# 25 Years of Bluetooth Technology
## 5 Bluetooth Security  
There are billions of Bluetooth devices in use today. These devices are exposed to different types of threats. Bluetooth security solutions need to constantly evolve to mitigate emerging threats. Similar to any other wireless communication systems, Bluetooth transmissions can be deliberately jammed or intercepted. False or modified information can be passed to the devices by malicious users. Security threats in Bluetooth can be divided into three major categories as follows [27]:  
* _Disclosure threat_: The information can leak from the target system to an eavesdropper that is not authorized to access the information. * _Integrity threat_: The information can be deliberately altered to mislead the recipient. * _Denial of Service (DoS) threat_: The users can be blocked from gaining access to a service by making it either unavailable or severely limiting its availability to an authorized user. Bluetooth devices are exposed to malicious intervention during the process of pairing with another device. These weaknesses are primarily due to flaws in the link key establishment protocol [27] which is required for devices to pair (i.e., establish a trusted relationship), and because session encryption is not mandatory. Therefore, attacks can occur prior to the completion of pairing. Link keys can still be sniffed after the pairing completes and used to perform illegal authentication or Man-in-the-Middle (MITM) attacks [27]. We present a summary of Bluetooth attacks below. * PIN cracking  
For data exchange between Bluetooth devices, trust has to be established between them. This process is known as pairing and is implemented by exchanging secret codes, often referred to as the Personal Identification Number (PIN). PIN length can be up to 8 bytes. Pairing is implemented in the following steps: Initialization, Link key Generation, Authentication, and Encryption. An attacker can eavesdrop the entire process of pairing and authentication and collect all the messages. The attacker can then use a brute force algorithm to identify the PIN used. If the device's Media Access Control (MAC) address is known, then by using a 128-bit guessed number, an accurate initialization key could be identified. The next step is to find the shared session link key by using all the collected data. Provided the data gathered is accurate, the PIN is determined without much effort. After cracking the pin, the attacker can pair with the target device and access information illegally [28]. Recently proposed security solutions that can mitigate intrusions related to pairing [27; 29] include the use of a combination of long public/private keys, which are harder to crack. * MAC spoofing  
Spoofing is done prior to encryption and when the piconet forms. Devices can authenticate each other by producing link-keys. While the attack is ongoing, attackers could impersonate an alternative client. There is a possibility for attackers to end connections or modify data during transmission utilizing certain hacking tools [29]. * Man-In-The-Middle (MITM) Attack  
The first MITM intrusion (Figure 11) was developed on the idea that the hackers are aware of the shared key used by the Bluetooth devices. It is also possible to get the link key by other methods such as eavesdropping and brute-forcing the PIN. A hack that utilizes manipulating the Bluetooth clock, involves devices that require the same hopping sequence on different clocks. A hack can be achieved by replying to the page request of the master device ahead of the slave. This restarts the paging with the slave using a different clock. MITM attacks can be launched during Secure Simple Pairing (SSP). One type of attack during the SSP process focuses on wrong data transmitted during the initial steps of SSP called the Input/Output (IO) phase in which devices that are interested in pairing perform an exchange of IO capabilities [30].