Bluetooth Impersonation AttackS (BIAS)

An adversary disguises the MAC address of their Bluetooth enabled device to one for which there exists an active and trusted connection and authenticates successfully. The adversary can then perform malicious actions on the target Bluetooth device depending on the target’s capabilities.

Abstraction

Detailed

Typical severity

High

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

Execution flow

How does the attack proceed, step by step?

Explore

Find disguise and target

The adversary starts the Bluetooth service on the attacking device and searches for nearby listening devices.

Techniques used

Knowledge of a trusted MAC address.
Scanning for devices other than the target that may be trusted.

Experiment

Disguise

Using the MAC address of the device the adversary wants to impersonate, they may use a tool such as spooftooth or macchanger to spoof their Bluetooth address and attempt to authenticate with the target.

Exploit

Use device capabilities to accomplish goal

Finally, if authenticated successfully the adversary can perform tasks/information gathering dependent on the target's capabilities and connections.

Requirements

What does the attack require?

Prerequisites

Knowledge of a target device's list of trusted connections.

Skills required

Low: Adversaries must be capable of using command line Linux tools.
Low: Adversaries must be in close proximity to Bluetooth devices.

Resources required

Not stated in the MITRE record.

Impact

What does a successful attack lead to?

Affected scopes: Integrity

Affected scopes: Confidentiality

Defence

How is it prevented and mitigated?

Disable Bluetooth in public places.

Verify incoming Bluetooth connections; do not automatically trust.

Change default PIN passwords and always use one when connecting.