COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-668

Key Negotiation of Bluetooth Attack (KNOB)

An adversary can exploit a flaw in Bluetooth key negotiation allowing them to decrypt information sent between two devices communicating via Bluetooth. The adversary uses an Adversary in the Middle setup to modify packets sent between the two devices during the authentication process, specifically the entropy bits. Knowledge of the number of entropy bits will allow the attacker to easily decrypt information passing over the line of communication.

Abstraction

Standard

Typical severity

High

Likelihood of attack

Low

Understand the attack

What is this attack pattern?

An adversary can exploit a flaw in Bluetooth key negotiation allowing them to decrypt information sent between two devices communicating via Bluetooth. The adversary uses an Adversary in the Middle setup to modify packets sent between the two devices during the authentication process, specifically the entropy bits. Knowledge of the number of entropy bits will allow the attacker to easily decrypt information passing over the line of communication.

Execution flow

How does the attack proceed, step by step?

1

Explore

Discovery

Using an established Person in the Middle setup, search for Bluetooth devices beginning the authentication process.

Techniques used

  • Use packet capture tools.
2

Experiment

Change the entropy bits

Upon recieving the initial key negotiation packet from the master, the adversary modifies the entropy bits requested to 1 to allow for easy decryption before it is forwarded.
3

Exploit

Capture and decrypt data

Once the entropy of encryption is known, the adversary can capture data and then decrypt on their device.

Requirements

What does the attack require?

Prerequisites

  • Person in the Middle network setup.

Skills required

  • Medium: Ability to modify packets.

Resources required

  • Bluetooth adapter, packet capturing capabilities.

Impact

What does a successful attack lead to?

Read Data

Affected scopes: Confidentiality

Bypass Protection Mechanism

Affected scopes: Confidentiality, Access Control, Authorization

Modify Data

Affected scopes: Integrity

Defence

How is it prevented and mitigated?

1
Newer Bluetooth firmwares ensure that the KNOB is not negotaited in plaintext. Update your device.

Real world

MITRE example instances

Example instance 1Detail
Given users Alice, Bob and Charlie (Charlie being the attacker), Alice and Bob begin to agree on an encryption key when connecting. While Alice sends a message to Bob that an encryption key with 16 bytes of entropy should be used, Charlie changes this to 1 and forwards the request to Bob and continues forwarding these packets until authentication is successful.
CAPEC-668: Key Negotiation of Bluetooth Attack (KNOB) — DayBreach Saldırı Sözlüğü · DayBreach