bugtraq - Bluetooth DoS by obex push

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <45B578E5.9080100@cs.washington.edu>
Date: Mon, 22 Jan 2007 18:54:29 -0800
From: Armin Hornung <hornung@...washington.edu>
To: bugtraq@...urityfocus.com
Subject: Bluetooth DoS by obex push

Hello,

during a course project studying security and privacy related to
Bluetooth, we discovered a simple but effective DoS attack using OBEX push.

Using ussp-push [1], it is possible to send out files very quickly. By
continuously trying to push a ﬁle, the target is ﬂooded with prompts
whether to accept the ﬁle or not, which disables any other usage on the
phone, including the ability to turn off Bluetooth.
We confirmed the attack to work on the following phones:

- Sony Ericsson K700i
- Nokia N70
- Motorola MOTORAZR V3
- Sony Ericsson W810i
- LG Chocolate KG800

and expect nearly all available phones with Bluetooth to be vulnerable
(in contrary to the previous DoS by l2ping).

A proof-of-concept code is attached (plain text), using ussp-push and
targeting a known MAC. This could be easily extended to target all
visible devices.
Plus, a user could be forced to accept a possibly malicious file with
this attack. Using only one Bluetooth-Dongle, we were able to
practically disable three phones simlutaneously.

Best regards,
Stefan Ekerfelt and Armin Hornung

[1] http://www.xmailserver.org/ussp-push.html

View attachment "obex_dos" of type "text/plain" (500 bytes)