Key Negotiation of Bluetooth Attack

Re:Key Negotiation of Bluetooth Attack by timerol on Friday August 16, 2019 @03:35PM (#20718864)

The way you're describing this makes it sound like an extremely difficult process. In some ways, it is. However, every BT device that exists is currently capable of doing this frequency tracking and tight timing. It's merely a matter of starting to transmit slightly earlier and significantly louder than a normal BT transmit after sniffing the start of the connection.

This attack should be possible from any software-defined radio that's capable of sniffing on and forming BT connections.

[ Parent | on HN ]

Re:Key Negotiation of Bluetooth Attack by jwtorres on Friday August 16, 2019 @03:41PM (#20718919)

Quoting my response to Tuna-Fish: "Trying to overpower the transmission of the BT peer is certainly the technique to take (although I was hoping not to broadcast that publicly in my original post). You will still have a tough time, however, because you're probably trying to overpower the transmission of two collocated devices (e.g. keyboard+computer) while you are 5-50feet away. In many cases you'll probably end up saturating the receiving antenna. It will be largely a trial-and-error technique, but it will work eventually."

[ Parent | on HN ]