CAPEC-667 — Bluetooth Impersonation AttackS (BIAS)
CAPEC-667: Bluetooth Impersonation AttackS (BIAS)
MITRE CAPEC attack pattern
| Status | Draft |
| Typical severity | High |
| Likelihood of attack | Medium |
| Catalogue | CAPEC 3.9 (2023-01-24) |
Description
An adversary disguises the MAC address of their Bluetooth enabled device to one for which there exists an active and trusted connection and authenticates successfully. The adversary can then perform malicious actions on the target Bluetooth device depending on the target’s capabilities.
Where this sits in the chain
A finding maps to a weakness (CWE), a weakness is exploited by an attack pattern (CAPEC), and an attack pattern shows up in ATT&CK as observed adversary behaviour. This page is the middle hop.
Weaknesses exploited: CWE-290
Prerequisites
- Knowledge of a target device's list of trusted connections.
Skills required
- Low: Adversaries must be capable of using command line Linux tools.
- Low: Adversaries must be in close proximity to Bluetooth devices.
Consequences
- Integrity: —
- Confidentiality: —
Mitigations
- Disable Bluetooth in public places.
- Verify incoming Bluetooth connections; do not automatically trust.
- Change default PIN passwords and always use one when connecting.