“Nino” man-in-the-middle attack on bluetooth secure simple pairing

Bluetooth Security Attacks

“…SSP uses four association models: OOB, Numeric Comparison, Passkey Entry, and Just Works (see Chap. However, it has been shown that MITM attacks against Bluetooth 2.1+EDR/3.0+HS/4.0 devices are possible by forcing the victim devices to use the Just Works association model [2,[9][10][11][12][13][14][15][16][17][18][19][20][21][22][23] (see Chap. The choice of association model depends on the device's IO capabilities (see Table 2.1 in Chap.…”

“…The attacking device is set to require authentication and encryption for each connection with the printer (see rows [14][15]. After the successful authentication with the printer (see rows [19][20][21][22][23][24][25], the attacking device abuses it by printing funny pictures, dozens of pages of random text, and various hoax documents (see rows [26][27][28]. After the successful authentication with the printer (see rows [19][20][21][22][23][24][25], the attacking device abuses it by printing funny pictures, dozens of pages of random text, and various hoax documents (see rows [26][27][28].…”

“…Our security analysis tool supports the automatic discovery and recognition of Bluetoothenabled printers in range. Finally, the attacking device simultaneously denies all legitimate printer users access to all four Bluetooth-enabled printers (see rows [17][18][19][20][21][22][23][24][25][26][27][28][29][30][31][32][33][34] [2,69]. If several Bluetooth-enabled printers are detected, several Bluetooth USB dongles will also automatically be used in parallel, i.e., one Bluetooth USB dongle is used for each detected Bluetooth-enabled printer.…”

Analysis of Bluetooth threats and v4.0 security features

“…This is because even if the user correctly checks that the numbers displayed on both devices are equal, they may not necessarily be involved in the same intended session. Haataja et al [7][8][9][10] exploited the fact that prior to SSP the devices exchange their respective input/output capabilities without any authentication, and so describe that one could modify these exchange messages to force devices to use the Just Works (JW) association model whose SSP is not designed to resist MitM attacks, thus leading to an MitM attack on the devices. Raphael and Patrick [3] have done an extensive analysis of the different association models with respect to secure simple pairing in Bluetooth 4.0 for both (BR/EDR) and LE operational modes.…”

Analyzing the Secure Simple Pairing in Bluetooth v4.0

“…This is because even if the user correctly checks that the numbers displayed on both devices are equal, they may not necessarily be involved in the same intended session. Haataja et al [10,11,8,9] exploited the fact that prior to SSP the devices exchange their respective input/output capabilities without any authentication, and so describe that one could modify these exchange messages to force devices to use the Just Works (JW) association model whose SSP is not designed to resist MitM attacks, thus leading to an MitM attack on the devices.…”