ftit channel bar
FTIT September 5 2001 - Mobile Internet Security
Bluetooth - beware of drive-by hackers
by Joia Shillingford
Published: September 3 2001 10:18GMT | Last Updated: September 4 2001 11:42GMT
image

Bluetooth, the short-range radio standard, gives users a lot more freedom about where they use their portable computers to communicate. But it also opens up the possibility of so-called drive-by hacking or even carpark hacking.

Simon Gawne, vice president of marketing at software company Red-M, says: "In Silicon Valley, people wanting to connect to the internet will sometimes park outside a company with a wireless network and use its internet connection. They are part of a movement which thinks internet access should be free."

In the US, this has happened with the 802.11 wireless standard, but in theory someone sitting outside a Bluetooth-equipped building could get free internet access as many Bluetooth networks are connected to the net. The real problem, however, is that strangers could use Bluetooth as a way in to the company Lan or intranet.

"Even a Fed-Ex package could act as a Trojan Horse," warns Ori Pomerantz, a developer at Israel-based software company First Access. He says: "Suppose you are out of the office at a conference and the mailroom leaves a parcel near your computer. If the package includes a Bluetooth-enabled cellphone, the person who sent it to you could use it to dial into the company network."

Bluetooth allows all Bluetooth-enabled devices within a range of 10 metres to communicate. "The fact that Bluetooth is short-range is meaningless from a security perspective," he says, "because it isn't short enough."

There are perils outside the office, too. "A travelling executive in the airport could use your Bluetooth phone to transmit data from his laptop or personal organiser to Tokyo at your expense," cautions Troy Holtby, product manager for wireless products at 3Com.

"Bluetooth is promiscuous. Any Bluetooth mobile in range will be happy to pick up the call," points out Mr Pomerantz. The technology could also be used to transfer confidential files invisibly from one laptop to another.

With Bluetooth, even a humble computer mouse could have a sinister purpose. "Let's suppose you allow any Bluetooth mouse to talk to your laptop - after all, it's only a harmless mouse. But another mouse could be put in range and pretend to be yours; then it could send characters that cause a buffer overrun and help it break in."

Encryption can help to protect data transmitted over Bluetooth, but only if users switch it on. Moreover, in, say, an airport lounge providing net access via Bluetooth, encryption only takes place between the user's laptop and the network access point nearby, says Mr Pomerantz. "It won't be much protection if a hacker breaks in to the access point or to any router along the way. To be really secure, the data would have to be encrypted by the user and not decrypted till it reaches its final destination."

Rory Davidson, technical architect at KPMG-owned consultancy Metrius, says: "Security is the mobile and wireless technology's Achilles heel. The large partners within the Bluetooth group, including Intel, are all concentrating efforts on resolving the security issues.

"Bluetooth uses ad hoc network connectivity, with networks formed on the fly from devices connected wirelessly. Individual devices act as routers when relaying messages to other devices, which are too far apart from the sending one. The problem is that as all the devices in the network are dependent on each other to relay messages, denial-of-service attacks are easy to perform."

"The design of an ad hoc network is not fixed, either," continues Mr Davidson. "It changes all the time when these mobile devices move in and out of other devices' range."

Another potential problem is that because mobile devices are dependent on batteries, attacks which deliberately drain battery power could put them out of action. It can also be difficult for Bluetooth users in a meeting to ensure that they are communicating just with their colleagues, not with competitors in the same meeting.

Mr Davidson believes: "Bluetooth's security seems most suited to small ad hoc networks. Connecting a personal digital assistant (PDA) to a mobile phone using Bluetooth may also be secure enough."

Bluetooth can be made more secure by switching on encryption, specifying which devices, such as just your own mobile, you are willing to connect to, and adding extra firewall software, such as that developed by Red-M or First Access. Its frequency-hopping feature also makes it harder to hack.

Mr Gawne says: "A visitor to our head office near Slough, can connect to our Bluetooth network to use the internet while they are waiting to meet someone, but they can't get in to our intranet. We've added 128 bit encryption, and developed secure systems for medical Bluetooth networks."

3Com, the Palm PDA maker, also has 128 bit encryption in its $149 Bluetooth card and has made it easier for users to secure their systems.

Jeremy Green, principal consultant at researchers Ovum, predicts that: "Despite security fears, Bluetooth is too affordable and too useful not to succeed."

Jason Conyard, director of wireless strategy at Symantec, the anti-virus company, says if short-range wireless networks do take off: "The threats will one day range from virus-infected files being beamed between devices to full-blown 'worms' spreading via any and all communications networks."