BLUETOOTH SECURITY

1
BLUETOOTH SECURITY
VS

• What is Bluetooth/Background?
• Technical Specifications
• Bluetooth Usage
• Security Concerns in Ad Hoc Networks
• Bluetooth Advantages
• What Bluetooth Security Offers?
• Problems Associated w/Bluetooth
• Conclusion

Presented by Jim Burley
2
What is Bluetooth

• A cable-replacement technology that can be used
  to connect almost any device to any other device
• Radio interface enabling electronic devices to
• communicate wirelessly via short range (10
• meters) ad-hoc radio connections
• A standard for a small, low cost ( 5), low
• power, radio based chip to be plugged into
• computers, printers, keyboards, monitors,
  mobile
• phones, refrigerators??, PDAs, etc

3
Background

• It was developed by a group call Bluetooth
  Special Interest Group (SIG)
• formed in May 1998
• Founding members were Ericsson, Nokia, Intel,
  IBM and Toshiba
• Since then, almost all of the big companies in
  telecom business (e.g.
• 3Com, Microsoft, Motorola) have joined the
  SIG and the number of
• participating companies is now over 1500

4
Technical Specifications
Bluetooth devices are categorized into 3
different classes by the power they use gt
Class 3 device has a 1 mW transmission power and
a range of .1-10 meters gt Class 2 device has
a transmission power of 1-2.5 mW and a 10 meter
range gt Class 1 device has transmission
power of 100 mW and a range up to 100 meters
                                               
                                                  
                                        
Architecture of Bluetooth is formed by the radio,
the base frequency part and The Link Manager gt
Bluetooth uses the radio range of 2.45 GHz, Max
bandwidth is roughly 1 MB/s
5
Bluetooth Usage

• Several Bluetooth devices can form an ad
• hoc network called a piconet
• In a piconet one device acts as a master (sets
• frequency hopping behavior) and the others as
  slaves
• Example A conference room with many
• laptops wishing to communicate with each
• other

6
Security Concerns of Ad HocNetworks

• Must consider standard ad hoc network issues
• Availability
• DOS attacks easy to perform (info trans by air)
• Routing protocol attacks (changing topology
• and attacks)
• Battery Exhaustion attacks (devices have
• energy conservation schemes)
• Authorization Key Management
• Confidentiality Integrity
• Anyone can sniff messages from the air
• Radio Interference

7
Bluetooth Advantages

• Designed for quick, seamless short range networks
• Features low power consumption, small protocol
  stack,
• robust data voice transfer
• Cheap price
• Good choice for WPAN (Wireless Personal Area
  Networks)

8
What Bluetooth Security Offers?

• Every bluetooth device has 4 entities for
  maintaining
• security
• 1 - Bluetooth device address 48-bit address that
  is unique for each Bluetooth device and defined
  by IEEE
• 2 - Private authentication key 128-bit random
  number used for authentication purposes
• 3 - Private encryption key 8-128 bits in length
  that is used for encryption
• 4 - Random number frequently changing 128-bit
  random or pseudo-random number that is made by
  the Bluetooth device itself

9
Bluetooth Security (Cont)

• In Bluetooth Generic Access Profile, security is
• divided into 3 modes
• non-secure
• service level enforced security
• link level enforced security
• Device initiates security procedures before the
  channel is established
• Device security modes
• Trusted or untrusted
• Service security modes
• Authorization and Authentication
• Authentication only
• Open to all

10
Problems Associated w/Bluetooth

• Use of PIN code in the initialization process
• of two devices (enter PIN code twice every
  time you connect to two devices)
• Ad hoc network every machine is initialized
• separately (can be cumbersome)
• Unit key scheme, authentication and encryption
• based on assumption that link key is the
  participants shared secret

11
Conclusion

• Bluetooth security seem to be adequate only for
  small ad
• hoc networks, ex participants in a meeting.
  Connecting a
• PDA to a mobile phone using Bluetooth seem secure
  
• enough, but may not be secure enough for money
• transfers or transferring of other sensitive
  information. It
• seems security of Bluetooth only considered the
  simple
• issues and the more functional has to be built
  above it.