Friday, December 09, 2011

Bluetooth for Bad Guys

Criminals have been skimming debit and credit card information by tampering with point of sale terminals, PIN pads, gasoline pumps, and ATMs for quite a while now. The first time I heard of Bluetooth being used in such cases was from this SparkFun Electronics news blurb a couple years ago. Malicious hardware installed in a Canada retailer's PIN pad intercepted customer data and transmitted it via Bluetooth to the attacker's device, perhaps a laptop in a nearby parking lot. At the time it seemed like a clever use of the technology by a Canadian ne'er-do-well but probably not the start of a trend. I was wrong.

As Joshua Wright recently pointed out, Visa is informing merchants about similar crimes that took place around the same time in Utah. Skimmers have also been found in Florida and elsewhere. Just this week, customers of Lucky Supermarkets in California found out that a similar attack was the reason their bank accounts were recently drained. This isn't just one clever crook; this is a criminal industry at work.

The technical reasons that Bluetooth is an attractive technology for this application are nicely outlined in Joshua's article, but we wouldn't see so many actual attacks were it not for commercial availability of Bluetooth skimmers sold on the criminal underground. There is an industry producing hardware for crime just as there is an industry producing software for crime.

How can you protect yourself as a customer? The best advice I can think of is to consider the liability of payment methods. There is a reason I like to carry some cash. There is also a reason I strongly prefer to use a credit card over a bank debit card. With a credit card (in the US, at least), the financial institutions and merchants bear most of the burden of liability. As long as I check for unauthorized transactions before paying my bill every month, I don't have much to worry about. Once, many years ago, someone emptied my checking account. I figured out what had happened and managed to convince my bank that the bank's own misguided security practice had allowed it to happen, but guess who bore the burden of a zero balance until that was resolved?

How can you protect yourself if you are a retailer or financial institution? This is a much more difficult problem. For starters, you should read Joshua Wright's article and the Visa bulletin. Josh has some nice things to say about my Project Ubertooth, but he also has some criticisms, mostly pointing out features yet to be developed. The first item on his wish list is frequency hopping, something I am working on now. He also points out the need to improve Bluetooth device fingerprinting, an area of research that has been advanced in recent years primarily by JP Dunning.

When I read about real life attacks on retailers and customers, sometimes I imagine how I could use technology to catch the crooks. Frankly, it would be hard, and it would be especially hard to deploy tools that would allow more investigators to do the same. Bad guys are using Bluetooth (and potentially other wireless technologies). We need Bluetooth tools for the good guys too.

I guess, if there is a lesson to be learned from all this, it is that hardware security matters. If an attacker can get in between a user and a system, the security of the system will fail in almost any case. Advocates of the Bring Your Pwn Device (BYOD) trend might want to pay attention. (That was an honest typo, but I decided to keep it!)

30 comments:

bluetooth said...

yes, even better for the bad guys is good for us.

0845 numbers said...

Bluetooth was invented for the convenience of many, not for the sake of few. Let's just be vigilant with our accounts.

Poker Online said...

This is a nice and informative, containing all information and also has a great impact on the new technology. Thanks for sharing it

Poker Online Terpercaya said...

Please visit guys. thanx you guys

Agen Poker said...

Nice post guys.

Judi Poker said...

have a nice days guys

Poker Online Indonesia said...

Happy Munday guys.

Agen Bola Terpercaya said...

nice posting Agen bola terpercaya

Agen Bola said...

nice article thank you.Agen Bola

bandar ceme online said...

Fantastic post.Really looking forward to read more. Much obliged.
bandar ceme
bandar ceme online
ceme online
situs bandar ceme
bandar ceme terpercaya

bandar ceme said...

bandar ceme
bandar ceme online
ceme online
situs bandar ceme
bandar ceme terpercaya

poker online
judi poker online
poker indonesia
situs judi poker
poker online terpercaya

dominohp said...

bandar q bandar qiu bandar kiu bandar ceme agen ceme agen bandar q bandar q online

CERITA SEXUAL said...

Hello Bosku....!!
jangan Bilang Kalau Kamu Jago Bermain Poker Sebelum Bermain Di :
http://www.gadispoker.com/ref.php?ref=CSGADIS555
Jadi Tunggu Apalagi Ayo.. Bergabung & Rasakan Kesuksesan Bersama Kami.
Cukup hanya Satu ID kamu Sudah Bisa Memainkan 6 Permainan Sekaligus lho..

Jangan Anda Ragu.. ROBOT Ataupun Admin Ikut Bermain??
Tenang Saja Di sini.!! Di Gadispoker NO. 1 Terpercaya,
Murni Member VS Member, Fairplay.
Proses Depo / WD Super Cepat, Berapapun Kemenangan Anda Akan Dibayar!

