Two practical man-in-the-middle attacks on Bluetooth secure simple pairing and countermeasures

IEEE Transactions on Wireless Communications

Volumn 9, Issue 1, 2010, Pages 384-392

  Haataja, Keijo ^a   Toivanen, Pekka ^a  

^a UNIVERSITY OF EASTERN FINLAND   (Finland)

Author keywords

Bluetooth; Man in the middle attack; Out ofband channel; Secure simple pairing; Wireless security

Indexed keywords

COMPARATIVE ANALYSIS; INPUT/OUTPUT; MAN IN THE MIDDLE ATTACKS; SECURE SIMPLE PAIRING; WIRELESS SECURITY;

BLUETOOTH; WIRELESS NETWORKS; WIRELESS TELECOMMUNICATION SYSTEMS;

NETWORK SECURITY;

EID: 74549219772     PISSN: 15361276     EISSN: None     Source Type: Journal    
DOI: 10.1109/TWC.2010.01.090935     Document Type: Article

References (27)

1. Bluetooth SIG, Bluetooth Specifications 1.0-3.0+HS. [Online]. Available: http://www.bluetooth.com/Bluetooth/Technology/Building/ Specifications. [Accessed Sep. 17, 2009].
2. Bluetooth SIG, Bluetooth Wireless Technology Surpasses One Billion Devices. [Online]. Available: http://www.bluetooth.com/ Bluetooth/Press/SIG/ BLUETOOTH WIRELESS TECHNOLOGY SURPASSES ONE BILLION DEVICES.htm. [Accessed Sep. 17, 2009].
3. Bluetooth SIG, 2008 Marks Ten Years of Bluetooth Wireless Technology. [Online]. Available: http://www.bluetooth.com/Bluetooth/ Press/SIG/2008 MARKS TEN YEARS OF emBLUETOOTHem WIRELESS TECHNOLOGY.htm. [Accessed Sep. 17, 2009].
4. H. Cheung, "How to: building a BlueSniper Rifle-part 1." [Online]. Available: http://www.smallnetbuilder.com/content/view/24256/98. [Accessed Sep. 17, 2009].
5. H. Cheung, "How to: building a BlueSniper Rifle-part 2." [Online]. Available: http://www.smallnetbuilder.com/content/view/24228/98. [Accessed Sep. 17, 2009].
6. M. Moser, "Busting the Bluetooth myth-getting RAW access." [Online]. Available: http://www.packetstormsecurity.org/papers/wireless/busting bluetooth myth.pdf. [Accessed Sep. 17, 2009].
7. K. Haataja, "Security threats and countermeasures in Bluetooth-enabled systems," Ph.D. dissertation, University of Kuopio, Department of Computer Science, Feb. 6, 2009.
8. Darkircop, "CSR Sniffer-firmware assembler and disassembler." [Online]. Available: http://bluetooth-pentest.narod.ru/software/xap2.zip. [Accessed Sep. 17, 2009].
9. D. Spill and A. Bittau, "BlueSniff-Eve meets Alice and Bluetooth," in Proc. First USENIX Workshop on Offensive Technologies (WOOT'2007), Boston, MA, Aug. 2007.
10. D. Spill and A. Bittau, BlueSniff source codes. [Online]. Available: http://www.cs.ucl.ac.uk/staff/a.bittau/gr-bluetooth.tar.gz. [Accessed Sep. 17, 2009].
11. M. Jakobsson and S. Wetzel, "Security weaknesses in Bluetooth," Lecture Notes in Computer Science, vol.2020, pp. 176-191, Springer- Verlag, 2001.
12. D. K̈ugler, "Man in the middle attacks on Bluetooth," Lecture Notes in Computer Science, vol.2742, pp. 149-161, Springer-Verlag, 2003.
13. A. Levi, E. Cetintas, M. Aydos, C. Koc, and M. Caglayan, "Relay attacks on Bluetooth authentication and solutions," Lecture Notes in Computer Science, vol.3280, pp. 278-288, Springer-Verlag, 2004.
14. J. Suomalainen, J. Valkonen, and N. Asokan, "Security associations in personal networks: a comparative analysis," Lecture Notes in Computer Science, vol.4572, pp. 43-57, Springer-Verlag, 2007.
15. K. Hypp̈onen and K. Haataja, " Man-in-the-middle attack on Bluetooth secure simple pairing," in Proc. IEEE Third International Conference in Central Asia on Internet, The Next Generation of Mobile, Wireless and Optical Communications Networks (ICI'2007), Tashkent, Uzbekistan, Sep. 2007.
16. K. Haataja and K. Hypp̈onen, "Man-in-the-middle attacks on Bluetooth: a comparative analysis, a novel attack, and countermeasures," in Proc. IEEE Third International Symposium on Communications, Control and Signal Processing (ISCCSP'2008), St. Julians, Malta, Mar. 2008.
17. K. Haataja and P. Toivanen, "Practical man-in-the-middle attacks against Bluetooth secure simple pairing," in Proc. 4th IEEE International Conference on Wireless Communications, Networking and Mobile Computing (WiCOM'2008), Dalian, China, Oct. 2008.
18. E. Uzun, K. Karvonen, and N. Asokan, "Usability analysis of secure pairing methods," Lecture Notes in Computer Science, vol.4886, pp. 307-324, Springer-Verlag, 2008.
19. J. Shandle, "University research aims at more secure Wi-Fi." [Online]. Available: http://www.eetimes.com/news/latest/showArticle.jhtml? articleID=192501255. [Accessed Sep. 17, 2009].
20. M. Barbeau, J. Hall, and E. Kranakis, "Detecting impersonation attacks in future wireless and mobile networks," Lecture Notes in Computer Science, vol.4074, pp. 80-95, Springer-Verlag, 2006.
21. J. Franklin, D. McCoy, P. Tabriz, V. Neagoe, J. Randwyk, and D. Sicker, "Passive data link layer 802.11 wireless device driver fingerprinting, " in Proc. 15th USENIX Security Symposium, Vancouver, B.C., Canada, July 2006.
22. O. Ureten and N. Serinken, "Wireless security through RF fingerprinting," Canadian J. Electrical and Computer Engineering, vol.32, no.1, pp. 27-33, 2007.
23. O. Ureten and N. Serinken, "Bayesian detection of radio transmitter turn-on transients," in Proc. IEEE Non Linear Signal and Image Processing Conference, Antalya, Turkey, June 1999, pp. 830-834.
24. J. Hall, M. Barbeau, and E. Kranakis, "Detecting rogue devices in Bluetooth networks using radio frequency fingerprinting," in Proc. IASTED International Conference on Communications and Computer Networks (CCN'2006), Lima, Peru, Oct. 2006.
25. N. Borisov, I. Goldberg, and D. Wagner, "Intercepting mobile communications: the insecurity on 802.11," in Proc. 7th Annual International Conference on Mobile Computing and Networking (MOBICOM'2001), ACM Press, 2001.
26. K. Haataja, "New efficient intrusion detection and prevention system for Bluetooth networks," in Proc. ACM International Conference on Mobile, Wireless MiddleWare, Operating Systems, and Applications (Mobilware'2008), Innsbruck, Austria, Feb. 2008.
27. ZigBee Alliance, Technical specifications-ZigBee specifications. [Online]. Available: http://www.zigbee.org/Products/ TechnicalDocumentsDownload/ tabid/237/Default.aspx. [Accessed Sep. 17, 2009].