Bluetooth OOB channel security

BR/EDR

BLE

In Bluetooth, it is necessary to establish a shared link key between two devices to authenticate them and encrypt communications. Pairing introduces both devices to each other and generates this shared key through different methods. Some devices use out of band (OOB) data, exchanged through external technologies such as NFC or Wi Fi.

Through an OOB mechanism, each device exchanges the identification data required for authentication, functioning similarly to a manual PIN exchange. Once this data is exchanged, the pairing is considered protected against MitM attacks, assuming the OOB channel is secure. However, if the OOB communication method is not properly protected against sniffing, an attacker may capture the exchanged data and compromise the pairing. The verification method for this control depends on the specific OOB mechanism used.

Description

A capture of a device’s pairing/announcement data must be performed to verify that a device wishes to use OOB data for pairing.

If this is the case, it is necessary to analyze the external channel to be used for data exchange. During this analysis it must be checked that the channel used is confidential.

Example case

A device can share, through an out-of-band (OOB) procedure, the necessary data for establishing a connection with another device. These data must conform to the format specified by the Bluetooth standard.

We will use Wireshark with BTVS (btvs.exe -Mode wireshark) to capture packets for analysis.

When negotiating a connection, the Pairing Request or Pairing Response command has a field called OOB data, which can have two values:

When the device has a value of 0x01 (Data Present), the OOB data exchange mechanism must be audited to ensure that it is carried out securely, usually via WiFi or RFID.

Related resources

To check this control, the following resources may be useful: