2 cissp ® Official Study Guide Eighth Edition

Bluetooth (802.15)
Bluetooth
, or 
IEEE 802.15
, 
personal area networks (PANs)
are another area of wireless 
security concern. Headsets for cell phones, mice, keyboards, Global Positioning System 
(GPS) devices, and many other interface devices and peripherals are connected via 
Bluetooth. Many of these connections are set up using a technique known as pairing, where 
the primary device scans the 2.4 GHz radio frequencies for available devices, and then, 
once a device is discovered, a four-digit PIN is used to “authorize” the pairing. This pro-
cess does reduce the number of accidental pairings; however, a four-digit PIN is not secure 
(not to mention that the default PIN is often 0000). In addition, there are attacks against 
Bluetooth-enabled devices. One technique, known as bluejacking, allows an attacker to 
transmit Short Message Service (SMS)-like messages to your device. Bluesnarfing allows 
hackers to connect with your Bluetooth devices without your knowledge and extract infor-
mation from them. This form of attack can offer attackers access to your contact lists, your 
data, and even your conversations. Bluebugging is an attack that grants hackers remote 
control over the feature and functions of a Bluetooth device. This could include the ability 
to turn on the microphone to use the phone as an audio bug. Fortunately, Bluetooth typi-
cally has a limited range of 30 feet, but some devices can function from more than 100 
meters away. Bluetooth radios and antennas are classified by their maximum permitted 
power. The classes are shown in Table 11.11.
TA b l e 11.11
Classes of Bluetooth devices
Class
Maximum permitted power
Typical range
1
100 mW
100 m
2
2.5 mW
10 m

---

Cabling, Wireless, Topology, Communications, and Transmission Media Technology