Nokia Admits Multiple Bluetooth Security Holes

An anonymous reader writes "Nokia has admitted that four of its handsets (6310, 6310i, 8910 and 8910i) have multiple security vulnerabilities that can allow an attacker to read, edit and copy the contacts and calendar entries using Bluetooth. This admission comes after a ZDNet UK article published earlier today. the spokesperson advises customers to switch off Bluetooth in public places!" For more information, see the bluesnarfing site pointed out by reader profet.

Great !

Great, not a single Mac OS X app can correctly address my 6310i, but Joe Random Hacker can? Urgh. I need to get my priorities straight.

Re:Great !

Go in to System Preferences, click Bluetooth applet, check "Support Non-Conforming Phones".

bluejacking

Old news. The concept of hijacking bluetooth links was first mentioned here [slashdot.org] back in November.

But I guess Nokia finally admitting they have an issue is interesting. I wonder what the other Bluetooth capable device manufacturers do about this???

Re:bluejacking

Bluejacking is just where you send a contact to available phones, and it just used to startle people. This is nothing to do with bluesnarfing which is the hacking/changing data!

No big deal

What's happening with Bluetooth happened with wireless networks.

What happened with wireless networks happened with anonymous ftp servers.

What happened with anon ftp servers happened with telnet access (you remember the "guest" login provided by most hosts ?).

Every time a new technology is used there are some flaws with it. No big deal.

Re:No big deal

What's happening with Bluetooth happened with wireless networks.
What happened with wireless networks happened with anonymous ftp servers.
What happened with anon ftp servers happened with telnet access (you remember the "guest" login provided by most hosts ?).
Every time a new technology is used there are some flaws with it. No big deal.

BIG DEAL!

You could expect that someone that designs a new communication protocol today builds on past experience. It's not like viruses, spam, malware and and crackers are something unknown. Instead, you should make the security requirements absolutely central in your new protocols. With the bluetooth technology becoming the most widespread wireless communications protocol (if you believe its proponents) not having security as a top priority is absofuckinglutely brainlessly idiotical.

Re:No big deal

Just to clarify, this article is about a problem in Nokia's implementation of Bluetooth, not necessarily a problem in the actual Bluetooth protocol/specification. As an analogy, we hear about security holes in IIS, Apache, OpenSSL, etc, but these do not necessarily indicate problems in the relevant RFC documents. At least, we can hope so ...

Re:No big deal

There are problems with Bluetooth by design. For one thing, no wireless protocol for interaction between devices can be truly secure unless peering requires physical contact between them (I place my phone next to my laptop, but the spook across the street has a directed antenna that is a thousand times stronger then the phone...)

It isn't like this hasn't come up before, Schneier predicted that Bluetooth would be a security nightmare three and a half years ago [schneier.com] ! Quoting:

What amazes me is the dearth of information about the security of this protocol. I'm sure someone has thought about it, a team designed some security into Bluetooth, and that those designers believe it to be secure. But has anyone reputable examined the protocol? Is the implementation known to be correct? Are there any programming errors? If Bluetooth is secure, it will be the first time ever that a major protocol has been released without any security flaws. I'm not optimistic.

And what about privacy? Bluetooth devices regularly broadcast a unique ID. Can that be used to track someone's movements?

The stampede towards Bluetooth continues unawares. Expect all sorts of vulnerabilities, patches, workarounds, spin control, and the like. And treat Bluetooth as a broadcast protocol, because that's what it is.

Hey, do you want....

a fresh list of emai^H^H^H^H telephone numbers so you can send your email marketing to?

K.I.S.S

Keep It Simple Stupid. Phones are tools. We don't "need" them to be fully featured akin a full OS. Today we have Bluetooth hole sin a few phones. What's next tomorrow on MSFT Smart Phones? Hackers turning in using your line to call 0900 numbers? People hacking your e-wallet? When it comes to commodity devices we should make sure they do reliably and securely work. I don't expect anything less.

Re:K.I.S.S

Think about the damages on windows PCs. Users are advised to keep their machines up to date and yet a significant proportion of them do not listen (want proof? Mydoom is now in version C and still taking hits at MSFTs website).

Your comparison with "their machines" and the phone firmware (essentially this is the phone "OS"), makes me think you believe that Windows Update can defeat MyDoom.

