Hacker News Reader

Comment by filleokus | Hacker News Reader

Haven't worked my way all through the paper yet. But is it correct that an attacker can perform this attack to something like a keyboard that has been previously paired and everything? What kind of user "interaction" would be required? Will the OS re-pair the device and (possibly) notify the user?

This seems really powerful and dangerous. Probably not that many people who uses laptops and BT keyboards, but many of the iPad keyboard covers uses bluetooth.

View on HN

Not a Bluetooth expert and I might have misunderstood the paper but it seemed like it can be done any time two devices initiate a new connection (not when they're paired but anytime they start communicating). AFAIU, it's a firmware level hack so not something you can do with standard Bluetooth functionality. You need to be able to get a custom firmware into the Bluetooth chipset to carry off an attack.

I presume that you could pull it of with a SDR.

Good question. Can the attacker force an existing paired device to re-negotiate the pairing process, or is this attack only viable against devices that have not yet paired?

I think an attacker can disrupt already existing connections causing them to reconnect but if they try to re-pair then operator interaction would be required.

I think that this attack only works when the encryption is being negotiated, which is usually when the connection is made (you can do it later, or redo it at any time)

Reply on news.ycombinator.com