2 Flashcards by Kameron Cooks

Bluetooth classic
Frequency:
Modulation:
Channel #:
H/S:
Data Rate:
Range:
Payload:

2.4Ghz
FHSS
79 Channels
1600
3 mbps
10-100 m
none

How well did you know this?

Not at all

Perfectly

What is the difference between Bluetooth smart and Bluetooth ready?

Smart - Can only connect to devices with Bluetooth low energy mode
Smart Ready- can connect too both new and old bluetooth

How well did you know this?

Not at all

Perfectly

Bluetooth low energy
Frequency:
modulation:
Channels? How many are data transfers and BD_ADDR advertisments?
H/S:

2.4 Ghz
FHSS
40, 37 tx, 3 adver
100 h/s

How well did you know this?

Not at all

Perfectly

BLE ver4.0-4.2
Data rate:
Range:
Payload:

1 mbps
10m
2-39 bytes

How well did you know this?

Not at all

Perfectly

BLE ver 5.0-5.2
Data Rate:
Range:
Payload:

2 Mbps - 20 m or 40m -1 mbps
2 - 257 bytes

How well did you know this?

Not at all

Perfectly

What does Bluetooth Low energy do for security?

Will send out a randomized BD_Addr in order to prevent location tracking

How well did you know this?

Not at all

Perfectly

Why is exploiting BT difficult?

Use of FHSS; based on a secret value
standard equipment doesn’t support

How well did you know this?

Not at all

Perfectly

What is it called that determines the hopping pattern of BT classic?

How long before it resets?

What are the two components its made of?

Pseudorandom hopping pattern

23 hours

Master Mac
Clock value

How well did you know this?

Not at all

Perfectly

What is the relationship within a piconet?
How many devices in total/different types?

Master-Slave
1 master, 7 slaves, 8 in total

How well did you know this?

Not at all

Perfectly

What are the two devices discovery modes? And what are there characteristics?

Discoverable:
Responds to Inquiry scans with inquiry response

Non-Discoverable
cannot make new connections, dosen’t respond to inquiry scans. Can still react w/ devices they have previously interacted with

How well did you know this?

Not at all

Perfectly

What is a BD_ADDR?

48-bit mac address of a bluetooth device

How well did you know this?

Not at all

Perfectly

What parts make up the BD_ADDR?
SB:CD:DE:12:34:56

SB:CD - NAP Non-significant address part
First sixteen bits of BD_ADDR

DE - UAP Upper-address part
Last 8 bits of the oui

12:34:56 - Lower-address part
last 24 bits of the MAC address

How well did you know this?

Not at all

Perfectly

When is a BD_ADDR sent over the air?

Only when a device is in discoverable mode and never in the layer 2 header

How well did you know this?

Not at all

Perfectly

What are the characteristics of the Host in a Bluetooth Protocol stack?

-Computer
-soft-ware based
-upper-layer protocols
- Profiles are stored here
- easily accessible to developers

How well did you know this?

Not at all

Perfectly

What are the characteristics of the Host Controller Interface (HCI) in a Bluetooth Protocol stack?

Communication link b/w the host layer and the controller layer, *Last layer easily accessible by developers

How well did you know this?

Not at all

Perfectly

What are the characteristics of the Controller (dongle) in a Bluetooth Protocol stack?

-hardware-based
-comes from a manufacturer
- encryption and authentication
- not accessible to developers

How well did you know this?

Not at all

Perfectly

What is a Bluetooth Profile?

Define additional functionality w/ a BT device, In order for a BT device to use certain functionality they must be operating the same profile

How well did you know this?

Not at all

Perfectly

What are the two types of authentications within BT?

Traditional pairing
Secure Simple Pairing

How well did you know this?

Not at all

Perfectly

What is the Link Key made of in a traditional pairing?

What can be found during the initial pairing of a device

What is traditional pairing vulnerable too?

