Bluetooth global-technology 170

Bluetooth global-technology 170

• 1.
  Interested in learning more about security? SANS Institute InfoSec Reading Room This paper is from the SANS Institute Reading Room site. Reposting is not permitted without express written permission. Bluetooth: The Global Technology? The purpose of the paper is to familiarize you with the Bluetooth specification, its capabilities, and associated security concerns with regards to implementation. The security features inherent to Bluetooth are adequate for ad hoc networks, and data transfer of non-sensitive information. Additionally, the 10 cm transmission range of Bluetooth devices operating with a maximum output power of 1 mW provides adequate security for money transfers, and transmission of sensitive data. Information integrity problems will prim... Copyright SANS Institute Author Retains Full Rights AD
• 2.
  Bluetooth: The GlobalTechnology? Howard Johnson Version 2.1 April 24, 2002 ts. The purpose of the paper is to familiarize you with the Bluetooth specification, its igh capabilities, and associated security concerns with regards to implementation. ll r Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 Introduction fu As technology managers and technicians, we are constantly engaged in an ongoing ins struggle between functionality, usability, and security. To effectively balance our concerns, we must keep pace with changes in technology. The telecommunications and eta computing industries continue to create and market technologies designed to enhance mobility and functionality, both at home and at work. Any organization that desires to rr exploit opportunities must realize that greater mobility demands a global technology. Bluetooth provides mobility and will emerge as a scalable, economic global technology. ho ut Why Bluetooth? ,A Bluetooth will become the short-range wireless technology of choice because it provides 02 mobility, security and functionality in one small package. The small form factor of the 20 Bluetooth radio also provides a unique balance of component cost, physical range, bandwidth, and power consumption. The Bluetooth specification is much more than just te a cable replacement technology, because it is capable of wireless connections to a wide tu variety of portable electronic devices via one-to-one, and one-to-many device connections. Bluetooth enabled devices are also capable of simultaneous voice and data sti connections, as well as, ad hoc networking. All electronic devices that support In Bluetooth, or the closely aligned IEEE (The Institute of Electrical and Electronics Engineers, Inc.) 802.15.1 standard for Wireless Personal Area Networks (PAN), will NS have a 1.5-inch transceiver chip that uses the globally available, unlicensed, Industrial, SA Scientific, and Medical (ISM) Band ranging from 2.4 GHz to 2.485 GHz (gigahertz). Future development of Bluetooth promises greater functionality and interoperability with other Bluetooth devices, as well as enhanced data transfer capabilities with IEEE 802.11 © (Wireless Local Area Networks). What is Bluetooth? Key fingerprint open-source standard that borrows many features from existing wireless Bluetooth is an = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 standards such as IEEE 802.11, IrDA (Infrared Data Association), DECT (Digital Enhanced Cordless Telecommunications), Motorola’s Piano, and TCP/IP to connect portable devices without wires via short-range radio frequencies (RF). © SANS Institute 2002, As part of the Information Security Reading Room. Author retains full rights.
• 3.
  In doing so,Bluetooth inherits the following capabilities: • Use of the ISM Band • Frequency-hopping Spread Spectrum (FHSS) • Authentication • Privacy • Power Management • LAN Capabilities • Object Exchange Capabilities ts. • Voice Data Transmission Capabilities igh • Ad hoc Networking Key•fingerprintand Packet Switching ll r Circuit = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 fu In order to accomplish this, developers purposely chose the free, worldwide available, ISM Band. Bluetooth utilizes an unlicensed portion of the RF spectrum beginning at ins 2.4GHz, therein providing a globally available communications channel free to all electronic devices, ranging from cellular phones to consumer electronics that support the eta Bluetooth specification. Bluetooth promises to allow both stationary and mobile rr electronic devices to communicate, with minimal user interaction, due to its “always on” state. ho ut In order to seamlessly interconnect devices, each and every electronic device will require a Bluetooth chip. Try to imagine every electronic device you now posses enabled by ,A Bluetooth Technology. Now imagine effortless connectivity between your computer, 02 stereo, car, cell phone, and home environmental controls. The economics of producing a wireless technology that promotes, mobility, functionality, security, and interoperability 20 is simply astounding. Bluetooth technology, and its potential, is virtually limitless. Bluetooth will commence a new era of human-machine interaction. te tu Background sti In In 1994, Ericsson, a Swedish Telecommunications Firm, began research on cable-less connections in order to integrate their cellular phones with Internet enabled devices via NS RF. Originally designed by two Ericsson Telephone employees, Sven Mattison (Swedish) and Jaap Haartsen (Dutch), their research produced a small, cheap radio chip SA that could be placed in almost any electronic device. Since its initial development, over 2,000 companies worldwide have signed on as members of the Bluetooth Special Interest © Group (SIG). The SIG is an industry group that consists of leaders from the telecommunications and computing industries that are driving the development of the wireless specification. Furthermore, the SIG is also responsible for promoting the technology in the marketplace. The potential of Bluetooth technology has attracted unprecedented interest and financial 998D FDB5 DE3D F8B5 from the Key fingerprint = AF19 FA27 2F94 investment by companies 06E4 A169 4E46 telecommunications, computing, networking, consumer, automotive, military, industrial, semiconductor and other industries. © SANS Institute 2002, As part of the Information Security Reading Room. Author retains full rights.
