312-50 Question 385
Single answer▪ Bluetooth HackingDuring an authorized wireless assessment, you discover that several employees use legacy Bluetooth headsets and phones in a warehouse where devices are left in discoverable mode. The client wants you to demonstrate a realistic confidentiality risk without installing malware or modifying the devices. Which attack is the MOST appropriate to attempt first?
- A
Bluejacking to send unsolicited contact cards or messages to nearby discoverable devices
- B
Bluesnarfing to try to access data such as contacts or messages from vulnerable Bluetooth devices
- C
Bluebugging to remotely flash new firmware onto the phones over Bluetooth
- D
A deauthentication attack against the Bluetooth piconet to force devices to reveal WPA keys
Show answer and explanation
Correct answer: B
Explanation
The best answer is bluesnarfing because the scenario focuses on demonstrating a confidentiality risk against legacy, discoverable Bluetooth devices without changing device state or installing malware. In Bluetooth security testing, discoverable mode increases the attack surface by making devices easier to identify and target. Historically, vulnerable implementations of Bluetooth object exchange and related services enabled unauthorized retrieval of data from poorly secured devices. Bluejacking may show that a device is reachable, but it is primarily a message-pushing or social-engineering style nuisance rather than a data-exposure attack. Bluebugging is more intrusive and aims at unauthorized control, which is not the cleanest first demonstration for the stated objective. As a best-practice reference, assessors should align Bluetooth testing with authorized scope and use vendor documentation, Bluetooth SIG security guidance, and platform-specific advisories to verify whether legacy devices expose vulnerable services or weak pairing configurations.
- A. Incorrect.
Incorrect. Bluejacking involves sending unsolicited messages, typically business cards or text-like content, to discoverable Bluetooth devices. It demonstrates proximity and nuisance impact, but it does not primarily demonstrate unauthorized access to confidential data. In this scenario, the client specifically wants to show a confidentiality risk, so bluejacking is less appropriate than an attack aimed at data exposure.
- B. Correct.
Correct. Bluesnarfing is the unauthorized access or theft of information from a Bluetooth-enabled device, historically exploiting weaknesses in poorly implemented or vulnerable Bluetooth services and device configurations. In an environment with legacy devices left discoverable, this is a realistic first attempt to demonstrate confidentiality impact without modifying the devices. It aligns directly with the client's objective of showing exposure of sensitive data such as contacts, messages, or other accessible information.
- C. Incorrect.
Incorrect. Bluebugging refers to exploiting a vulnerable Bluetooth device to gain a higher level of control, such as issuing commands or using device functions without authorization. However, the option is incorrect because 'remotely flash new firmware' is not the defining or typical objective of bluebugging. It also goes beyond the client's request to avoid modifying devices and is not the most appropriate first choice when the goal is to demonstrate confidentiality risk.
- D. Incorrect.
Incorrect. A deauthentication attack is associated with Wi-Fi, not Bluetooth, and WPA keys are part of Wi-Fi security protocols rather than Bluetooth pairing mechanisms. Bluetooth uses different protocols, link keys, and pairing processes. This option reflects a common misconception of mixing 802.11 attack concepts with Bluetooth attacks.