Jini
- LibertyLink
- OSGi Alliance
- Salutation
- Service Location Protocol
- Toothing
- Universal plug-and-play
- Wi-Fi
- Wireless dating
- Wireless AV kit with Bluetooth for modern LCD TV and computer displays.
- ZigBee – an alternative digital radio technology that claims to be simpler and cheaper than uetooth, it also needs less power consumption.
External links
- Bluetooth Tutorial Includes information on Architecture, Protocols, Establishing Connections, Security and Comparisons
- Bluetooth connecting and paire guide
- The Official Bluetooth® Wireless Info Site<SIG public pages
- Howstuffworks.com explanation of bluetooth
- The Bluetooth Car Concept
- A series of guides on how-to connect devices like mobile phones, PDAs, desktop/laptops, headsets and use different Bluetooth services
- Mapping Salutation Architecture APIs to Bluetooth Service Discovery Layer
- Bluetoothâ„¢ Security White Paper
- Security Concerns
- Laptops, PDA and mobile (cell) phones with Bluetooth(TM) and Linux
- Bluetooth qualified products
- Bluecarkit discussion forum about Bluetooth car handsfree
- Bluetooth in spanish
- Radio-Electronics.Com – Overview of Bluetooth and its operationi>
- Bluetooth Background information about bluetooth (German)
- Bluetooth.org – The Official Bluetooth Membership Sitei>