Bluetooth - Security - Snarf Attack

Contents 1 SNARF Attack 1.1 Potential Attacks 1.2 Defence 1.3 Criminals Motivation

SNARF Attack

The Snarf attack is a Bluetooth enabled hacking technique that allows hackers to access another Bluetooth device without the victims knowledge. This attack raises obvious concerns, similar to Bluejacking the attack gains access to the victims phone book, missed, received or dialled contacts. It is also possible for the attacker to use the phones commands through their own phone.

Although it is obvious that the Snarf attack reveals sensitive information, what is not so obvious is what other malicious attacks can be initiated through a snarf attack. The Snarf attack provides access to the victims AT-commands, in other words it allows the attacker to do the following.

Potential Attacks

Send SMS

Attackers are able to use the Bluetooth connection to send an SMS. This may be initiated to save on costs, or to undertake criminal activities.

Initiating a Phone Call

It is possible for to make a phone call to virtually any other phone number. Once again saving costs may be enough motivation for criminals to use this attack as some phone calls such as international calls can become quiet expensive. The attacker may also use the phone call for criminal activities.

Writing a Phone Book Entry

Writing a phone book entry is also possible with the Snarf attack. Attackers can delete, edit or add to the victim’s dialled number list, or phone book. This may seem placid in comparison to other attacks, but it is possible criminals may find a malicious reason for such an attack.

Defence

The only way to defend against the Snarf attack is to either turn Bluetooth off on the device, or to set it as invisible. Although this prevention is going to stop most attackers, there is software available that can penetrate Bluetooth invisible devices.

Criminals Motivation

The reasons a person may choose to initiate a Snarf attack are infinite. Identity theft using this attack appears to be the most attractive. If the attacker has access to a victims personal details through a mobile phone, and is able to use the phone from a remote location which poses obvious threats. Hansen (2003:01) said, "the typical identity thief initiates the crime by defrauding a mobile phone provider, and moves from there to establishing any number of fraudulent accounts with credit card companies, retailers and so on’. ‘The Identity Theft Resource Centre estimates that 700,000 consumers became victims of identity theft during 2002.’

Bluetooth- Security

--benhenzell 09:51, 29 Oct 2004 (EST)