312-50 Question 386
Single answer▪ Bluetooth HackingDuring an authorized wireless security assessment of a corporate office, you discover several employee Bluetooth headsets and smartphones in discoverable mode. The client wants to know which technique represents a realistic confidentiality risk from misconfigured Bluetooth devices without requiring prior pairing or physical access. Which action should you report as the most relevant attack scenario?
- A
Perform bluesnarfing against vulnerable devices to attempt unauthorized access to stored data such as contacts or messages
- B
Use bluejacking to silently install a persistent backdoor application on the target smartphone over OBEX
- C
Exploit Bluetooth to bypass disk encryption and extract files directly from a powered-off laptop
- D
Use bluesmacking to gain interactive shell access on the smartphone through malformed L2CAP packets
Show answer and explanation
Correct answer: A
Explanation
The best answer is bluesnarfing because it maps to a realistic confidentiality impact: unauthorized retrieval of information from vulnerable Bluetooth devices. In contrast, bluejacking is primarily unsolicited message delivery, not remote malware installation. Bluesmacking is associated with denial of service, not command execution. When evaluating Bluetooth risk in CEH-style scenarios, candidates should distinguish between attack classes by impact: confidentiality (bluesnarfing), nuisance/social engineering (bluejacking), and availability disruption (bluesmacking). In practice, assessors should verify Bluetooth device mode, exposed services, pairing requirements, and firmware patch level. Bluetooth SIG guidance and vendor security advisories consistently emphasize disabling discoverable mode when unnecessary, enforcing authenticated pairing, and applying firmware and OS updates to mitigate known Bluetooth weaknesses.
- A. Correct.
Correct. Bluesnarfing is a recognized Bluetooth attack in which an attacker exploits weaknesses in Bluetooth implementations or exposed services to gain unauthorized access to data on vulnerable devices. Historically, affected devices could expose items such as contacts, calendars, messages, or other stored information. This is a direct confidentiality risk and fits the scenario of discoverable or otherwise poorly configured Bluetooth devices during an assessment.
- B. Incorrect.
Incorrect. Bluejacking typically involves sending unsolicited messages, usually via Bluetooth business cards or similar object exchange mechanisms. It is generally considered a nuisance or social-engineering vector rather than a method for silently installing persistent malware or a backdoor. Confusing bluejacking with code execution is a common misconception.
- C. Incorrect.
Incorrect. Bluetooth attacks do not allow an assessor to bypass full-disk encryption on a powered-off laptop and directly extract files in this way. If the system is powered off and encrypted, Bluetooth is not a realistic path to recover protected data. This option overstates Bluetooth capabilities and mixes unrelated attack concepts.
- D. Incorrect.
Incorrect. Bluesmacking is a Bluetooth denial-of-service technique that abuses L2CAP echo requests with oversized packets to overwhelm a target device. Its purpose is service disruption, not obtaining interactive shell access. This distractor is plausible because it references a real Bluetooth attack, but the impact described is inaccurate.