How to close the security gaps in Bluetooth
Connecting state and local government leaders
Bluetooth personal area networks provide only limited security; NIST offers new guidance on countering threats.
Bluetooth technology has been integrated into many types of devices, including cell phones, laptops, automobiles, printers, keyboards, mice and headsets. This allows users to form ad hoc networks between varieties of devices but it also introduces risks of eavesdropping, hijacking and compromise.
The National Institute of Standards and Technology is updating its recommendations for securing Bluetooth-enabled devices that addresses new versions of the standards and the threats to them.
A draft of Special Publication 800-121 Rev. 1, "Guide to Bluetooth Security," has been issued for public comment. It gives recommendations on securing Bluetooth effectively, but warns that the mitigation and controls described cannot guarantee a secure environment.
Related stories:
NIST puts together a plan for securing wireless LANs
4 threats to wireless security
“Each organization should evaluate the acceptable level of risk based on numerous factors, which will affect the level of security implemented by that organization,” the document says. “To be effective, Bluetooth security should be incorporated throughout the entire lifecycle of Bluetooth solutions.”
Bluetooth is an open-standards protocol for short-range, personal-area wireless networking commonly used to connect peripherals with desktop or handheld computing devices. The growing use of personal mobile devices and the introduction of new applications, such as links in on-board automobile systems, have resulted in a growing use of Bluetooth and a number of new versions and features.
SP 800-121 was published originally in 2008, describing the security capabilities of Bluetooth and giving recommendations on their use. Much of the information originally had been included in NIST guidance on WiFi network security, but commenters wanted a separate publication for the Bluetooth material.
The revised version includes information on the latest vulnerabilities and their mitigations for Secure Simple Pairing, which was introduced in Bluetooth v2.1 + Enhanced Data Rate (EDR), as well as an introduction to and discussion of Bluetooth v3.0 + High Speed and Bluetooth v4.0 Low Energy security mechanisms and recommendations.
Bluetooth allows users to form ad hoc voice and data networks among a wide variety of devices, and operates in the same band as some 802.11 WiFi versions. It uses frequency-hopping spread spectrum technology, and this, plus power controls to limit the effective range of a device, provide limited security from eavesdropping. But hopping sequences can be easily determined with free open-source software.
Authentication, confidentiality and authorization services are included in the Bluetooth standard, and each version has its own security features, although they often are not robust. The publication includes a summary and assessment of Bluetooth vulnerabilities for each version, including seven that apply to all versions:
- Link keys are stored improperly.
- Strengths of the pseudo-random number generators (PRNG) are not known.
- Encryption-key length is negotiable.
- No user authentication exists.
- End-to-end security is not performed.
- Security services are limited.
- Discoverable and/or connectable devices are prone to attack.
The document also describes a number of threats and ways to mitigate them. General recommendations for secure use of Bluetooth include:
- Use the strongest Bluetooth security mode available for Bluetooth devices. The available modes vary based on the Bluetooth specification version supported by the device.
- Address Bluetooth technology in security policies, and change default settings of Bluetooth devices to reflect the policies. The policy should include a list of approved uses for Bluetooth, a list of the types of information that may be transferred over Bluetooth networks, and requirements for selecting and using Bluetooth personal identification numbers where applicable.
- Ensure that Bluetooth users are made aware of their security-related responsibilities regarding Bluetooth use. Users should also be made aware of other actions to take regarding Bluetooth device security, such as ensuring that Bluetooth devices are turned off when they are not needed to minimize exposure to malicious activities, and performing Bluetooth device pairing as infrequently as possible and, ideally, in a physically secure area where attackers cannot observe passkey entry or eavesdrop on Bluetooth pairing-related communications.
Comments on draft SP 800-121 Revision 1 should be sent by Oct. 28 to 800-121comments@nist.gov with "Comments on SP 800-121" in the subject line.