Bluetooth security 'crisis' looming

Class 1 standard easy for hackers to exploit, says security firm

Robert Jaques

Security experts have warned of the need to take care as new Bluetooth devices with a transmission range of up to 100 metres arrive.

Security consultant @stake believes that devices conforming to the latest Bluetooth standard represent a potential crisis similar to the introduction of wireless local area networks based on the 802.11b Wi-Fi standard.

Advertisement

The firm expects that Class 1 Bluetooth will appear on everything from laptops to mobile phones, allowing hackers to gain access to sensitive information.

Ollie Whitehouse, director of security architecture at @stake, said in a statement: "With this class of device, wireless transmission of information leaves the office environment and travels anywhere an employee does.

"This means that third parties can access information without penetrating the physical security of an office or dealing with the problems of circumventing existing network security.

"The onus really is on vendors to ensure that all devices are optimised for security before they are put in the hands of customers."

In a recent white paper, @stake warned that even non-discoverable devices still respond to direct name and service enquiries and are therefore open to detection and attack.

Other common problems identified include Windows 2000 hosts configured to connect to all Bluetooth devices, and Windows registries that retain details of all devices to which they have been connected.

Another potentially serious problem centres on mobile phones that retain pairing information details when Sim cards are swapped.

This means that a third party that has access to a phone for even a few minutes can place a bond on it and use it as a platform for future attacks.

"The very real risks of Bluetooth will only multiply as adoption increases and the drivers vary from their default configurations," said Whitehouse.

"Many vendors release Bluetooth products with a best effort approach to security that can only compromise the integrity of the information held on those devices.

"Vendors should understand these issues and risks and develop mechanisms for delivering security out of the box. While it is not a time to panic, it is certainly a time to act."

  • Have your say
  • Send to a friend
  • Print
  • Digg
  • Reddit
  • Share

Tags:

Do you agree?

Further reading

No wireless at Westminster, MPs told

Threat of 'bluesnarfing' attacks prompts wireless ban until security can be guaranteed

Wireless gaming set for mass market

Lara Croft in hot phone action

2004 is crunch time for wireless data

Content and apps developers face make or break year, warns analyst

Happy new year in store for wireless

Developers set to cash in on expanded market, predicts analyst

Related whitepapers

Related jobs

Most watched

Summit: Views From the Valley

V3.co.uk's US office weighs in on the information overload crisis

John Chambers speaks on collaboration

Cisco boss talks up new offerings

Analysis and Reports

Remote access - Three steps to getting connected

3.4 million UK professionals now work from home – is your company equipped?

Cost benefits of a global collaboration network

This white paper is a must read for organisations looking for evidence of the bottom-line benefits of high-definition video and voice communications

Poll

Impact of Information Overload poll

Impact of Information Overload poll

What is the biggest problem your firm faces as a result of the data explosion?

View poll results

Advertisement

White paper library

Keep up to date with the latest products, services and technologies from the world's leading IT companies; IThound.com brings you over 6,000 white papers, case studies and analyst reports.

Advertisement

Newsletter signup

Sign up for our range of FREE newsletters:

Existing User

Newsletter user login:

Enter email address to edit your newsletter preferences

Job of the week

Search thousands of IT jobs :

Search thousands of IT jobs:

Advanced search

Hiring now on ComputingCareers:

Related IT jobs

Search thousands of IT jobs :

Search thousands of IT jobs:

Advanced search

Advertisement

Spotlight

deloitte

Summit interview: Deloitte discusses security implications of the data deluge

We chat to Mike Maddison, UK head of Security, Privacy...

ibm logo

IBM boosts mobile shopping with WebSphere Commerce

Update designed to give mobile users a richer, more personalised...

Summit: Intel discusses processors for data overload (part 2 of 2)

More thoughts on how servers can help manage overload

chrome logo

Google plans a Mac version of Chrome

A Mac-friendly version of the browser is in the pipeline

Primary Navigation