Actually, MyDoom has fuck all to do with keeping your Windows PC up to date. It is about keeping your _virus_ scanning up to date, and not running attachments that make it through to you. I could have just run and completed Windows Update, but still be infected with MyDoom via the very next email I received and (stupidly) ran the attachment of. Remember, virus scanning is NOT part of the Windows OS, it is something that must be loaded and configured and paid for (usually, unless you go with grisoft or similar).

Your point would be a lot better made if you referred to something like the Blaster or Nachi worm, where the fix was available via Windows Update for several weeks.

Is Bluetooth upgradeable?

Is Bluetooth upgradeable and How?

Re:Is Bluetooth upgradeable?

I had the firmware upgraded on my 6310i to resolve some bluetooth connection issues, and I imagine the whole stack is upgradeable in this manner.

I don't think the bluetooth protocol is broken - just the implementation.

Social science wonder?

These days we have all possible material about encryption available publicly. We have RSA, we have digital signatures, we have freely available software which can create perfectly encrypted material which would give bad headaches to the NSA if they had to crack it, even I can encode anything with gpg.
Yet, a mobile-phone giant does this. Are they just plain stupid, or is this another example of the wonders of social science? I can't help thinking how intelligent an ant nest can be though ants singularly are so stupid, and how an organization with some of the brightest engineers on the planet can act so carelessly.

hmm.. i wonder why????!

when things aren't built from the ground up with security in mind, there is likely to be some compromise for the sake of ease of use, when security issues come to mind. apart from the fact that any form of wireless communication is prone to be insecure! think about it.. ARGH THE GOVERNMENT IS LISTENING TO MY PHONE CALLS!!

Ingornace?

Bluetooth was built from the ground up with security in mind, obviously Nokia totally boggled this.

I wonder...

... if these are the only Nokia models which are affected by this vulnerability.

What about other models that have Bluetooth? Are they safe from this security hole?

Turn it off!

If you turn Bluetooth off, your're invulnerable and your batteries will last longer.

Big Woop.

No one wanders about with their phone whilst it is discoverable anyway.

Looked more like an attempt to get advertising for their hosting company to me.

I was interested to see the Z1010 on the list when the commercial version isn't out yet.

Unbelievable

I can't believe this, a company as big as Nokia making mistake as stupid as this ?

I thought most people would have learned something on the WiFi fiasco by now, especially Nokia (who also make security products such as firewalls by the way)

Now let's see if they're dedicated enough to their customers to fix this problem quickly.
In the meantime, it's good idea to keep this on the headlines of the media.

On another note, I'd be interested about other bluetooth-enabled devices - handsfree headset ? iPAQs? Palm? Sony Clies?

Re:Unbelievable

I can't believe this, a company as big as Nokia making mistake as stupid as this ?

I can. The mobile phone manufactures in general and Nokia in particular is very much focused on time-to-market. That means that their phones are not always finished when they hit the shelves. To be fair, neither was my Ericsson R520m phone when I first got it.

Solution: Employ Hackers

Some companies already do, I'd imagine, but surely the solution would be to employ - and pay decently - people who've highlighted vulnerabilities in previous products/systems to go at phones/etc like the clappers, trying to find any vulnerabilities. Granted, few products are going to be 100% secure but surely it'd be better than holes like this cropping up.

Irony

The ad I got on the page with that article...

Advertising nokia as a business mobility solution. Want to keep your business contacts a secret?

It could be a lot worse...

Except that Nokia have built Bluetooth support only into a limited number of phones, mainly those aimed at the "business market". For instance, my 6800 has almost every conceivable option but no Bluetooth.

I can't guess their reasons for not including Bluetooth with all their more expensive models, since it can't cost more than one Euro or so, but at least it means that of all the phones out there, relatively few are exploitable.

Re:It could be a lot worse...

This is exactly the reason why its such a big issue.

As an consumer, if you have a bluetooth phone all you are likely to have is the phone number of your friends.

As a geek, you are more than likely to have a PDA for keeping anything more detailed/sensitive.

Business users, executives etc. are more likely to use the advanced functions of there phones and therefore it is they that are most at risk to losing sensitive data.

So, whilst most models dont have bluetooth, the ones that do are the ones that are liekly to have the most valuable information.

Hah, I'm Safe!

Who'd want to hack an N-Gage?

Both ZDNET and Nokia wrong

You have to turn off bluetooth functionability to be safe..

