2KKUU7ita

You undoubtedly have various Bluetoothenabled
wireless devices, such as laptops and
smartphones, running within your organization.
Although vulnerabilities are not as prevalent as
they are in 802.11-based Wi-Fi networks, they
still exist (currently, over 60 Bluetooth-related
weaknesses are listed at http://nvd.
nist.gov), and quite a few hacking tools take
advantage of them. You can even overcome the
personal area network distance limitation of
Bluetooth’s signal (typically just a few meters)
and attack Bluetooth devices remotely by building
and using a BlueSniper rifle. (See the following
list for the website.) Various resources
and tools for testing Bluetooth authentication/
pairing and data transfer weaknesses include
✓ Blooover (http://trifinite.org/
trifinite_stuff_blooover.
html)
Don’t overlook Bluetooth
Encrypted traffic
Chapter 9: Wireless LANs
✓ BlueScanner (http://sourceforge.
net/projects/bluescanner)
✓ Bluesnarfer (www.alighieri.org/
tools/bluesnarfer.tar.gz)
✓ BlueSniper rifle (www.tomsguide.
com/us/how-to-bluesniperpt1,review-408.html)
✓ Car Whisperer (http://trifinite.
org/trifinite_stuff_car
whisperer.html)
✓ Detailed presentation on the various
Bluetooth attacks (http://trifinite.
org/Downloads/21c3_Bluetooth_
Hacking.pdf)
Wireless traffic can be captured directly out of the airwaves, making this
communications medium susceptible to eavesdropping. Unless the traffic
is encrypted, it’s sent and received in cleartext just as on a standard wired
network. On top of that, the 802.11 encryption protocols, Wired Equivalent
Privacy (WEP) and Wi-Fi Protected Access (WPA), have their own weakness
that allows attackers to crack the encryption keys and decrypt the captured
traffic. This vulnerability has really helped put WLANs on the map — so to
speak.
WEP, in a certain sense, actually lives up to its name: It provides privacy
equivalent to that of a wired network, and then some. However, it wasn’t
intended to be cracked so easily. WEP uses a fairly strong symmetric (sharedkey)
encryption algorithm called RC4. Hackers can observe encrypted
wireless traffic and recover the WEP key because of a flaw in how the RC4
initialization vector (IV) is implemented in the protocol. This weakness is
because the IV is only 24 bits long, which causes it to repeat every 16.7 million
packets — even sooner in many cases, based on the number of wireless
clients entering and leaving the network.
165