• 4.
  There are threecategories of involvement with the Bluetooth SIG: Promoter, Associate, and Early Adoptor. The top-level group is the Promoter group. It consists of companies responsible for the developing and marketing the Bluetooth technology. Current members are: Bluetooth Promoter Group Founding Members Additional Members ts. • Ericsson • 3Com igh • Nokia • Lucent • IBM • Microsoft ll r • FA27 2F94 998D FDB5 Motorola Key fingerprint = AF19 Intel • DE3D F8B5 06E4 A169 4E46 • Toshiba fu ins Membership within this group is exclusive and there are no plans to expand the membership. eta At the mid-level is the Associate group. Associate members can be any company that has rr signed the Early Adoptor 1.1 contract and the Associate Member Amendment. There is a membership fee associated with this level based on the annual revenue of the applying ho company. ut ,A The bottom-level group is the Early Adoptor group. Early Adoptor members can be any company that has signed the Early Adoptor 1.0 contract. There is no fee for this level of 02 membership. Additionally, there are also working groups, expert groups, and marketing 20 subgroups. te In order to appreciate the financial commitment to the development and marketing of the tu Bluetooth standard, HomeRF (specification for wireless digital communications between PCs and consumer electronics), a competing wireless standard, currently has less than sti eighty member companies. No other wireless standard has the support and commitment In given to Bluetooth. An up-to-date list of the Bluetooth SIG membership can be found at www.bluetooth.com/sig/memberlist/memberlist.asp. NS SA Bluetooth Components Any electronic device incorporating Bluetooth technology will consists of four major © components: • Radio Unit Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 • Baseband Unit • Software Stack • Application Software Bluetooth Module © SANS Institute 2002, As part of the Information Security Reading Room. Author retains full rights.
• 5.
  B luetooth ProtocolStack vCard/vCal WAE TCS BIN SDP OBEX WAP AT Comm ands UDP TCP IP PPP RFCOMM AUDIO ts. L2CAP igh H ost Co ntroller Interface LMP ll r BASEBAND Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 BLUETOOTH RAD IO fu L egend : ins • Bluetooth Core Protocol s • Cable Replacement Protocol eta • Telephony Control Protocols • Ado pted Protocols • Radio Unit rr ho Radio Unit ut The radio unit is a transceiver that facilitates the wireless link between Bluetooth enabled ,A devices operating in the ISM Band. Although the ISM Band does not require an 02 operator’s license from any regulatory agency, there are international regulations that limit power output. By limiting power output and using frequency-hopping spread- 20 spectrum, Bluetooth is able to co-exist with other technologies that operate in the ISM Band like microwave ovens, Wireless LAN (IEEE 802.11a, b, and g), cordless phones, te baby monitors, and HomeRF. Bluetooth is designed to operate in noisy RF tu environments. To accomplish this, Bluetooth radios use fast acknowledgement and sti frequency-hopping after each packet is transmitted and received to minimize interference In from competing signals. The Federal Communications Commission (FCC) mandates that FHSS systems spend no more than 0.4 seconds on any single channel every 30 seconds in NS the 2.4 GHz ISM band. These same systems are also required to hop through at least 75 channels in order to reduce the likelihood of packet collisions. The Bluetooth SIG has SA taken the FCC mandate, along with the operation output power limit of 100mW, and pushed its standard to accommodate an US/European standard that hops through 79 © channels displaced by 1MHz, with a maximum frequency-hopping rate of 1600 hops/s. In France and Spain however, regulations limit the number of hops to 23 channels, which limits the range of available frequencies. In order to limit the number of frequency hops available to the Bluetooth transceiver, an internal software switch is used. Bluetooth also supports three power classes that provide varyingDE3D F8B5 06E4 A169 4E46 When Key fingerprint = AF19 FA27 2F94 998D FDB5 distances of link establishment. the maximum output power of 100mw (milliwatts) is employed, Bluetooth enabled devices can communicate at ranges up to approximately 100 meters. © SANS Institute 2002, As part of the Information Security Reading Room. Author retains full rights.