Nokia is vunerabile to both having the device detect on and off in the hacks..

according to the bleustumbler.org site..

nokia is not the only one

Nokia is not the only phone maker with broken or stupid bluetooth implementations. Just look at the Siemens S55 which by default (when bluetooth is on) accpets any kind of files and saves them to your phones inbox. Also it has several bugs, like the Nokia. I'm have setup a small website (http://www.betaversion.net/btdsd/) with a currently very small list of bluetooth capable phones with there security settings and bugs. I tell you bluetooth will be real fun in the future :-)

What's the truth?

Interestingly from what I have read about the security vulnerabilities with the *five* models affected by this (Nokia 6310, 6310i, 8910, 8910i and 7650), Nokia has confirmed only that the 7650 has the problem. Also reported that some SonyEricsson phones would have similar vulnerabilities, but it was not stated which models. So, I take it that at least these five Nokia phones have the Bluetooth holes. But what is interesting is that different news-feeds report Nokia confirming/denying different models! What this really tells us that the writers of the news themselves are either: 1) Too lazy to look it up from Nokia itself. 2) Too naive to take some other newsfeeds info as a fact. 3) Too inexperienced to check the validity of the info. 4) Too ??? to ??? So, who made the mistake? ALL the "reporters" who did not check the validity of the news by themselves straight from the source.

Is Nokia the mobile Microsoft?

From the article: Nokia will not be releasing a fix for the devices in the near future because it said the attacks are limited to "only a few models" and it does not expect them to "happen at large".

Doesn't seem smart to me. Admit there is a vulnerability then say you aren't going to fix it. I'm surprised they didn't say the "fix" would be released in the next versions of the affected phones and customers would need to upgrade following their easy and costly upgrade path.

Of course a bulk enterprise license would cover any future upgrades but you would still have to buy a license for each phone call you make with the new phone.

Wireless is inherently insecure

I'm glad I still have my old 3210. As long as it continues to make a noise when someone dials it and transmit my voice and their voice in mutually opposite directions when answered, then I have no reason to replace it.

When you're sending data over the air, then you have no way of knowing who is listening. That's why my home LAN is wired -- so I at least know if anyone is tapping me, then they must be on the inside. And I wouldn't trust the phone companies to build in any kind of security either; MI5 would never let them get away with it. You should assume any part of the network you can't see is tappable if not actually tapped. The best form of telephone security is to keep all messages short and hope they aren't listening when you're speaking.

Not true - wires leak like hell

That's why my home LAN is wired -- so I at least know if anyone is tapping me, then they must be on the inside.

This isn't true -- you can pick up (copper) LAN signals from a reasonable distance, which is why the military always uses fiber outside of shielded environments. At least when sensitive data is expected to travel along the pipes.

The most obvious way to test this is to place an ordinary FM radio antenna along the network wire and see how much junk you are picking up; you can clearly hear the intensity of the network traffic.

I heard this traffic when sitting in my car in the company parking lot at one of my previous jobs and so knew when the builds were done.

Granted, the equipment is fairly expensive, but don't think for a second that you're safe because you're wired. Wires leak like hell.

Protected 6310

I think I hava 6310 from the first batch. Never bothered to flash it because I rarely use it.

This one does not have the vulnerability. You see, if you switch bluetooth on, the whole phone crashes immediately.

But I only just got it!

Great. Only Saturday I got my 7650 in a sale, and I bought it primarily for its bluetooth capabilities!

Well, I guess it was worth those 48 hours of carefree wireless toying...

So does that make it ...

Warphoning? Grossly overused prefix, but I'm surprised no one else has mentioned it.

I wonder how long it takes before people using voice dial find themselves calling Elbonia..

It's bad implementation, not specification

If nothing has changed since AL Digital released the it on bugtraq, then the most serious issues only affect phones that have previously been paired with the attacking Bluetooth device.

This means that you have to have given the attacker access to privileged services at one point in time, and then deleted him.

If you had not deleted him, he would obviously still have access.

But it is the missing deletion that is the problem.

You should not pair your device with any devices except your own. Your PDA requires to be paired with your Phone, Laptop, and access point, so it can dial up, synch, and have LAN access etc. But you don't have to pair it to send your business card to somebody else. There is no reason to pair with Joe Hackers device. So for most of the cases described by AL Digital it is just a bad implementation which does not affect the majority of users.

For the rest of the cases it is also a bad implementation by Nokia and "possibly other manufacturers", it is not a vulnerability in the protocol.

