Detail CAPEC-667

CAPEC-667

Bluetooth Impersonation AttackS (BIAS)
2021-06-24
00h00 +00:00
Sedang
Tinggi
Draft
2022-09-29
00h00 +00:00
CAPEC Mitre.org
Peringatan untuk CAPEC tertentu
Tetap terinformasi tentang perubahan untuk CAPEC tertentu.
Kelola notifikasi

Deskripsi CAPEC

An adversary disguises the MAC address of their Bluetooth enabled device to one for which there exists an active and trusted connection and authenticates successfully. The adversary can then perform malicious actions on the target Bluetooth device depending on the target’s capabilities.

Informasi CAPEC

Alur Eksekusi

1) Explore

[Find disguise and target] The adversary starts the Bluetooth service on the attacking device and searches for nearby listening devices.

Teknik
  • Knowledge of a trusted MAC address.
  • Scanning for devices other than the target that may be trusted.
2) Experiment

[Disguise] Using the MAC address of the device the adversary wants to impersonate, they may use a tool such as spooftooth or macchanger to spoof their Bluetooth address and attempt to authenticate with the target.

3) Exploit

[Use device capabilities to accomplish goal] Finally, if authenticated successfully the adversary can perform tasks/information gathering dependent on the target's capabilities and connections.

Prasyarat

Knowledge of a target device's list of trusted connections.

Keahlian yang Diperlukan

Adversaries must be capable of using command line Linux tools.
Adversaries must be in close proximity to Bluetooth devices.

Mitigasi

Disable Bluetooth in public places.
Verify incoming Bluetooth connections; do not automatically trust.
Change default PIN passwords and always use one when connecting.

Kelemahan Terkait

CWE-ID Nama Kelemahan

CWE-290

 Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Pengajuan

Nama Organisasi Tanggal Tanggal rilis
CAPEC Content Team The MITRE Corporation 2021-06-24 +00:00

Modifikasi

Nama Organisasi Tanggal Komentar
CAPEC Content Team The MITRE Corporation 2022-09-29 +00:00 Updated Related_Attack_Patterns
Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.