• 6.
  The charts providedbelow show the interrelationships between the Bluetooth specification, transmitter characteristics, and ISM band usage. Radio Bands and Channels Country Frequency Range RF Channels USA/Europe 2.4000 – 2.4835 GHz 79 Japan 2.4710 – 2.4970 GHz 23 ts. Spain 2.4450 – 2.4750 GHz 23 igh France 2.4465 – 2.4853 GHz 23 ll r Key fingerprint = AF19 FA27TransmitterFDB5 DE3D F8B5 06E4 A169 4E46 2F94 998D Characteristics fu Power Class Maximum Output Power Distance ins 1 100 mW (20 dBm) ~ 100.0 m eta 2 2.5 mW ( 4 dBm) ~ 10.0 m 3 1 mW ( 0 dBm) rr ~ 0.1 m mm cm ho Transceiver Specifications ut • 1600 hops per second ,A • 79 (or 23) channels displaced by 1 MHz • 220 micro-second Time Division Duplex (TDD) guard time 02 • Covers entire 2.4 GHz ISM Band 20 • Transmit power ranges from –30 to +20 dBm • Modulation scheme – GFSK (Gaussian Frequency Shift Keying) te • Receiver sensitivity – -70 dBm tu • Circuit and Packet Switching sti In Baseband Unit NS SA The Baseband unit, also called the Link Control Unit, is the physical hardware that facilitates the RF link among Bluetooth devices. To better understand this, think of the Baseband Unit as a virtual serial cable physically connecting two devices. Once © connected, there are two types of links associated with the Baseband packets: Synchronous Connection-Oriented (SCO) and Asynchronous Connectionless (ACL). An SCO link provides circuit-switched, point-to-point connections, usually for voice, data, and streaming content. SCO links are symmetrical. The maximum data rate for both Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 sending and receiving is 433.9 Kbps. Conversely, an ACL link provides packet- switched, point-to-multipoint connections, usually for data. ACL links are asymmetrical. The maximum data rate for receiving is 723.2 Kbps, while sending is limited to 57.6 Kbps. Bluetooth enabled devices can support three types of connections: © SANS Institute 2002, As part of the Information Security Reading Room. Author retains full rights.
• 7.
  • One ACL Channel • Three simultaneous SCO Channels • One simultaneous ACL and SCO Channel This virtual RS-232 cable consists of at least one antenna and one RF transceiver bundled with the low-level radio controller software. The Baseband module consists of flash memory and a central processing unit that is responsible for controlling timing, frequency hopping, data encryption, and error correction functions in conjunction with the Link Manager Protocol (LMP). LMP, one of the core Bluetooth protocols, is responsible for ts. control and setup of data and audio links between Bluetooth devices. LMP is also igh responsible for the control and negotiation of the Baseband packet size. As depicted in the diagram, the Bluetooth Radio, the Baseband controller, and the Link Manager ll r Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5or the Host Controller Protocol are normally referred to as the Bluetooth Hardware 06E4 A169 4E46 Interface. The Host Controller Interface provides all required functionality for fu establishing and maintaining all communications links. ins Now that you are familiar with the Bluetooth protocol and its technical specifications, eta let’s explore some of the capabilities this technology will provide. rr Wireless electronic devices promise greater freedom at home and in the office. They ho promise the freedom of greater mobility, information exchange, synchronization of applications, and effortless networking. The functionality of Bluetooth will enable ut humans to make more efficient use of space when using electronic equipment because ,A unsightly, cumbersome cables will no longer be required. 02 The Bluetooth wireless system supports point-to-point and point-to-multi-point 20 connections. An ad hoc Bluetooth scatternet may be established by linking several piconets together. A piconet is defined as a group of devices consisting of at least one te master and one slave unit which all share the same frequency-hopping sequence. A tu scatternet is a collection of interlinked piconets with each piconet maintaining its unique sti frequency-hopping sequence. A Bluetooth device may link two piconets by being a slave in two different piconets. Additionally, it may be a slave in one piconet while being a In master in another. At present, a device may not participate in more than two piconets at NS the same time. The current specification also limits the number of piconets within a scatternet to 10 piconets. Within a scatternet of 10 fully loaded piconets, a full-duplex SA data rate of more than 6 Mb/s is possible. © Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 © SANS Institute 2002, As part of the Information Security Reading Room. Author retains full rights.
