CAPECattack pattern
CAPEC-668 Key Negotiation of Bluetooth Attack (KNOB)
High
Official page ↗
- Abstraction
- Standard
- Status
- Draft
- Likelihood of attack
- Low
- Typical severity
- High
- CAPEC version
- 3.9
Description
An adversary can exploit a flaw in Bluetooth key negotiation allowing them to decrypt information sent between two devices communicating via Bluetooth. The adversary uses an Adversary in the Middle setup to modify packets sent between the two devices during the authentication process, specifically the entropy bits. Knowledge of the number of entropy bits will allow the attacker to easily decrypt information passing over the line of communication.
Execution flow
1. [Explore] [Discovery] Using an established Person in the Middle setup, search for Bluetooth devices beginning the authentication process.
2. [Experiment] [Change the entropy bits] Upon recieving the initial key negotiation packet from the master, the adversary modifies the entropy bits requested to 1 to allow for easy decryption before it is forwarded.
3. [Exploit] [Capture and decrypt data] Once the entropy of encryption is known, the adversary can capture data and then decrypt on their device.
Prerequisites
• Person in the Middle network setup.
Skills required
• [Medium] Ability to modify packets.
Consequences
• Confidentiality: Read Data
• Confidentiality, Access Control, Authorization: Bypass Protection Mechanism
• Integrity: Modify Data
Mitigations
• Newer Bluetooth firmwares ensure that the KNOB is not negotaited in plaintext. Update your device.
Related
Att&ck technique · MITRE ATT&CK (1)
- T1565.002 Transmitted Data Manipulation sub-technique
Can precede · CAPEC (1)
- CAPEC-148 Content Spoofing attack pattern
Child of · CAPEC (1)
- CAPEC-115 Authentication Bypass attack pattern