Claudio Merloni: The BlueBag: a mobile, covert Bluetooth attack and infection device

Published: June 4, 2006, 11:10 p.m.

b'How could an attacker steal the phone numbers stored on your mobile, eavesdrop your conversations, see what you\'re typing on the keyboard, take pictures of the room you\'re in, and monitor everything you\'re doing, without ever getting in the range of your Bluetooth mobile phone?\\n\\t\\n\\tIn this talk we present a set of projects that can be combined to exploit Bluetooth devices (and users...), weaknesses building a distributed network of agents spreading via Bluetooth which can seek given targets and exploit the devices to log keystrokes, steal data, record audio data, take pictures and then send the collected data back to the attacker, either through the agents network or directly to the attacker. We show the different elements that compose the whole project, giving an estimate, through real data and mathematical models, of the effectiveness of that kind of attack. We also show what our hidden, effective and cool worm-spreading trolley looks like: say hello to the BlueBag!\\n\\t;-)\\n\\t\\n\\tClaudio Merloni, M.S. in Computer Engineering, has graduated from the Politecnico of Milano School of Engineering. Since 2004, he has worked as a security consultant for Secure Network, a firm specializing in information security consulting and training, based in Milan. His daily work is focused mainly on security policies and management, security assessment and computer forensics.\\n\\t\\n\\tLuca Carettoni is a Computer Engineering student at the Politecnico of Milano University. His current research and master\\u2019s degree thesis deals with automatic detection of web application security flaws. Since 2005 he has worked as a security consultant for Secure Network, a firm specializing in information security consulting and training, based in Milan. He is the author of several research papers, advisories and articles on computer security for Italian journals. His interests revolve around three attractors: web applications security, mobile computing and digital freedom."'