BD_ADDR
PIN
Random #s

Random #s

pin attacks

What is the Link Key made of in a secure simple pairing

Is it vulnerable to pin attacks? Why or why not?

ECC w/the Diffie Helman key exchange

No, because it isn’t used in the creation of the key. Preventing man-in-the-middle attacks

Bluetooth Power classes
What is the power/range of class 1?

100 mw 100m

Bluetooth Power classes
What is the power/range of class 1.5?

10 mw 20m

Bluetooth Power classes
What is the power/range of class 2?

2.5mw 10m

Bluetooth Power classes
What is the power/range of class 3?

1mw 1m

When trying to find the BD_ADDR what are the methods to do so?

1. Active Discovery - Scanning inquiry response 2. Passive Discovery - looking for label that has BD_ADDR 3. Hybrid Discovery - off by one method, looking at last byte of a wifi mac address and adding or subtracting one the last value too guess the BD_ADDR 4. Traffic Analysis- reconstructing the BDR_ADDR from a BT frame, taking the LAP from the Sync word which comes from the Access code and the UAP from the frame size fo the payload

When trying to exploit BT Classic pin attacks what's the order?

Scan and recon for BD_ADDR using AD, PD, HD, TA > Get BD_ADDR from Inquiry Response > Brute Force PIN > get the link key

What is the repairing exploit in BT?

Disconnect Bluetooth devices to force them into another session and get another opportunity for an inquiry response

What is the vulnerability of Bluetooth low energy ver 4.0-4.2?

A weak temporary key

What is the Device Identity Manipulation?

-Happens before A connection - Changing class information too bypass any connection restrictions

What exploit is abusing profiles

Happens after a connection - takes advantage of a preloaded profile for uses it was not designed for

RFID Communication: Frequencies(3): Componenets(3):

Simplex "one way" Low, High, Ultra High Reader/Interrogator Antennae Tag

Within RFID what is the difference between an active and passive tag? Active: Power source? Transmit capable? range? Devcies? Passive Power source? Transmit capable? range? Devcies?

Active: Power source transmits 300 ft Transponder: transmits when interrogated Beacon: Transmits periodically Passive: No power Source Can't transmit can be read 30 ft

What are the security concerns of RFID?

Skimming, tag data manipulation, jamming

NFC Communication: Freq: Data Rate: Range: Components

Simplex, Half-duplex, and full duplex 13.56 MHz 424 kbps 4cm-10cm initiator, target

What NFC mode of operation emulates a physical card?

Card emulation

What NFC mode of operation allows interaction w/an information source

Discovery

What NFC mode of operation has two NFC enabled devices to communicate directly to each other.

Perr-to-Peer communication

NFC Security?

Skimming Tag manipulation jamming

ZigBee Layer 1 and Layers 2: Layer 3 and Layer 4: Frequency: Data rate: Range: Toplogies: max # of hops: max # of nodes:

IEEE 802.15.4 ZigBee 2.5GHz 250kbps 10-20m between nodes star, tree, or mesh unlimited 65,535

ZigBee device types: __________ Trust center, can only be 1 in the network, All keys are unique and stored here

ZigBee Coordinator (Zc)

ZigBee device types: ____________ - forwards traffic

Zigee Router (ZR)

ZigBee device types: _____________ - can only communicate w/ a zigbee coordinator for a ZigBee Router. No perr-to-peer communication

ZigBee End Device (ZED)

What are 2 security models of Zigbee?

Centralized - unique keys, (Zc) Distributed - identical keys (no Zc)

What are the two security modes of ZigBee?

High Security- Enterprise Standard - Residential

Zwave Layer 1 and Layer 2: Layer 3 and 4: Frequency: data rate: Range: Topologies: max # of hops: max # of nodes:

ITU-T Rec. G.9959 Zwave Sub-1 GHz 100 kbps 100m b/w nodes mesh only 4 232

What is Zwave security charecxteristics?

Zsnare downgrade S2 > S0 -optional encryption is Zwaves biggest threat