Kami Juga memiliki Promo Menarik Khusus Untuk Member Setia Gadispoker.:
-Minimal Depo / Wd Hanya : 10000,-
-Bonus Deposit Setiap hari Untuk Para member.
-Bonus Refferal 15% Seumur Hidup.
-Bonus TO/Turn Over Up TO 0,3% - 0,5%

Kalian Juga Akan Di layani Dengan CS kami Yang ramah, baik dan Juga berpegalaman.
Selama 24Jam, Jadi Tunggu Apalag..
Ayo Bergabung Bersama Kami.

Untuk Info Lebih lanjut Silakan hubungi CS (custumer Service).
-Live chat ( http://www.gadispoker.com )
-Whatsapp : +855966624192
-Skype : Gadispoker
-Yahoo : gadispokercs
-BBM : D87DB681
Hubungi Segera Dan Jangan Lewatkan Kemenanganmu..!

Unknown said...

DEWADOMINOQQ AGEN JUDI ONLINE TERBAIK DAN TERPERCAYA


DewaDominoQQ - Agen Poker & Domino Terbesar & Terpercaya Se-Indonesia.
Nikmati Bonus TO Setiap Hari & Referral Terbesar Seumur Hidup. Minimal DP & WD IDR 15.000.
100% Fairplay No Admins No Bots.
Kini kami menyediakan 7 Permainan yang dapat anda akses hanya dengan 1 ID.
Ayo Segera Join DewaDominoQQ. https://goo.gl/mUbUK8
LINE : dewadominoqq
BBM : 2B5E9CDB
WhatsApp : +85593827759
FanPage : https://goo.gl/H515Qd
Twitter : @dewadominoqq

Jenny Wijaya said...

daftar sabung ayam s128
bluebet mobile
cbet bola online
918kiss
download apk osg777

slot online joker123

Angel Laris said...

bandarq bandarq online poker online poker deposit pulsa boyaqq bandarqq

Unknown said...

Agen Bandar Ceme Online - Permainan Ceme online adalah permainan yang menggunakan kartu domino.Bandar Ceme Online

enamceme said...

a very best bandar ceme online bandar ceme

poker online

DominoQiu said...

Domino Qiu Qiu gaming online Indonesia

bandar ceme ceme online

boyaqq said...

bandar ceme

daftar poker

daftar situs poker online

daftar bandar ceme

ceme

domino

bandar ceme online

ceme online

situs ceme

boyaqq said...

Insight Interactive

agen ceme

qiu qiu

situs ceme

bandarqiu

bandarq

dominoqq

id pro poker

akun pro

Sinta Suleha said...

Thanks For Your support,,Good article

DivaDOMINO
Judi Poker Online
Agen DOMINO99 Online
Situs QQ Online Terpercaya Online
Agen situs Domino99 Online
Situs Domino99 Terbaru Online
Daftar Akun Robot
Akun Robot PKV
Strikerjitu
Bola parlay
sosmedqq
sosmedqq terpercaya
Akun Robot PKV
Bola parlay
Bola Terpercaya
Daftar Situs Poker
Tips BandarQ Terbaru
Situs Tips BandarQ

Ceme Online said...

terimakasih sudah membagikan informasi yang sangat bermanfaat



ceme online

bandar ceme

bandar ceme online

ceme online indonesia

judi ceme

judi ceme online

ceme

bandar ceme

ceme 99

99 ceme

bandar ceme terpercaya

agen ceme

situs ceme

game ceme

ceme terbaik

ceme terpercaya

Unknown said...

Good Job Thanks For Your support,,Good article


Poker Online

Judi Poker

Judi Poker Online

QQOnline2019

bandar domino99
poker online terpercaya
daftar domino
Berita Terhot

Raja ID PRO

boyaqq said...

BoyaQQ adalah salah satu situs agen judi bandar poker domino qq online terpercaya dengan beberapa bonus menarik yang bisa kamu dapatkan serta memiliki banyaknya permainan judi poker online atau judi qq online server pokerv diantaranya : Poker Online. agen poker

Ginnkelly said...

poker online pontianak
poker online medan
poker online terpercaya

Poker Online said...

Poker Online Indonesia
poker online sumatera utara
poker online sumatera barat

Jangkrik bgpitter said...

Cara Main domino88 Terpercaya

Anonymous said...

If some one desires to be updated with latest technologies after that he must be pay
a quick visit this website and be up to date all the time.

Anonymous said...

If some one desires to be updated with latest technologies after that
he must be pay a quick visit this website and be up to date all the time.