Major security hole in WM5, WM6 bluetooth stack

January 20, 2009 | By Surur

Security Researcher Alberto Moreno Tablado has discovered a major hole in the bluetooth stack of Windows Mobile 5.0 and Windows Mobile 6.0 phones.

Apparently the weakness is in the bluetooth FTP service, which allows another authorized and paired bluetooth device to browse specific specified directories on your Windows Mobile phone. This can be very useful for copying files to and from your smartphone from your desktop for example wirelessly.

Unfortunately it seems the service has a Directory Transversal Vulnerability, meaning an attacker does not have to be confined to the specified and safe directories, but can break out of the sandbox and copy files to and from anywhere on your smartphone.

Alberto gives the example of copying the PIM.vol file from the root of your device, meaning the attacker now has your all your contacts, calender and tasks, or being able to place a trojoan.exe in your \windows\startup directory.

Microsoft has just been notified of the issue, and has as of this writing not responded to Alberto yet.

Currently there no known patch, and Alberto has not tested Windows Mobile 6.1 to see if its vulnerable yet, but given the similarities of the versions this is quite likely. The only mitigating factor for now is that only authorized and paired devices are allowed to use the Bluetooth FTP service at the moment, and Alberto advises Windows Mobile users not accept pairing prompts from strangers.

Read the full security bulletin here.

7

About Surur

Site Admin and Windows Phone enthusiast, he has been using Windows Mobile devices since before they were called PocketPC’s. He is currently sporting a HTC 7 Trophy.

Tagged bluetooth, bluetooth security, vulnerability, windows mobile, windows mobile 5, windows mobile 6

Aleis

o yeah, bluejacking IS real!
keep bluetooth off…make a password for pairing if you need it on, and yeah dont accept unauthorized request.
Peter

Whats the problem? This can only happen if you have authorized a device. Don’t authorize anything unless you know what it is.

admin

The danger is when vulnerabilities get stacked. If another vulnerability comes along which makes it easy to pair with an unknown device (this may already exist http://www.macworld.com/article/45166/2005/06/bluetooth.html ) this attack could easily become wormable.

http://www.j2i.net Joel I Johnson

I’d be concerned if it were not for the fact that I have to authorize an attacker.
Pingback: Hole in your Bluetooth: Are you vulnerable? - Pocket.info - Mobile 2.0 - Pocket.Info - Mobile News
Pingback: HTC refuses to fix Bluetooth FTP vulnerability
Pingback: HTC refuses to fix Bluetooth FTP vulnerability « Joozzt RSS feeds

Scan QR Codes, UPC, EAN, Code 39/128 or ITF barcodes on your Windows Phone 7 to find best prices online.

Enjoy slots? Blackjack? Video Poker? Play Crazy Casino FREE!

#1 FREE Solitaire on WP7

If your a fan of Pong then you will love this game. Heavenly Skies. Save the universe! Are you ready?

A rewarding mix of match 3 and tetris gameplay

Free, Live Tile support for Word Of The Day and so much more. Why NOT try it out?

Set up reminders with only two taps. Supports also text reminders and voice reminders.

Download the best puzzle game in WP7 Marketplace for FREE!

Are you a good Alchemist ? Use your brain to discover Atomic Energy, Chuck Norris, Angry Birds and 1400 more !

Fun puzzle game with over 150 levels!

Fully featured, beautifully designed WP7 YouTube app.

u.n.i MEGA PACK (FREE), the ultimate addictive top GAMES bundle for Windows Phone 7! 7+ and growing!

Highly addictive word game designed for adrenaline junkies. Practice locally, but then are you fast enough to compete online?

Livescape is an activity and nutrition journal that features GPS tracking and the ability to count steps!

The smartest Google reader app.

Air Soccer Tour - Addictive FREE swipe soccer game. Win the world cup.

Beat the Story Mode. When your done Bring your skill online. Rank up by winning online matches. Have 1 on 1's with anyone! Global Online Multiplayer!

Never miss a bill again, now with a double-sided Live Tile and pop-up reminders.

Newest devices leaks, online charts and ultimate performance benchmark for every Windows Phone.

Every day, get great app deals from Windows Phone developers pushed to you!

Quick Tiles, a fully featured live tile editor for Windows Phone.

Great sports app for NFL, NBA, MLB, NHL. Pin scores/games to live tile on your home screen.

Local 1777 Ringtones , Zedge , Record and Save Ringtone ,Secret Voice Recorder and 7 Different Piano and Xylophone..Try Now..

MobileFax gives you the opportunity to send fax pages from your mobile phone anytime, anywhere !

Wheel of Wealth is a multiplayer turn based game based on the hit TV show Wheel of Fortune.

Embark on an adventure to locate the long lost Golden Chalice!

Enjoy a better WP7 experience with better & simpler apps

The most engaging weather experience with gorgeous live animations, simple intuitive Metro UI, live tiles, detailed weather data and much much more.

Promote your app on WMPoweruser.com