Friday, December 09, 2011

Bluetooth for Bad Guys

Criminals have been skimming debit and credit card information by tampering with point of sale terminals, PIN pads, gasoline pumps, and ATMs for quite a while now. The first time I heard of Bluetooth being used in such cases was from this SparkFun Electronics news blurb a couple years ago. Malicious hardware installed in a Canada retailer's PIN pad intercepted customer data and transmitted it via Bluetooth to the attacker's device, perhaps a laptop in a nearby parking lot. At the time it seemed like a clever use of the technology by a Canadian ne'er-do-well but probably not the start of a trend. I was wrong.

As Joshua Wright recently pointed out, Visa is informing merchants about similar crimes that took place around the same time in Utah. Skimmers have also been found in Florida and elsewhere. Just this week, customers of Lucky Supermarkets in California found out that a similar attack was the reason their bank accounts were recently drained. This isn't just one clever crook; this is a criminal industry at work.

The technical reasons that Bluetooth is an attractive technology for this application are nicely outlined in Joshua's article, but we wouldn't see so many actual attacks were it not for commercial availability of Bluetooth skimmers sold on the criminal underground. There is an industry producing hardware for crime just as there is an industry producing software for crime.

How can you protect yourself as a customer? The best advice I can think of is to consider the liability of payment methods. There is a reason I like to carry some cash. There is also a reason I strongly prefer to use a credit card over a bank debit card. With a credit card (in the US, at least), the financial institutions and merchants bear most of the burden of liability. As long as I check for unauthorized transactions before paying my bill every month, I don't have much to worry about. Once, many years ago, someone emptied my checking account. I figured out what had happened and managed to convince my bank that the bank's own misguided security practice had allowed it to happen, but guess who bore the burden of a zero balance until that was resolved?

How can you protect yourself if you are a retailer or financial institution? This is a much more difficult problem. For starters, you should read Joshua Wright's article and the Visa bulletin. Josh has some nice things to say about my Project Ubertooth, but he also has some criticisms, mostly pointing out features yet to be developed. The first item on his wish list is frequency hopping, something I am working on now. He also points out the need to improve Bluetooth device fingerprinting, an area of research that has been advanced in recent years primarily by JP Dunning.

When I read about real life attacks on retailers and customers, sometimes I imagine how I could use technology to catch the crooks. Frankly, it would be hard, and it would be especially hard to deploy tools that would allow more investigators to do the same. Bad guys are using Bluetooth (and potentially other wireless technologies). We need Bluetooth tools for the good guys too.

I guess, if there is a lesson to be learned from all this, it is that hardware security matters. If an attacker can get in between a user and a system, the security of the system will fail in almost any case. Advocates of the Bring Your Pwn Device (BYOD) trend might want to pay attention. (That was an honest typo, but I decided to keep it!)


bluetooth said...

yes, even better for the bad guys is good for us.

0845 numbers said...

Bluetooth was invented for the convenience of many, not for the sake of few. Let's just be vigilant with our accounts.

Poker Online said...

This is a nice and informative, containing all information and also has a great impact on the new technology. Thanks for sharing it

Poker Online Terpercaya said...

Please visit guys. thanx you guys

Agen Poker said...

Nice post guys.

Judi Poker said...

have a nice days guys

Poker Online Indonesia said...

Happy Munday guys.

Agen Bola Terpercaya said...

nice posting Agen bola terpercaya

Agen Bola said...

nice article thank you.Agen Bola

bandar ceme online said...

Fantastic post.Really looking forward to read more. Much obliged.
bandar ceme
bandar ceme online
ceme online
situs bandar ceme
bandar ceme terpercaya

bandar ceme said...

bandar ceme
bandar ceme online
ceme online
situs bandar ceme
bandar ceme terpercaya

poker online
judi poker online
poker indonesia
situs judi poker
poker online terpercaya

dominohp said...

bandar q bandar qiu bandar kiu bandar ceme agen ceme agen bandar q bandar q online


Hello Bosku....!!
jangan Bilang Kalau Kamu Jago Bermain Poker Sebelum Bermain Di :
Jadi Tunggu Apalagi Ayo.. Bergabung & Rasakan Kesuksesan Bersama Kami.
Cukup hanya Satu ID kamu Sudah Bisa Memainkan 6 Permainan Sekaligus lho..

Jangan Anda Ragu.. ROBOT Ataupun Admin Ikut Bermain??
Tenang Saja Di sini.!! Di Gadispoker NO. 1 Terpercaya,
Murni Member VS Member, Fairplay.
Proses Depo / WD Super Cepat, Berapapun Kemenangan Anda Akan Dibayar!

Kami Juga memiliki Promo Menarik Khusus Untuk Member Setia Gadispoker.:
-Minimal Depo / Wd Hanya : 10000,-
-Bonus Deposit Setiap hari Untuk Para member.
-Bonus Refferal 15% Seumur Hidup.
-Bonus TO/Turn Over Up TO 0,3% - 0,5%

Kalian Juga Akan Di layani Dengan CS kami Yang ramah, baik dan Juga berpegalaman.
Selama 24Jam, Jadi Tunggu Apalag..
Ayo Bergabung Bersama Kami.

Untuk Info Lebih lanjut Silakan hubungi CS (custumer Service).
-Live chat ( )
-Whatsapp : +855966624192
-Skype : Gadispoker
-Yahoo : gadispokercs
-BBM : D87DB681
Hubungi Segera Dan Jangan Lewatkan Kemenanganmu..!

virginia veronica said...


DewaDominoQQ - Agen Poker & Domino Terbesar & Terpercaya Se-Indonesia.
Nikmati Bonus TO Setiap Hari & Referral Terbesar Seumur Hidup. Minimal DP & WD IDR 15.000.
100% Fairplay No Admins No Bots.
Kini kami menyediakan 7 Permainan yang dapat anda akses hanya dengan 1 ID.
Ayo Segera Join DewaDominoQQ.
LINE : dewadominoqq
WhatsApp : +85593827759
FanPage :
Twitter : @dewadominoqq

Jenny Wijaya said...

daftar sabung ayam s128
bluebet mobile
cbet bola online
download apk osg777

slot online joker123

Angel Laris said...

bandarq bandarq online poker online poker deposit pulsa boyaqq bandarqq