• 8.
  Bluetooth Ad HocNetworking Bluetooth enabled devices promise ad hoc networking. Ad hoc networking is the capability to quickly establish and dissolve small groups of devices with little user interaction, and no requirements for permanent address assignment among connecting devices. When two Bluetooth ts. enabled devices come within range of one another, one device becomes the Master igh and the other, a slave. The Master device establishes synchronization among all slaveFDB5 DE3D F8B5 06E4 A169 4E46 ll r Key fingerprint = AF19 FA27 2F94 998D devices by using its clock and hopping sequence. fu Once connected, the devices form a Piconet. A Piconet can have a total of eight devices, one ins master and seven active slaves. A Piconet can also include as many as 255 parked slaves, which are eta devices synchronized with the Piconet but not actively sending or receiving any signals. rr ho When two or more independent and non- synchronized Piconets communicate with one ut another, they form a Scatternet. In order to ,A facilitate communications between the separate Piconets, a single device being either a master or 02 slave, must become a slave in the other Piconet. 20 Once this is accomplished, the shared device will relay all communications between Piconets as te required. tu sti In an ad hoc network, there is no fixed infrastructure. The network is established on the In fly, via wireless links. Individual devices act as routers when relaying data from one device to other when the two devices are too far from one another for direct NS communications. Since ad hoc networks are mobile and constantly changing in topology, ad hoc networking presents intriguing security challenges. SA Bluetooth Security © Bluetooth supports several security features depending on the application, and user requirements. These features range from the protection against eavesdropping, inherent to the frequency-hopping spread-spectrum technology, to the use of keys or Personal Identification Number (PIN), and password combinations. With the A169 4E46 Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 use of PINs (alphanumeric strings of up to 16 characters), the 128-bit SAFER+ encryption algorithm is used to create very strong security and encryption between devices. If required, additional security can be added in the application software. © SANS Institute 2002, As part of the Information Security Reading Room. Author retains full rights.
• 9.
  The Bluetooth specificationdefines three security modes: • Non-secure • Service-level Security • Link level Security. In non-secure mode, a Bluetooth device does not initiate any kind of security procedures. In the service-level security mode, security policies are allowed, based upon the access ts. requirements of the application in use. This is especially useful when running several igh applications that require different security modes. ll r Key fingerprint =level security 2F94 998D FDB5 DE3D F8B5 06E4up security When using link AF19 FA27 mode, Bluetooth enabled devices set A169 4E46 procedures before the link set-up is completed. Link level security requires that fu applications know who is at the other end of the link, in order to, provide authentication, ins authorization, and encryption services. Information integrity is vital to Bluetooth’s future. As a result, developers have incorporated random number generation, encryption, eta encryption key management, and authentication. Authentication is an important element in any Bluetooth system that enables a user to develop a domain of trusted devices. Once rr established, authentication services allow the host controller interface to decide if a connection is to be formed based on the available identification at the hardware level. ho Upon link establishment, additional security may be applied to the data transmission ut using encryption. Encryption is applied to an existing connection, while authentication ,A procedures dictate whether or not a connection will ever be formed. The security mechanisms inherent into the Bluetooth specification are secure enough for most 02 applications. If not, stronger encryption schemes may be added to Bluetooth products at 20 the software application level. te Potential Health Concerns tu sti As wireless communications make there way into our homes and offices, more and more attention is being given to potential side effects of repeated exposure to microwave In frequencies. To date, scientific studies indicate that current output power is too weak to harm humans since the radiation is omni-directional. Another concern focuses on NS whether Bluetooth RF emissions heat the human body. Studies in this area indicate that SA the output power of Bluetooth devices is insufficient to cause any detectable temperature increase. As more wireless devices are deployed at home and in the office, studies regarding prolonged exposure to electromagnetic radiation should be conducted. At © present, some scientific studies indicate that certain individuals are more sensitive to prolonged exposure. Additionally, some people that claim that they can no longer be near such fields without considerable discomfort. Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 Conclusion The simplest way to understand Bluetooth is to think of it as the cables that are connected to your PC. Bluetooth technology is the physical RF link between your computer and © SANS Institute 2002, As part of the Information Security Reading Room. Author retains full rights.
