Bluetooth Data Exfiltration

Bluetooth tethering can be used to pair a network device with a cellular data path which bypasses your traditional network security. How do you detect when someone starts Bluetooth tethering in your building? How do you avoid false alarms when the Bluetooth is only being used to connect a headset? To learn more about detecting Bluetooth data exfiltration devices operating in your environment read our Bastille data sheets or request a Bastille demo.

Key Takeaways

• Bluetooth internet tethering lets a computer reach the public internet through a phone, bypassing corporate security checks
• Corporate infrastructure can block Wi-Fi hotspot connections but has no active countermeasure for Bluetooth
• This opens an unfiltered, unfirewalled path for exfiltrating sensitive information
• It is attractive precisely because the data never has to leave the building physically

Video Transcript

[MUSIC PLAYING] Hello. My name is Balint Seeber, and I'm the Director of Vulnerability Research at Bastille. I'd like to talk to you about Bluetooth data exfiltration. Usually within an organization or corporate communications infrastructure, you have Wi-Fi access points, and people will use those to connect to the corporate network, as well as potentially access the outside world.

To actually circumvent that, phones can be used in Bluetooth internet tethering mode, or with a normal hotspot that supports Bluetooth, such that you can connect your computer via Bluetooth and get out to the internet in a way that completely bypasses all the security checks that have been created by the IT infrastructure there.

So usually people might connect via Wi-Fi to their little hotspot device or to their telephone, and some corporate infrastructures actually prevent that from happening by delivering that connection as you attempt to connect to your device. With Bluetooth, there are no precautions and no active countermeasures that actually can detect it and deal with it.

So actually being able to connect through Bluetooth to one cellular data service and get onto the public internet that way, without any sort of firewalling or filtering, presents a risk where if people actually obtain sensitive information and they don't wish to carry it out physically. They can exfiltrate it via this mechanism. Thanks very much for listening. If you'd like to learn more, please visit our website. [MUSIC PLAYING] PLAYING]