CAPEC-666 BlueSmacking

An adversary uses Bluetooth flooding to transfer large packets to Bluetooth enabled devices over the L2CAP protocol with the goal of creating a DoS. This attack must be carried out within close proximity to a Bluetooth enabled device.

1. [Explore] [Scan for Bluetooth Enabled Devices] Using BlueZ along with an antenna, an adversary searches for devices with Bluetooth on. 2. [Experiment] [Change L2CAP Packet Length] The adversary must change the L2CAP packet length to create packets that will overwhelm a Bluetooth enabled device. 3. [Exploit] [Flood] An adversary sends the packets to the target device, and floods it until performance is degraded.

• The system/application has Bluetooth enabled.

• [Low] An adversary only needs a Linux machine along with a Bluetooth adapter, which is extremely common.

• Availability: Unreliable Execution, Resource Consumption

• Disable Bluetooth when not being used. • When using Bluetooth, set it to hidden or non-discoverable mode.