June 11, 2020 |Kim Crawley
This blog was written by an independent guest blogger.
What would we do without Bluetooth these days? Our earbuds and headphones would have to use annoying wires. We would have one less way to transfer files between your laptop and your phone. And how would you connect your phone to your car?
But as a wireless data transfer standard, of course Bluetooth has some associated cybersecurity risks. You don’t want unauthorized parties to access the data you’re transferring via Bluetooth, nor do you want them to have access to your Bluetooth-enabled devices. It helps to know what the security risks with Bluetooth are so you can enjoy all of the convenience of the widespread wireless technology while mitigating its risks.
The most common types of Bluetooth attacks
BlueSmacking
BlueSmacking is a way to execute a Denial of Service attack against a Bluetooth-enabled device. What’s a Denial of Service attack, you might ask? It’s when a target such as a server or device gets way more data packets or oversized data packets than it’s designed to handle. The target gets overwhelmed, so it shuts down. Thankfully Denial of Service attacks are relatively minor as far as cyber attacks in general are concerned. You can usually recover from one by rebooting the targeted device. But through the distraction or inconvenience of a Denial of Service attack, attackers are able to conduct more destructive cyber attacks. So Denial of Service attacks shouldn’t be underestimated.
To get technical, a BlueSmack attack uses the L2CAP layer of Bluetooth’s networking stack to send a really oversized data packet. I couldn’t finish a large pizza in one sitting, and if I tried to force myself to I’d probably “shutdown” with a stomach ache on my couch. BlueSmack and Bluetooth is a similar concept.
BlueJacking
BlueJacking sounds like Bluetooth plus hijacking for a reason. BlueJacking is when one Bluetooth device hijacks another with spam advertising. Bluetooth usually has a broadcasting range of ten meters or about thirty feet. So your BlueJacking attacker would probably be in the same room as you. Or perhaps an attacker could leave a BlueJacking device on the street and target your phone while you walk past it. Like BlueSmacking, this attack is more of an annoyance than anything else. But phone messages can be a means of phishing attacks. Phishing is when an attacker pretends to be a trusted entity like your bank, phone company, or Amazon to entice the victim into clicking on a link or entering their sensitive information. A message sent by BlueJacking could contain a hyperlink to a website that has malware, or a website that grabs sensitive information from its victim.
BlueSnarfing
You probably notice a trend in the naming of these Bluetooth security risks. They’re all Bluetooth-specific exploits with the word Blue in their names. That helps make everything easy to understand. So what is BlueSnarfing? It’s similar to BlueJacking in some ways, but much more dangerous. You see, a BlueJacking attack just sends data, whereas a BlueSnarfing attack can take data. Data that is dangerous in the hands of cyber attackers, such as your text messages, emails, photos, and the unique identifying information that your phone or laptop uses with your cellular provider or ISP. An attacker could receive enough information about your phone or laptop to conduct more harmful cyber attacks.
BlueBugging
BlueBugging is an exploit that was developed after it was seen how easy BlueJacking and BlueSnarfing can be to conduct. BlueBugging uses Bluetooth to establish a backdoor on a victim’s phone or laptop. Backdoors are very dangerous because they can give a malicious outsider inside access to your device and sensitive information. Basically they can use the backdoor to spy on your activity. They may even be able to pretend to be you on social media or your online banking!
Mobile Protection for Employees
Provides real time visibility into mobile risk on employee devices and integrates with leading Unified Endpoint Management (UEM) solutions.
Learn more
4 Bluetooth security tips
Fortunately there’s a lot you can do with your phone or laptop to mitigate these common and worrisome Bluetooth security risks.
- First of all, you should always know where your device is physically. This is of course easier with a laptop than it is with your phone. You may want to set up a “find my device” service on your phone through a trustworthy entity like Apple or Google so you have a way of using their technologies to find and remotely lock your phone if you lose it.
- Avoid using Bluetooth to communicate sensitive information like passwords and such. If you must use Bluetooth to transfer your income tax forms from your phone to your PC or whatever, at the very least you should encrypt your files first.
- Only leave your Bluetooth in “discoverable” mode when you’re pairing a new peripheral with your phone or laptop. When you always use the same earbuds or whichever peripheral, you don’t need to have discoverable mode on because your device will already know the peripheral’s unique identifying code.
- And overall, you should turn Bluetooth off when you’re not using it. I do the same with WiFi for similar reasons. Not only will you close a possible cyber attack vector, you’ll also save battery power on your phone!
