CAPEC-666: BlueSmacking
Description
An adversary uses Bluetooth flooding to transfer large packets to Bluetooth enabled devices over the L2CAP protocol with the goal of creating a DoS. This attack must be carried out within close proximity to a Bluetooth enabled device.
- Likelihood of attack
- Medium
- Typical severity
- Medium
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Abuse Existing Functionality
Prerequisites
- The system/application has Bluetooth enabled.
Skills required
- LowAn adversary only needs a Linux machine along with a Bluetooth adapter, which is extremely common.
Consequences
- Availability
Unreliable Execution; Resource Consumption
Mitigations
- Disable Bluetooth when not being used.
- When using Bluetooth, set it to hidden or non-discoverable mode.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 2 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-ISVAInbound Session Volume Analysis2 shared
- D3-ITFInbound Traffic Filtering2 shared
- D3-APCAApplication Protocol Command Analysis2 shared
- D3-CSPPClient-server Payload Profiling2 shared
- D3-NTCDNetwork Traffic Community Deviation2 shared
- D3-NTFNetwork Traffic Filtering2 shared
- D3-NTSANetwork Traffic Signature Analysis2 shared
- D3-PHDURAPer Host Download-Upload Ratio Analysis2 shared
- D3-PMADProtocol Metadata Anomaly Detection2 shared
- D3-RTSDRemote Terminal Session Detection2 shared
- D3-UGLPAUser Geolocation Logon Pattern Analysis2 shared