Cyberstudy
PDF p.274 In progress

Bluetooth Connection Methods

Open PDF at p.274 21 flashcards

Summary

PDF p.274

Bluetooth is a short-range wireless technology for personal area networking. It has several security issues, including device discovery, authentication and authorization, and malware. Bluetooth security features help mitigate these risks.

In plain words

Supplementary — not from your PDF

Bluetooth risks include device discovery (even non-discoverable devices can be detected), weak pairing (change default passkeys such as 0000), and malware or exploits such as BlueBorne. Protect it with firmware updates, reviewing paired devices, and turning Bluetooth off when not needed. Security features include pairing with cryptographic keys (numeric comparison, passkey, out-of-band), permission prompts, encryption, Bluetooth Secure Connections, and BLE random addresses that prevent tracking.

Detailed explanation

PDF p.274
  • Device Discovery
    • Discoverable Mode: Device connects to nearby Bluetooth devices.
    • Detection: Even non-discoverable devices can be detected.
  • Authentication and Authorization
    • Pairing: Devices authenticate using a passkey.
    • Secure Passkey: Change default passkey (e.g., "0000") to a secure phrase.
    • Pairing List: Regularly check and validate paired devices.
  • Malware
    • Exploits: Bluetooth worms and application exploits like BlueBorne can compromise systems.
    • Firmware Updates: Keep devices updated to mitigate vulnerabilities.

Bluetooth Security Features

  • Pairing and Authentication
    • Cryptographic Keys: Authenticate devices and establish secure communication.
    • Methods: Numeric comparison, passkey entry, out-of-band (OOB) authentication.
  • Bluetooth Permissions
    • User Consent: Requires permission to connect and access services.
    • Control: Manage which devices can connect.
  • Encryption
    • Data Protection: Encrypts data transmitted between devices.
    • Shared Secret Key: Used for encryption after pairing.
  • Bluetooth Secure Connections (BSC)
    • Enhanced Security: Increased resistance to eavesdropping and attacks.
  • Bluetooth Low Energy (BLE) Privacy
    • Random Addresses: Prevents tracking and unauthorized identification.

Important terms

taken from the text above
Discoverable Mode
Device connects to nearby Bluetooth devices.
Pairing
Devices authenticate using a passkey.
Secure Passkey
Change default passkey (e.g., "0000") to a secure phrase.
Pairing List
Regularly check and validate paired devices.
Exploits
Bluetooth worms and application exploits like BlueBorne can compromise systems.
Firmware Updates
Keep devices updated to mitigate vulnerabilities.
Cryptographic Keys
Authenticate devices and establish secure communication.
User Consent
Requires permission to connect and access services.
Data Protection
Encrypts data transmitted between devices.
Shared Secret Key
Used for encryption after pairing.
Enhanced Security
Increased resistance to eavesdropping and attacks.
Random Addresses
Prevents tracking and unauthorized identification.
BSC Bluetooth Secure Connections BLE Bluetooth Low Energy

Examples & real-world scenarios

Supplementary — not from your PDF
  • Removing old, unknown devices from a phone's paired list.
  • Updating headset firmware.
  • Numeric comparison pairing: both devices show the same code.

Scenario

A security advisory warns about a Bluetooth vulnerability. Until patches are installed, the organization advises staff to turn Bluetooth off when not in use and checks MDM compliance.

Common mistakes

Supplementary — not from your PDF
  • Leaving devices in discoverable mode.
  • Keeping default passkeys.

Practical skills

Supplementary — not from your PDF
  • Review and clean up Bluetooth pairings on your own devices.

What I should remember

Key Points PDF p.274
  • Device Discovery: Even non-discoverable devices can be detected.
  • Authentication and Authorization: Use secure passkeys and validate paired devices.
  • Malware: Keep devices updated to prevent exploits.
  • Bluetooth Security Features
    • Pairing and Authentication: Use cryptographic keys.
    • Permissions: Require user consent.
    • Encryption: Protect data transmission.
    • BSC: Enhanced security against attacks.
    • BLE Privacy: Uses random addresses to prevent tracking.