offline
- nulti.korisnik
- Legendarni građanin
- Pridružio: 20 Feb 2005
- Poruke: 4505
- Gde živiš: planeta Zemlja
|
Interesantno je da je cak i ovo provaljeno :
==============================================
The two-step attack can cause two devices to reestablish the link between them, a process known as "pairing," and then use the data exchanged during pairing to guess the password that secures the connection in well under a second. A successful attack could allow an attacker to eavesdrop and potentially issue commands to the other device, said Avishai Wool, assistant professor of electrical engineering at Tel Aviv University in Israel and a co-author of the paper.
"At a minimum, it allows the attacker to eavesdrop on all the subsequent encrypted communication between two Bluetooth devices," Wool said in an e-mail interview. "If the attacker can also fake his own Bluetooth device address, he can potentially pretend to be one device and pair with the other, which may allow him to issue commands."
The attacker could conceivable mimic any other supported Bluetooth device, such as a headset for a phone, he said. If the one device could extract personal data from or issue commands to the other, then so could the attacker.
The paper, which was presented at the MobiSys 2005 conference on Monday, caused a stir among security experts because the technique is the first general purpose attack to threaten Bluetooth devices. Past attacks only worked against devices that improperly implemented Bluetooth or under special circumstances.
The Bluetooth Special Interest Group (SIG), the organization that sets the specifications for the standard, placed the latest attack in the latter category, because devices that have longer, alphanumeric PINs are effectively protected against the technique.
"So far, no security holes have been discovered in the Bluetooth specification itself," the group said in a statement issued on Wednesday in response to the researchers' paper. "Vulnerabilities that have come to light either exploit the Bluetooth link as a conduit, much like the Internet to the PC, or as a result of the implementation of Bluetooth technology within the device."
Two years ago, security researcher Ollie Whitehouse released a tool known as RedFang to detect Bluetooth devices, even if those devices where not broadcasting their address. Devices set to that stealth mode do not answer any queries unless specifically destined for the adapter's six-byte address (Updated: 9 June 2005).
Other minor security threats include Bluesnarfing, where attackers attempt to connect to weakly secured phones and grab data, and Bluejacking, where one person spams other devices within range with unsolicited messages.
The latest attack is more serious and extends previous research by Redfang creator Ollie Whitehouse, now a technical manager for security firm Symantec. (SecurityFocus is owned by Symantec.) A year ago, Whitehouse proposed a way to brute force PINs of only a few digits; the current researchers refined that attack and made it more useful, Whitehouse said.
"They not only improved on that attack, but they also found a way to make it occur at a time of their choosing," he said.
The latest attack allows an attacker equipped with specialized hardware to reset the pairing process and then record the resulting exchange of data. The brute force razbijacing algorithm created by the researchers can quickly use that data to find the PIN that secures either device. A password made up of 4 digits takes 0.06 seconds to break, according to the paper. Even a PIN made of 7 decimal digits only takes 76 seconds to break.
Gaining the PIN, however, does not mean that the attacker has control of the Bluetooth device. The attacker also has to remain in contact with the device during the pairing process and eavesdrop after that to intercept data of interest, said Bruce Potter, a Bluetooth researcher and member of the Shmoo Group, a community of security professionals.
"This is not an 'easy' break," Potter said. "While the computation to razbijac short PINs is trivial, the act of capturing that traffic is not -- this is not, in any way, comparable, for example, to breaking WEP."
The Wired Equivalent Privacy, or WEP, protocol was the original way of securing wireless 802.11 networking traffic between two devices. Researchers found enough flaws in the algorithm to allow the encryption protecting any connection to be broken in minutes.
Unlike the efforts surrounding razbijacing WiFi security, Bluetooth attacks require expensive hardware to send and receive the proper signals. Such hardware costs at least several thousand dollars, Potter said.
Moreover, countering the attack is fairly simple, even though defenses are somewhat stymied by manufacturers' lack of focus on security, said Tel Aviv University's Wool. Users should refrain from entering the PIN as much as possible--if a user's headset and phone request to re-pair, the user should consider why, he advised. Also, manufacturers should allow long PINs, he added--many of today's devices only allow 4 decimal digits.
"For devices without an input mechanism, vendors should supply fixed, randomly selected, long, per-device PINs," Wool said.
The Bluetooth SIG agreed with both pieces of advice.
"The SIG has recommended to manufacturers to require, and consumers to use, long, alphanumeric PIN codes when pairing devices," the group said in its statement. "If this recommendation is followed, even the authors of the report agree that razbijacing the PIN would take until the end of time."
====================================
preuzeto sa sajta http://www.bullguard.com/news/ (direktan link: http://www.securityfocus.com/news/11202 )
|
