Wireless Security.pdf - PDF Archive

610 Chapter 23
It should suffice for our discussion to say that there are no known serious attacks on the
protocol itself, but various implementations may be vulnerable to a few attacks, referred
to as “ bluejacking, ” “ bluebugging, ” and “ bluesnarfing. ” 9 All of these attacks relate to
the ability of an attacker to connect to a Bluetooth device (in most instances a mobile
phone with Bluetooth) without the knowledge of the device user. The bluejacking attack
simply involves the sending of an unwanted message to the device user, which could be
used to trick the user into providing sensitive information to the attacker (phishing). The
other attacks involve the ability of an attacker to access the contents of a device, either
being able to execute commands (bluebugging) or to download data from the device
(bluesnarfing). In any case, these attacks require the attacker to be in close proximity
(within a few meters) unless they have the equipment to boost the Bluetooth protocol’s
range. Apparently these issues have been addressed in newer implementations of the
protocol but as always, it is a good idea to keep up with current developments, as a
devastating attack can always be right around the corner.
Bluetooth provides a decent midrange protocol for embedded systems that need a
moderate level of throughput, but it is a complex protocol (the specification is well
over 1200 pages long), and the cost of a dedicated controller unit may be prohibitive
depending on the application. In the next section, we will look at a relative newcomer to
the wireless arena, the ZigBee protocol. Designed around the IEEE 802.15.4
low-power radio standard, ZigBee aims to be the go-to standard for industrial wireless
communication where throughput is less of an issue, and flexibility, power consumption,
and cost are primary concerns.
23.3 ZigBee
At the low end of the power-requirement spectrum for wireless devices, ZigBee 10 is the
equivalent of a dripping faucet when compared to the garden hose of Bluetooth or the fire
hose of 802.11 (in the case of 802.11g, a water cannon used for putting out aircraft fires),
as seen in Figure 23.3 . ZigBee is a relatively new standard developed and maintained by
9
Terms and definitions for Bluetooth attacks adapted from the Bluetooth SIG overview of
Bluetooth security ( http://www.bluetooth.com/Bluetooth/Learn/Security/ )
10
Parts of the description of ZigBee in the section are adapted from the ZigBee Alliance ZigBee
FAQ at www.zigbee.org .
www.newnespress.com