How secure is your data during a bluetooth transmission?

In any wireless networking setup, security is actually  a concern. Devices can easily grab radio waves out of the air, so people who send sensitive information over a wireless connection need to take precautions to make sure those signals aren't intercepted. Bluetooth technology is no different it's wireless and therefore susceptible to spying and remote access, just like WiFi is susceptible if the network isn't secure. With Bluetooth, though, the automatic nature of the connection, which is a huge benefit in terms of time and effort, is also a benefit to people looking to send you data without your permission.

Bluetooth offers several security modes, and device manufacturers determine which mode to include in a Bluetooth-enabled gadget. In almost all cases, Bluetooth users can establish "trusted devices" that can exchange data without asking permission. When any other device tries to establish a connection to the user's gadget, the user has to decide to allow it.

Service-level security and device-level security work together to protect Bluetooth devices from unauthorized data transmission. Security methods include authorization and identification procedures that limit the use of Bluetooth services to the registered user and require that users make a conscious decision to open a file or accept a data transfer. As long as these measures are enabled on the user's phone or other device, unauthorized access is unlikely. A user can also simply switch his Bluetooth mode to "non-discoverable" and avoid connecting with other Bluetooth devices entirely. If a user makes use of the Bluetooth network primarily for synching devices at home, this might be a good way to avoid any chance of a security breach while in public.

Bluetooth vulnerabilities

Although security is available for Bluetooth, many smartphone, cell phone, and other device vendors choose to use Mode 1 security. In addition a large number of devices are set to discovery/visible-to-all mode, which enables them to respond to all service inquiries. This allows users to quickly experience the benefits of using a piconet without the hassles of worrying about security configurations.

In a June 2006 article entitled "Bluetooth: London 2006", Alexander Gostev described the results of research conducted by Kaspersky Lab on the actual vulnerability of Bluetooth devices in public places. The Kaspersky team visited InfoSecurity 2006 in London with the purpose of detecting as many Bluetooth devices as possible.

According to Gostev, they detected more than 1000 Bluetooth devices in visible-to-all mode. In other words, these 1000 devices were ready and waiting for any other device to establish a connection. Lacking any other mechanisms to prevent unwanted access, they were exposed to data leakage or the rapid spread of malware. Devices detected included the following:

• Cell phones
• Smartphones
• Laptop computers
• Cordless phones
• PDA's
• Desktop computers
• Other uncategorized devices

Failing to turn off discover/visible-to-all mode or to implement at least Mode 2 level security might expose an organization's information in the following ways:

• Sensitive data is available for browsing
• An attacker can use a compromised telephone to make calls
• DoS attacks can be launched against the compromised device
• Address lists can be downloaded
• Malware can be installed for later infection of other devices, including network attached systems
• An attacker can install malware with the intent to gain ongoing control of the device

Protecting Bluetooth networks

There are a variety of ways for an organization to protect its Bluetooth devices from compromise. As with all security challenges the first step is to educate the workforce. Every employee should know about the right way and the wrong way to use Bluetooth. Also, policies should be in place that govern the use of business-owned and privately-owned wireless devices. At a minimum the policies should address the following:

• Configure devices so that the user has to approve any connection request
• Turn off Bluetooth when not in use
• Do not operate Bluetooth devices in Mode 1; ensure discovery mode is enabled only when necessary to pair trusted devices
• Trusted devices should be paired in safe environments out of the reach of malicious elements
• Minimize the range of devices to the shortest reasonable distance
• Consider installing anti-virus and personal firewall software on each Bluetooth device

Closely managed

Bluetooth is a great addition to the business productivity toolbox. However, it must be understood by the technical team and its deployment should be closely managed. Failure to purchase devices that support the right security measures, or to minimize exposure due to unmanaged device discovery, puts your enterprise data at risk.