Snippet 24: Bluetooth Denial of Service Attack (Bluetooth Low Energy)

Bluetooth denial of service does not require exotic tools: any Linux box that can scan can flood the 2.4 GHz band with inquiry packets, draining target batteries, drowning out legitimate requests, and degrading everything from Zigbee to Wi-Fi. This clip explains how the attack works and what the plain-text scan exchange reveals to defenders.

Key Takeaways

• Any Linux machine with a standard Bluetooth stack can generate persistent inquiry floods, with no CVE or special hardware required
• Floods run down device batteries, block legitimate connections, and degrade all 2.4 GHz services including Wi-Fi and Zigbee
• Bluetooth Classic’s 16-channel inquiry train behaves like a sweep jammer across the band
• BLE scan requests are sent in plain text, so defenders can see both the scanner and its target and spot devices being singled out

Video Transcript

Bluetooth denial of service attacks via inquiry flood. So this is a paper. There's actually no CVE associated with it. But it resonated with me because we've seen lots of inquiry packets in various installations, including our own. So you can check out the papers there. But the basic idea is that anybody with a Linux box or a Bluetooth stack that allows you to do scanning, either in Bluetooth, Bluetooth Low Energy, can put a lot of packets into the 2.4 spectrum very quickly and very persistently.

And so by putting all those packets into the spectrum, you can target devices and continuously inquiry them, inquire about their status that runs down their battery. That may prevent them from answering other requests from legitimate devices. It also can flood your 2.4 spectrum and render all other devices in 2.4 obsolete, everything from ZigBee to Wi-Fi. We've done that in our lab before.

If you just take a few Linux boxes and you run HCI's tool scan on loop, you end up putting so much energy in the spectrum that the other services in 2.4 start to degrade. And it's not hard to imagine why. I mentioned at the top that Bluetooth classic uses this 16 Channel Train. If anybody's ever done any electronic warfare work, this is called a trip jammer or sweep jammer. And this is just what's coming out of your consumer device.

So over time, every 600 microseconds, it's hopping channels and effectively blocking out, putting energy in all the channels in your spectrum. So you don't want many of these inquiry devices in your environment, and you certainly don't want them there persistently.

Another interesting note about this inquiry and pairing process from Bluetooth Low Energy is that in the exchange, what happens is as a device, a peripheral device is beaconing out its advertising address and a central device that wants to connect to that peripheral, then can send a scan addressing that device, specifically. So what's cool about this, this is all in plain text. So in Bastille, for instance, if you go look at a Bluetooth scan request packet, you'll see both the scanner address and the device that's being targeted.

So you can use this information to understand if certain Bluetooth devices in your environment are being targeted. And when they're targeted, the peripheral will do this or may do this response packet. And if it has to do that enough, it's wearing down its battery and it's keeping it from doing whatever it's supposed to be doing.