Wireless Vulnerabilities & Exploits
Wireless Vulnerabilities & Exploits
WVE ID: WVE-2005-0003
Type: Vulnerability
Status: Candidate
Classification:
Authentication Management
Information Disclosure
Description:
The BlueSnarf vulnerability allows an attacker to covertly retrieve information from certain models of Bluetooth enabled cellular phones via the OBEX protocol.
Discussion:
The Bluesnarf vulnerability is a flaw in the implementation of the OBEX Push service in certain Bluetooth devices. The OBEX Push service provideds for the easy exchange of information, and is very much like a binary version of the file transfer protocol (FTP). Devices that implement the protocol through an OBEX Push daemon do not allow file browsing, thus an attacker is limited to retrieving files with already known names. However, many file names for storing information on cell phones are standardized and defined by the IrMC (Infrared Mobile Communications) specification, so this limitation will not present an obstacle to an attacker (e.g., the phonebook filename is 'telecom/pb.vcf', the calendar is 'telecom/cal.vcs', etc.).
Information that can be retrieved via this method includes, but is not limited to Phonebook and calendar entries, Phone clock settings, the business card, configuration setttings, and the phone's IMEI (International Mobile Equipment Identity).
The information contained in such entries can be used for social engineering and at worst (in the case of the IMEI) cellular phone cloning.
Phones that are known to be vulnerable at this time are Sony/Ericcson T39m, T68, R520m, T68i, T610, Z1010, and Z600; and Nokia 6310, 6310i, 8910, and 8910i.
Credits
Author:
Marcel
Holtmann
(marcel@trifinite.org)
: trifinite.org
Author:
Adam
Laurie
(adam@trifinite.org)
: trifinite.org
References
URL:
http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20031111/fc473484/blu-0001.txt
URL:
http://trifinite.org/trifinite_stuff_bluesnarf.html
Released: 2003-11-11
Submitter
Andrew
Lockhart
(alockhart@networkchemistry.com)
: Network Chemistry
Submitted: Mon Oct 24 09:54:13 -0700 2005
Candidate Date: Thu Oct 06 14:35:58 -0700 2005
