Bluetooth hack shakes mobile security

[Osiris]

Bluetooth hack shakes mobile security

Cryptographers have discovered a security flaw in implementations of Bluetooth which allows hackers to pair their devices with prospective victims. The approach creates a means for hackers to hijack Bluetooth-enabled devices. It's not all just theory either, unlike most cryptographic attacks.

The researchers - Yaniv Shaked and Avishai Wool of Tel Aviv University in Israel - have come up with an exploit which allows hackers to pair with devices without alerting their owner. The approach gets around limitations of a security attack first described by Ollie Whitehouse of security firm @Stake last year. This earlier method meant an attacker needed to eavesdrop the initial connection process (pairing) between two Bluetooth devices, which only occurs infrequently.

Shaked and Wool have worked out a way to force this pairing process by masquerading as a device, already paired with a target, that has supposedly forgotten a link key used to secure communications. This initiates a fresh pairing session which a hacker can exploit to snaffle the link key and thereby establish a pairing without needed to know PIN details. Once a connection is set up, an attacker could make eavesdrop on data transmitted between a target devices and a PC or (at least potentially) take control of someone's Bluetooth device. "Once an attacker has forced two devices to pair, they can work out the link key in just 0.06 seconds on a Pentium IV-enabled computer."

[Knowledge]

Even though you can pair, I still dont think that you can browse a computer's system....

[Z�]

I agree. Although with Sony Ericsson models, it is possible to browse through the media of another device, the Gallery so to speak. However, I have not heard of such activity on computer workstations...