312-50 Question 384
Single answer▪ Bluetooth HackingDuring an authorized wireless security assessment of a corporate office, you discover several employee headsets and smartphones operating over Bluetooth. The client wants to know whether any nearby devices are exposing identifying information that could aid targeted attacks or device profiling, but they do not want you to pair with devices or perform disruptive exploitation. Which action is the MOST appropriate first step to gather this information?
- A
Use a Bluetooth scanner to perform device discovery and enumerate visible details such as device name, MAC address, class, and available services from discoverable devices
- B
Launch a BlueBorne exploit against all nearby Bluetooth devices to determine which systems are vulnerable and extract their identifying information
- C
Initiate repeated pairing requests against each detected device so the assessment can capture trust relationships and user responses
- D
Use a Wi-Fi packet sniffer in monitor mode to capture Bluetooth beacon traffic and identify nearby Bluetooth devices
Show answer and explanation
Correct answer: A
Explanation
The best answer is to start with Bluetooth reconnaissance using a dedicated Bluetooth discovery/enumeration tool. In CEH-style assessments, Bluetooth hacking often begins with identifying nearby devices, collecting BD_ADDR values, device names, class-of-device information, and, when devices are discoverable and responsive, enumerating exposed services. This is the least intrusive way to understand the attack surface and supports later risk analysis without crossing into exploitation or pairing attempts. From a best-practice perspective, an ethical hacker should follow the rules of engagement and use the minimum level of interaction needed to meet the objective. Bluetooth security guidance and common assessment workflows distinguish reconnaissance from active attacks such as unauthorized pairing, brute-force attempts, or exploitation of vulnerabilities like those associated with BlueBorne. Therefore, discovery and service enumeration are the most appropriate initial actions in this scenario.
- A. Correct.
Correct. In a non-intrusive Bluetooth assessment, the appropriate first step is passive or minimally invasive reconnaissance. Using a Bluetooth scanner to discover nearby devices and enumerate information such as BD_ADDR/MAC address, device name, class of device, and, where permitted by the device state, available services aligns with standard Bluetooth reconnaissance practices. This helps identify exposed metadata useful for profiling without attempting pairing or exploitation.
- B. Incorrect.
Incorrect. BlueBorne refers to a set of Bluetooth attack techniques/vulnerabilities that can enable remote compromise on affected systems. Launching exploits is not an appropriate first step when the stated objective is only to identify exposed information and avoid disruptive activity. Exploitation would exceed the least-invasive approach and may impact device availability or integrity.
- C. Incorrect.
Incorrect. Sending repeated pairing requests is active interaction and can be disruptive, generate user prompts, and violate the client's stated constraint not to pair with devices. While pairing behavior can sometimes reveal security posture, it is not the best first step for simple identification and profiling.
- D. Incorrect.
Incorrect. Standard Wi-Fi sniffers in monitor mode capture IEEE 802.11 traffic, not Bluetooth traffic. Bluetooth uses different physical and link-layer protocols and frequency-hopping mechanisms, so a Wi-Fi packet sniffer is not the proper tool for Bluetooth device discovery.