COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-666

BlueSmacking

An adversary uses Bluetooth flooding to transfer large packets to Bluetooth enabled devices over the L2CAP protocol with the goal of creating a DoS. This attack must be carried out within close proximity to a Bluetooth enabled device.

Abstraction

Standard

Typical severity

Medium

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

Execution flow

How does the attack proceed, step by step?

Explore

Scan for Bluetooth Enabled Devices

Using BlueZ along with an antenna, an adversary searches for devices with Bluetooth on.

Techniques used

Note the MAC address of the device you want to attack.

Experiment

Change L2CAP Packet Length

The adversary must change the L2CAP packet length to create packets that will overwhelm a Bluetooth enabled device.

Techniques used

An adversary downloads and installs BlueZ, the standard Bluetooth utility package for Linux.

Exploit

Flood

An adversary sends the packets to the target device, and floods it until performance is degraded.

Requirements

What does the attack require?

Prerequisites

The system/application has Bluetooth enabled.

Skills required

Low: An adversary only needs a Linux machine along with a Bluetooth adapter, which is extremely common.

Resources required

Not stated in the MITRE record.

Detection

What are the indicators of the attack?

Performance is degraded or halted by incoming L2CAP packets.

Impact

What does a successful attack lead to?

Unreliable ExecutionResource Consumption

Affected scopes: Availability

Defence

How is it prevented and mitigated?

Disable Bluetooth when not being used.

When using Bluetooth, set it to hidden or non-discoverable mode.