An adversary uses Bluetooth flooding to transfer large packets to Bluetooth enabled devices over the L2CAP protocol with the goal of creating a DoS. This attack must be carried out within close proximity to a Bluetooth enabled device.
Description
Attack Execution Flow
3
1
Step 1
Explore[Scan for Bluetooth Enabled Devices] Using BlueZ along with an antenna, an adversary searches for devices with Bluetooth on.
Note the MAC address of the device you want to attack.
AI Translation
[Scansiona dispositivi Bluetooth abilitati] Utilizzando BlueZ insieme a un'antenna, un adversary cerca dispositivi con Bluetooth attivo.
Annota l'indirizzo MAC del dispositivo che desideri attaccare.
Attack Techniques
-
Note the MAC address of the device you want to attack.
2
Step 2
Experiment[Change L2CAP Packet Length] The adversary must change the L2CAP packet length to create packets that will overwhelm a Bluetooth enabled device.
An adversary downloads and installs BlueZ, the standard Bluetooth utility package for Linux.
AI Translation
[Modifica della lunghezza del pacchetto L2CAP] L'attaccante deve modificare la lunghezza del pacchetto L2CAP per creare pacchetti che sovraccarichino un dispositivo Bluetooth abilitato.
Un attaccante scarica e installa BlueZ, il pacchetto di utilità Bluetooth standard per Linux.
Attack Techniques
-
An adversary downloads and installs BlueZ, the standard Bluetooth utility package for Linux.
3
Step 3
Exploit[Flood] An adversary sends the packets to the target device, and floods it until performance is degraded.
AI Translation
[Flood] Un avversario invia i pacchetti al dispositivo target e lo inonda fino a compromettere le prestazioni.
Mitigations
2
Disable Bluetooth When Not Being Used.
When Using Bluetooth, Set It To Hidden Or Non-Discoverable Mode.
Consequences
Security Scopes Affected
Availability
Potential Impacts
Resource Consumption
Unreliable Execution
Indicators
1
Performance is degraded or halted by incoming L2CAP packets.
Relationships
Parent CAPECs
Related ATT&CK Techniques
2
T1498.001
Direct Network Flood
Adversaries may attempt to cause a denial of service (DoS) by directly sending a high-volume of network traffic to a …
T1499.001
OS Exhaustion Flood
Adversaries may launch a denial of service (DoS) attack targeting an endpoint's operating system (OS). A system's OS is responsible …