Since its creation, Bluetooth has transformed itself from a cable replacement technology to a wireless technology that connects people and machines. Bluetooth has been widely adapted on mobile phones and PDAs. Many other vendors in other industries are integrating Bluetooth into their products. Although vendors are adapting to the technology, Bluetooth hasn't been a big hit among users. Security remains a major concern. Poor implementation of the Bluetooth architecture on mobile devices has led to some high profile Bluetooth hacks. Weak security protocol designs expose the Bluetooth system to some devastating protocol attacks [1]. Because some of these devices often contain sensitive personal or corporate information, security is always an issue when using Bluetooth with these devices. One issue with wireless technology is that signals might leak to outside of desired boundaries. These leaked signals can be used for various attacks ranging from eavesdropping to injecting traffic to fully impersonating another device. Over the years, several vulnerabilities have been discovered in the Bluetooth protocol design as well as the implementation of Bluetooth technology in applications. In this paper I will begin with briefly describing the Bluetooth protocol, explaining security measures in Bluetooth, and go into detail on specific analyze and discuss the vulnerabilities, and finally present an improvement pairing protocol that works with Encrypted Key Exchange Protocol. [24]
[1]
Hilarie K. Orman,et al.
The OAKLEY Key Determination Protocol
,
1997,
RFC.
[2]
D. Manivannan,et al.
Secure connections in Bluetooth scatternets
,
2003,
36th Annual Hawaii International Conference on System Sciences, 2003. Proceedings of the.
[3]
Hugo Krawczyk,et al.
A modular approach to the design and analysis of authentication and key exchange protocols (extended abstract)
,
1998,
STOC '98.
[4]
A T Karygiannis,et al.
Wireless Network Security: 802.11, Bluetooth and Handheld Devices
,
2002
.
[5]
David P. Jablon.
Strong password-only authenticated key exchange
,
1996,
CCRV.
[6]
Michael K. Reiter,et al.
Seeing-is-believing: using camera phones for human-verifiable authentication
,
2005,
2005 IEEE Symposium on Security and Privacy (S&P'05).
[7]
M. Ufuk Çaglayan,et al.
Relay Attacks on Bluetooth Authentication and Solutions
,
2004,
ISCIS.
[8]
Avishai Wool,et al.
Cracking the Bluetooth PIN
,
2005,
MobiSys '05.