A false sense of security

Bluetooth, like WiFi, is rapidly becoming a standard feature on portable computing equipment, such as laptops and mobile phones. It should come as no surprise then, that Bluetooth's security has come under intense scrutiny.

There has been a wide range of highly publicised, if often misunderstood, hacks against Bluetooth devices. A quick browse of trifinite.org's tool list at trifinite.org/trifinite_stuff.html gives a flavour of the range available "off the shelf", and an hour with Google will turn up a hefty collection of technical papers about various attacks.

To date, though, the attacks have largely concentrated on poor implementation choices by vendors rather than real problems with the Bluetooth standard itself. A common target is the pairing process, whereby a user creates a trusted link between two devices.

Often this is based on a fixed pin, especially for devices with no means of entering a custom one (for example, Bluetooth headsets for mobile phones). The RedFang tool from @Stake showed early on that it was feasible, for a patient attacker, to "brute force" round the pairing process but, due to the time involved, this is largely an academic attack unless your enemies are well-funded with lots of spare time.