Improving Compliance with Bluetooth Device Detection

Martin Davies, Eoghan Furey, Kevin Curran

Abstract


The number of devices containing Bluetooth chipsets is continuing to rise and there exists a need to stem the tidal wave of vulnerabilities brought by the Bring Your Own Device (BYOD) and Internet of Things
(IoT) phenomena. With Bluetooth enabled but discovery mode turned off, auditing for Bluetooth devices, or creating an accurate Bluetooth device hardware log is limited. The software tools and hardware
devices to monitor WiFi networking signals have long been a part of the security auditor’s arsenal, but similar tools for Bluetooth are bespoke, expensive, and not adopted by most security pentesters. However, this has changed with the introduction of the Ubertooth One, a low-cost and open-source platform for monitoring Bluetooth Classic signals. Using a combination of the Ubertooth One, and other high-power Bluetooth devices, an auditor should now be able to actively scan for rogue devices that may otherwise have been missed. This research examines various hardware combinations that can be used to achieve this functionality, and the possible implications from a compliance point of view, with a focus on the standards used by the Payment Card Industry Data Security Standard (PCI-DSS), and the guidelines offered by the National Institute of Standards and Technology (NIST). We compare the results of scanning with traditional Bluetooth devices as opposed to an Ubertooth/Bluetooth combination. We show how the ability to monitor a larger portion of Bluetooth traffic can highlight serious implications in the compliance landscape of many organisations and companies. We demonstrate that identifying non-discoverable devices with Bluetooth enabled is a crucial element in holistic security monitoring of threats.


Keywords


network security; wireless security; bluetooth hacking; hacking; wireless sniffing;



DOI: http://dx.doi.org/10.12928/telkomnika.v17i5.12929

Article Metrics

Abstract view : 7 times

Refbacks

  • There are currently no refbacks.


Copyright (c) 2019 Universitas Ahmad Dahlan

TELKOMNIKA Telecommunication, Computing, Electronics and Control
ISSN: 1693-6930, e-ISSN: 2302-9293
Universitas Ahmad Dahlan, 4th Campus, 9th Floor, LPPI Room
Jl. Ringroad Selatan, Kragilan, Tamanan, Banguntapan, Bantul, Yogyakarta, Indonesia 55191
Phone: +62 (274) 563515, 511830, 379418, 371120 ext. 4902, Fax: +62 274 564604

Creative Commons License
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.

View TELKOMNIKA Stats