Extracting the Painful Blue Tooth
Matteo Beccaro and Matteo Collura demonstrate penetrating commercial Bluetooth and BLE consumer devices, revealing critical weaknesses in pairing and key exchange.
Summary
Architecture and Background
Do you know how many Bluetooth-enabled devices are currently present in the world? With the beginning of the IoT (Internet of Things) and Smart Bluetooth (Low energy) we find in our hands almost a zillion of them. Are they secure? What if I tell you I can unlock your Smartphone?
Vulnerability Analysis
What if I tell you I'm able to open the new shiny SmartLock you are using to secure your house's door? In this talk we will explain briefly how the Bluetooth (BDR/EDR/LE) protocols work, focusing on security aspects. We will show then some known vulnerabilities and finally we will consider deeply undisclosed ones, even with live demonstrations. Matteo Beccaro is a young security researcher.
Exploitation and Demonstrations
His interest focus on WiFi networks, networking and NFC implementations. He finished high school studies in July 2013 and actually he is a student at Politecnico di Torino in Computer Engineering course. He has been selected as speaker at DEF CON 21, 30C3, BlackHat US Arsenal, DEF CON 22's Skytalks and BlackHat EU 2014 and Tetcon, for his research in vulnerabilities of NFC transport systems. Since 2013 he is also pentester and security engineer at Secure Network s.r.l.
Remediation and Defensive Strategies
Since 2015 he is also technical leader of the Security Research Team of OPFOR, the physical security division of Secure Network s.r.l. Matteo Collura is a student of Electronics Engineering at Politecnico di Torino. He has been studying Wireless networks and in the last few years he focused on NFC. He presented the results of a progressive work of research at several conferences: DEF CON 21 (Las Vegas, 2013), 30C3 (Hamburg 2013), DEF CON Skytalks (Las Vegas, 2014), BlackHat USA 2014 Arsenal (Las Vegas). Currently he is studying Bluetooth protocols and their implementations.
Related talks
Main Stage·46 min
smea
A thorough security analysis of internet-connected intimate devices revealing Bluetooth vulnerabilities, insecure APIs, and privacy failures.
Main Stage·23 min
Alan Meekins
Investigates fixed-address Bluetooth Low Energy beacons in law enforcement gear, body cameras, and consumer IoT, demonstrating long-term tracking.
Main Stage·37 min
Jose Pico · Fernando Perera
Jose Pico and Fernando Perera demonstrate exploiting Windows Bluetooth Low Energy (BLE) pairing flaws to execute unauthorized wireless keystroke injection.