• 10.
  your peripheral devices.It is the cable that connects your Palm Pilot to your laptop. It is the cable that connects your MP3 player to your headphones. Bluetooth represents all the cables that are currently attached to your computer, and to your printer, keyboard, mouse and monitor. Bluetooth enables the user to effortlessly connect devices anywhere within its operational range. Once this technology grows in popularity, manufacturing costs of Bluetooth chips are projected to cost approximately five dollars per device. Market researchers predict that over one hundred million Bluetooth enabled devices will be operational by the end of 2002. Furthermore, by the year 2005, over 1.4 billion products are expected to be in use worldwide. If these numbers are even close to being accurate, it ts. appears that it will be difficult to purchase any item not equipped with Bluetooth igh technology. ll r The fingerprint = AF19 FA27 2F94 998D are adequate for ad hoc A169 4E46 Key security features inherent to BluetoothFDB5 DE3D F8B5 06E4networks, and data transfer of non-sensitive information. Additionally, the 10 cm transmission range of fu Bluetooth devices operating with a maximum output power of 1 mW provides adequate ins security for money transfers, and transmission of sensitive data. Information integrity problems will primarily result from users using the wrong maximum output power. eta Christina Bjorknader, marketing and communications manager for L.M. Ericsson rr Telephone, a major Bluetooth backer says, “You could have a pair of mufflers – the headphones over your ears – and be mowing the lawn outside, listening to your Walkman ho when your phone rings inside and automatically stops the music to tell you that there is a ut call which you can then take.” Her scenario continues: Depending on whether your PDA ,A has voice capabilities, you could even check your calendar while on the phone call and add an appointment or make a change. “Once you’re done with the call, you can tell the 02 headset to hang up the phone, which will simply restart the music from where you left off and you then finish mowing the lawn, all without taking your hands off the mower.”1 20 te References: tu 1. “Bluetooth” sti http://www.anywhereyougo.com/bluetooth/ (April 2002) In 2. “Palowireless Bluetooth Resource Center” NS http://www.palowireless.com/bluetooth/ (April, 2002) SA 3. Johnson Consulting “Bluetooth – An Overview” http://www.swedetrack.com/images/bluet00.htm (May 17, 2000) © 4. Vainio, Juha T. “Bluetooth Security” http://www.niksula.cs.hut.fi/~jiitv/bluesec.html#chap1 (May 25, 2000) 5. Saltzstein, William E. “Bluetooth: The Future of Wireless 06E4 A169 4E46 Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 Medical Technology?” http://www.devicelink.com/mddi/archive/02/02/001.html (February, 2002) 1 Rohde © SANS Institute 2002, As part of the Information Security Reading Room. Author retains full rights.
• 11.
  6. “Bluetooth” http://www.ericsson.com/technology/Bluetooth.shtml (January 24, 2002) 7. “Bluetooth: The Official Website” http://www.bluetooth.com/ (April, 2002) 8. Kardach, James. “Bluetooth* Architecture Overview” http://www.intel.com/technology/itj/q22000/articles/art_1.htm (April, 2000) ts. igh 9. Rohde, Laura. “Analysis: Can Bluetooth live up to the hype?” http://www.cnn.com/2000/TECH/computing/07/12/bluetooth.idg/ (July 12, 2000) ll r Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 fu ins eta rr ho ut ,A 02 20 te tu sti In NS SA © Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 © SANS Institute 2002, As part of the Information Security Reading Room. Author retains full rights.
• 12.
  Last Updated: February6th, 2012 Upcoming SANS Training Click Here for a full list of all Upcoming SANS Events by Location SANS Secure India 2012 Bangalore, India Feb 20, 2012 - Feb 25, 2012 Live Event RSA Conference 2012 San Francisco, CA Feb 26, 2012 - Feb 27, 2012 Live Event SANS Germany 2012 Stuttgart, Germany Mar 05, 2012 - Mar 10, 2012 Live Event SANS Secure Singapore 2012 Singapore, Singapore Mar 05, 2012 - Mar 17, 2012 Live Event BETA SEC528 SANS Training Program for the New CompTIA Boston, MA Mar 12, 2012 - Mar 17, 2012 Live Event Advanced Security Practitioner Certification Mobile Device Security Summit Nashville, TN Mar 12, 2012 - Mar 15, 2012 Live Event SANS 2012 Orlando, FL Mar 23, 2012 - Mar 30, 2012 Live Event SANS Abu Dhabi 2012 Abu Dhabi, United Arab Mar 31, 2012 - Apr 05, 2012 Live Event Emirates SANS Northern Virginia 2012 Reston, VA Apr 15, 2012 - Apr 20, 2012 Live Event SANS Cyber Guardian 2012 Baltimore, MD Apr 30, 2012 - May 07, 2012 Live Event SANS Phoenix 2012 OnlineAZ Feb 13, 2012 - Feb 18, 2012 Live Event SANS OnDemand Books & MP3s Only Anytime Self Paced