This is an old revision of the document!


Bluetooth and its problems

Within Hyperbola Bluetooth is not included since the release of Milky Way v0.4. As technology standard for short-range wireless connection there are too many risks for stability and security, besides that there are no real community-driven implementations for GNU/Linux available and the support for our own HyperbolaBSD is also not given on a solid base.

About Security Risks

There are a variety of attack types which can be launched against bluetooth devices.

Attackers can capture the traffic between two devices (steal the data shared between the devices). This data can be exploited for mobile spying purposes, or for example, to steal the authentication data from a bluetooth authenticating device or hardware. This type of attack, called BlueSnarfing, is especially dangerous when the traffic isn’t encrypted.

Other types of attacks can terminate your battery, disable your Bluetooth device, or introduce information into the victim’s mobile, such as contacts.

The most common and safest prevention measure is to keep the bluetooth service disabled when unnecessary. When Bluetooth as interface and connection is enabled, an attacker only needs to come near the potential victims and execute a vulnerability scan to discover the vulnerable devices or traffic.

One of the most popular tools that the hackers use to find the unsecure traffic or devices to attack is BlueDiving, which additional to vulnerability discovery functionalities. It also includes exploitation codes or programs to run the attacks. In other words, an attacker only needs to be near you 10 meters to hack you.

The only way for potential victims to avoid getting scanned is to keep the bluetooth service turned off. This is actually the only safety measure which can guarantee security.

While many experts recommend the additional tips like identifying the pairing devices to make sure that these are the devices that the users want to connect, regular users can’t realize if the traffic between both devices is being sniffed (spied).

The second important security measure if the user must enable the bluetooth service is to make sure that the connectivity takes place in a solitary environment, without nearby people, since the attackers need a relatively close distance to proceed. Only if you are a coveted target, you may worry about long distance bluetooth attacks (called Bluesniping ) which are launched with special hardware and are not common at all.

Attack Types

Preventing Security Risks

To prevent all the possible scenarios and security-risks mentioned the further decision for the Hyperbola-project was and is to completely remove all components, including all possible services and applications with also to disable the corresponding interfaces while building the packages. Hyperbola won't receive further support for Bluetooth for now or in the upcoming future: Vulnerabilities are periodically discovered and solid security measures were incorporated only in latest versions of Bluetooth while ignoring older devices and implementations, which is in fact absolutely not acceptable.