From the article...

According to the AL Digital's bluestumblerWeb site, vulnerable phones include: Ericsson T68; Sony Ericsson R520m, T68i, T610 andZ1010; andNokia 6310, 6310i, 7650, 8910 and 8910i.

Well that is just about all of the bluetooth phones out there then?

Bluetooth and the Nokia 6310i

If you Google for the above, you'll find that Nokia's implementation of Bluetooth on this phone has been absolutely horrendous. Nokia is phasing out / has phased out the 6310i in the US and I managed to snag one on closeout at the AT & T Wireless Store for $29.95! I picked it because it had Bluetooth and because it was also the only US-sold phone that worked with a very cool car stereo handsfree kit made by Alpine (integrated Caller ID on the radio display, etc.) But apparently their implementation of Bluetooth only works with the Nokia Bluetooth Adapter (which of course costs twice as much as "generic" adapters like my D-Link). So I called the Nokia service center and arranged to send my phone in to get the firmware updated. I got it back about a week and a half later, and although they had updated the firmware the Bluetooth connection between my PC and the phone *still* wouldn't hold when trying to start up the Nokia PC Suite software! I gave up, bought the serial cable for $15 on eBay and had my contacts synced to my phone inside of 10 minutes. Other than the (lack of) Bluetooth support, I love the phone. The battery life is especially outstanding, and since they've started to phase it out, you can pick up the accessories on eBay for very cheap.

that explains why...

...Whenever I try to open a text message from a friend, I get some message trying to sell me cheap Viagra knockoffs...

A "Microsoft" -like reply from Nokia

Dear Nokia customers,
Due to the latest security problems involving our phones and Bluetooh, we recommend you write your complete address book and contacts on a piece of paper and store it in a safe place. Also, since our phones explode [theregister.co.uk] it is best that you stay more than 10 feet away from them at all times. This will ensure both safety of your information on the phone and yourself.

well....

well as soon as I can get a "normal" (1) phone with Bluetooth out here in the States, I'll worry about it.

Winton

(1) Normal -> one with out a 15" color screen, video camera and gamepad attached.

Sony Ericsson models vulnerable, as well as Nokias

Submitted yesterday to Slashdot at 1200 PST, filed in a locked cabinet in the basement lavatory with a sign stating "BEWARE OF THE LEOPARD" was this posting:
http://groups.google.com/groups?&selm=40 27ef9a.155 09562%40news.individual.de

AL Digital
http://www.aldigital.co.uk/
announced Nokia 6310, 8910 and 8910i mobiles were found to be at greatest risk to having their data copied without the owner's consent with a crack attack over Bluetooth.

The security papers (links, below) suggest keeping some other models of Bluetooth-capable mobiles 'invisible' to other devices may prevent data within the phone from being copied with a 'SNARF attack.' At worst, ony the data within the phone itself could be abducted, so if you don't keep data in it, and instead keep data within a PDA or notebook, the risk to you is low.

Yeah, welcome to the 21st century.

However, the authors apparantly got the brush from Sony-Ericsson, Nokia and the Bluetooth standards body when they raised the issue, so further
attention seems merited.

http://www.commsdesign.com/showArticle.jhtml?art ic leID=17601809
http://www.bluestumbler.org/

The latter URL has a number of references and leads to web pages for the cracking software cited, and it looks like AL Digital may have done their homework.

OwN3D ???

Damn it... What the hell does this mean ?
U R OwN3D - R00t
This is what my poor Nokia has been displaying for the past four days :(

nokia has any vulnerabilities?

nokia handsets have any vulnerabilities?? What a surprise! Wake me when Motorolas will have any.

For all the history all of Nokia hardware, both wireless radiolinks and consumer electronics, was ultracrappy and vulnerable to anything, even failing when not in use :)

Just avoid buying crappy things, and will be in safety.

To those who want to argue - buy ms windows, get on ms .NET, use outlook and explorer and acess your Nokia and pocket pc trough ms briefcase-synchronise-alike tools. All of the mentioned things have proven to be 100% unreliable, vulnerable, clumsy and sometimes dangerous to business of safety/health.

Re:Important note:

most people would probably be better off without the wheel.. but try telling them..

Re:Important note:

Well I could carry:

pocket phone book
diary
electronic game
alarm clock
laptop for connecting to the net

any other odds and sods, but if they are all in one thing, its lighter on my pockets.