Bluetooth Tethering Discovery with Bastille

Balint Seeber of Bastille shows how to detect Bluetooth tethering, where an employee pairs a laptop to a phone over Bluetooth to reach the internet and bypass corporate Wi-Fi controls and firewalls. Corporate access points can block a Wi-Fi hotspot with a deauth event but speak only Wi-Fi, so they miss Bluetooth tethering entirely; Bastille sensors receive Bluetooth and alert and localize the event.

Key Takeaways

• Bluetooth tethering lets a laptop reach the internet through a phone, bypassing corporate Wi-Fi controls and firewalls
• Corporate access points can deauth a Wi-Fi hotspot but speak only Wi-Fi, so Bluetooth tethering goes unseen
• Bastille sensors receive Bluetooth and detect the tethering event
• The event can be alerted and localized so security can contain it

Video Transcript

Hello, my name is Balint Seeber, and I'm the director of vulnerability research at Bastille. I'd like to show you how you can use the Bastille solution to detect Bluetooth tethering. In this scenario, we have an employee, maybe a disgruntled employee, that's trying to connect their laptop to their mobile phone and thus gain access to the internet. There may be existing corporate Wi-Fi infrastructure in place. There may be firewalls that would prevent employees from accessing any website they like.

Or they might want to do this secretively in case it's some sort of sensitive information they're trying to exfiltrate. Now, in an environment where you have corporate modern access points, somebody may wish to turn their mobile phone into a hotspot, and then associate their laptop with the access point that their phone is now broadcasting as.

When they attempt to connect their laptop to this hotspot, the existing corporate APs, access points, will detect this association event, and then send their own de-authorization event that will prevent this connection from completing, therefore preventing anybody from connecting to their own access point. Many modern smartphones, though, allow you to also connect to the internet through Bluetooth tethering. In this instance, the laptop and the phone will be paired via Bluetooth, and then you would initiate the internet connection.

They will then communicate Bluetooth between the two devices, and the phone will then enable access to the internet. And so the employee now has unrestricted access and can send or receive any information they wish. The access points speak only Wi-Fi so they wouldn't be able to detect this Bluetooth event. However, with the deployment of the Bastille sensors, they are able to receive Wi-Fi, Bluetooth, and many other different protocols. In this instance, they would actually receive the Bluetooth traffic and detect that tethering has taken place.

If this is not desired within this office, then an alert can actually be thrown, and security personnel will be notified that a tethering event has taken place, and they can use that information to try to contain the situation. It's possible to actually localize this as well within the Bastille user interface, to aid in figuring out the rough area where this tethering event may have actually taken place. This is a very novel and new technique that's part of the Bastille solution. So to learn more information about this, please visit our website.

[MUSIC PLAYING] PLAYING]