Building a dark piconet upon Bluetooth interfaces of computers

摘要

In this paper we demonstrate an attack scenario in which Bluetooth enabled computers are remotely controlled by an attacker without any security software detecting the connection. We describe in detail the methods to deliver malware, evade detection, elevate permissions, and transport critical information out of the network via Bluetooth connections. A prototype system using state-of-the-art operating systems and security software is built to show the practicability of the attack. We also study different mitigation strategies along with their downside. Security improvements for similar scenarios are also discussed.