Cracks appear in Bluetooth security
By John Blau, IDG News Service
February 11, 2004 11:35 am ET
Be careful the next time you turn on your Bluetooth-enabled phone: You could unknowingly be opening the door to a nasty intruder who could steal confidential information such as your address book or even use your phone to make expensive calls.
Security experts in the U.K. have discovered serious flaws in some Bluetooth-enabled phones, prompting one supplier of the vulnerable phones, Nokia Corp., to recommend precautionary measures.
...
Until now, the only known Bluetooth security shortcoming has been "bluejacking," an increasingly popular means of exchanging short three- or four-word messages in the display area designated for the name of the initiating device, according to Laurie. The process, essentially, allows communication to take place without pairing, which requires partners to exchange a PIN (personal identification number) to establish a connection.
But Laurie said he and his colleagues at A.L. Digital have uncovered not one but two new security flaws. He referred to the one as "bluesnarf" and the other as a "backdoor" attack.
"Bluesnarf is a tool I've written that allows you to bypass the pairing process to connect to a Bluetooth-enabled phone and, essentially, break into the device to steal or manipulate data," he said.
By John Blau, IDG News Service
February 11, 2004 11:35 am ET
Be careful the next time you turn on your Bluetooth-enabled phone: You could unknowingly be opening the door to a nasty intruder who could steal confidential information such as your address book or even use your phone to make expensive calls.
Security experts in the U.K. have discovered serious flaws in some Bluetooth-enabled phones, prompting one supplier of the vulnerable phones, Nokia Corp., to recommend precautionary measures.
...
Until now, the only known Bluetooth security shortcoming has been "bluejacking," an increasingly popular means of exchanging short three- or four-word messages in the display area designated for the name of the initiating device, according to Laurie. The process, essentially, allows communication to take place without pairing, which requires partners to exchange a PIN (personal identification number) to establish a connection.
But Laurie said he and his colleagues at A.L. Digital have uncovered not one but two new security flaws. He referred to the one as "bluesnarf" and the other as a "backdoor" attack.
"Bluesnarf is a tool I've written that allows you to bypass the pairing process to connect to a Bluetooth-enabled phone and, essentially, break into the device to steal or manipulate data," he said.
<< Home