Bluetooth Connectivity Threatens Your Security

Everyone loves the hands-free convenience that Bluetooth enables — some people love it a little too much and insist on wearing their Bluetooth ear pieces every waking hour like they’re action heroes perpetually on the cusp of the next great adventure.

But that’s not the only ugliness of Bluetooth, which has been vulnerable to security exploitations since its inception. The earliest form of this was the Cabir worm, which is believed to have been the first wireless worm. It could transmit itself to mobile phones using the Symbian platform when those devices were turned on and in discoverable mode. While it wasn’t very harmful — it sent a message with the caribe.ss file attached; when downloaded the file displayed the word “Caribe” on the handset screen — it served as a wakeup call to the industry.

Bluetooth threats have evolved since those days, and while they aren’t extremely dangerous they can still be quite serious.

Bluejacking is basically Bluetooth spam. Bluetooth users can send what is essentially an e-business card to other Bluetooth users within a 30-foot radius of their device; if downloaded that e-card can add the contact to the now-infected user’s address book. That contact then can send messages to this infected device. And some Bluejackers make the spam delivery even more simple, putting the spam directly into the Blutooth device name so when the recipient receives a message that a new device tried to connect, the requesting device is identified by the smap message — ” ‘30% Off Name-Brand Prescriptions’ is trying to connect to your device,” for instance. Such attacks can be increased to a 300-plus-foot radius if the attacker is using a directional antenna and amplifier.

The Car Whisperer is software that lets attackers send audio to, and receive audio from, a Bluetooth-enabled car stereo. This means that these attackers can listen to your calls and chime in, if they want to.

Bluebugging, is a bit more dangerous than the first two, allowing attackers to remotely access a user’s phone and use its features, including listening to calls, forwarding incoming calls, placing calls and sending text messages — and the user doesn’t realize what’s happening. This can result in expensive phone bills if its used to make premium or international calls.

Bluetooth attacks depend on exploiting the permission request/grant process that is the backbone of Bluetooth connectivity. Regardless of the security features on your device, the only way to completely prevent attackers from exploiting that permission request/grant process is to power off your device’s Bluetooth function when you’re not using it — not putting it into an invisible or undetectable mode, but completely turning it off (there are bad apps that can power your device back on, just one more reason overall app security is vital).

There are lots of battery management apps out there that will do this for you automatically: Tasker and Juice Defender and the NFC-enabled Sony SmartTag are among those that can do this for Android devices. Battery Doctor, Battery Life Pro and Battery are three that can do it for iOS.