Attacks, Strengths, and Weaknesses	113

address is also able to impersonate the unit distributing the unit key. Thus, when using a unit key, there is no protection against attacks from trusted devices. The unit key usage weakness was observed by Jakobsson and Wetzel in [19] and was also pointed out by NIST in a report on wireless security [22]. The potential risks with units keys have also been recognized by the Bluetooth SIG. Originally, the unit key was introduced in order to reduce memory requirements on very limited devices and remains part of the standard for backward compatibility reasons. The Bluetooth combination keys would be much more appropriate to use for almost any Bluetooth unit and the Bluetooth SIG does not recommend the use of unit keys [23] anymore.

7.6 Location tracking

As we have discussed, security in computer networks includes different aspects of message integrity, authentication, and confidentiality. In wireless networks, where users move between different networks and media types, another issue becomes important: location privacy. Since the Bluetooth technology is targeted toward devices of personal type like mobile phones, PDAs, or laptops, this becomes a real issue. The location privacy threat is actually independent of whether Bluetooth is just used for local connectivity or as an access technology. As long as the device is carried and used by one particular person, there is a risk that the device is tracked using the transmitted radio signals from the Bluetooth-enabled device. In order to be able to track user movements, there must be some fixed device identity the attacker can utilize. Once the attacker has succeeded in linking a human identity to the device identity, the threat becomes a reality. Hence, all kinds of fixed identities are potential privacy threats. The Bluetooth device address or any value derived from the device address is the obvious location privacy attack target in Bluetooth. Moreover, even a userfriendly name or any other application-specific identity might be a privacy problem. In this section we discuss the Bluetooth device address usage from a privacy perspective and discuss different Bluetooth location tracking attacks.

To protect a device against location tracking, an anonymity mode is needed. Devices operating in anonymous mode regularly update their device address by randomly choosing a new one. The anonymity mode is described in detail in Chapter 8.

7.6.1Bluetooth device address and location tracking

The most serious location tracking threat utilizes the Bluetooth device address. The address format is derived from the IEEE 802 standard. The Bluetooth

114	Bluetooth Security

device address, BD_ADDR, has a length of 48 bits and consists of three different parts:

1.Lower address part;

2.Upper address part (UAP);

3.Nonsignificant address part (NAP).

The format is illustrated in Figure 7.3. The LAP and UAP form the significant part.

The entire Bluetooth address (LAP, UAP, and NAP parts) is sent in the special frequency hop synchronization (FHS) packets transmitted at certain occasions. This fact can be utilized in the different attacks described in Section 7.6.2. However, this is not the only threat. Any deterministic value derived from the entire or parts of a fixed device address might be used for the very same purpose. This is the case for the Bluetooth access codes. These codes form the first part of each packet transmitted in Bluetooth. There are three different distinct access codes:

1.CAC, which is derived from the master’s LAP;

2.Device access code (DAC), which is derived form the specific device’s (slave) LAP;

3.Inquiry access code (IAC), which can be of two different forms, but is derived from special dedicated LAP values not related to any specific

BD_ADDR.

Hence, the CAC and DAC (but not the IAC) can potentially be used to track the location of a specific user.

LSB

MSB

Company-assigned field

Company identity field

LAP

UAP

NAP

24 bits

8 bits

16 bits

Figure 7.3 Bluetooth device address format.

Attacks, Strengths, and Weaknesses	115

7.6.2Five different types of location tracking attacks

As we just discussed, directly or indirectly, the use of a fixed device address allows the general location of Bluetooth devices to be clandestinely determined. The device address, the CAC, or the DAC can be used to identify a particular device. Also, the user-friendly name of a device can be used to track the location of a device. In all, five different types of location tracking attacks have been identified. We describe these in the following sections.

Inquiry attack

In this scenario the attacker has distributed one or more Bluetooth devices throughout a region in which he desires to locate Bluetooth users. This can be done relatively inexpensively due to the low cost of Bluetooth devices. In addition, this network of devices can be used for a legitimate purpose, such as public information kiosks, and thus may already exist. Furthermore, assume that the potential victim of such an attack has left his device in discoverable mode. In this case, the attacking device can simply interrogate the area using frequent inquiry messages for devices and maintain a log of all the device addresses that are discovered. This data can be correlated with time to provide an accurate record of victim movements and associations (e.g., two people who are frequently in the same area are probably associated in some way).

Traffic monitoring attack

The next attack we describe succeeds even if the victim device is not in discoverable mode. In this case, the attacker simply monitors the communication between two trusted devices belonging to the victim. These devices will communicate using a specific CAC. This CAC is computed from the device address of the master device in the piconet. Therefore, an attacker can determine the master devices in the area by simply monitoring all network traffic nearby. Even if the CAC is not unique, the attacker can be quite confident that a particular CAC belongs to one unique device due to the small probability of two devices that have the same CAC within a small area. Similarly, the DAC can be used to detect a particular device. Furthermore, the whole device address is sent in the FHS packets of the devices, allowing an attacker to uniquely determine the identity of a device. An attack based on monitoring DAC or FHS packets are not as powerful as an attack based on monitoring CAC, since the FHS packet or packets containing DAC are only used at connection establishment (or at the master-slave switch), that is, events that are relatively rare.

Paging attack

This attack allows the attacker to determine if a given device with a known BD_ADDR or DAC is present within range. The attack requires that the