full-disclosure - Bluetooth: Theft of Link Keys for Fun and Profit?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1926756402.20050812191305@Sniff-em.com>
Date: Fri Aug 12 18:13:19 2005
From: Thierry at sniff-em.com (Thierry Zoller)
Subject: Bluetooth: Theft of Link Keys for Fun and
	Profit?

Dear MaMF,

AL> Excuse me? You are skipping over the only important bit of your 
AL> "disclosure"! Since getting the key is the only remotely difficult part,
AL> you need to address that or you've got nothing of interest...
Actually he does have something of interest, at least for me. Not
everybody on this least is as deep in the subject as you, additionaly
he has a tendancy to _fully_ disclose what he finds.

AL> Obviously
AL> if you can spoof the BD_ADDR and already have the link key you can
AL> connect because those are the only two things that make your device
AL> unique. This is like saying "If you make a copy of my house key you can
AL> open my door!". Not really big news.
Don't forget he grabs the house key from the air, a few hundred meters
away. The analogy goes bust.

AL> Tools? Apart from a $10,000 sniffer?
Oohh, 1600$ actually, you just need to know where to get them,
hint Google is of great help.

Regards,
Thierry Zoller