Bluesnarfing: Can Someone Hack Your Phone Through Bluetooth?

Bluesnarfing is the theft of data over an unsecured Bluetooth connection. Attackers exploit a flaw in the OBEX file-transfer protocol to silently copy contacts, messages, photos, and other files from a nearby device. First demonstrated in 2003, it is largely neutralized on modern phones, which now require pairing and authentication before sharing data.

There is a popular joke making the rounds in the software community: Security consultants make their living by terrifying tech-ignorant managers about security issues and convincing them to pay hefty fees for protection!

Although many security concerns are gimmicks, some are truly dangerous and need to be dealt with seriously. One such security threat is bluesnarfing, which relies on Bluetooth networks to steal data and breach privacy.

What Is Bluesnarfing?

To put it simply, bluesnarfing is a way of stealing information using an unsecured Bluetooth connection. Hackers exploit vulnerabilities in Bluetooth tech to break into Bluetooth-connected devices like mobiles, laptops, personal digital assistants, etc. Using bluesnarfing, cybercriminals can potentially get access to personal data like contacts, messages, pictures, videos, and even passwords from the device of their victim!

Bluesnarfing Vs Bluejacking

Bluesnarfing is often confused with a milder Bluetooth nuisance called bluejacking. In bluejacking, an attacker pushes unsolicited messages to a nearby device over Bluetooth (it does not use the cellular SMS network), usually as a prank. Crucially, bluejacking only sends data and cannot read anything off your phone. Bluesnarfing is the opposite: it takes data, so much more sensitive personal information is at stake.

Range matters here. Depending on the class of Bluetooth the device uses, some bluesnarfing attacks can be staged from as far as 90 meters (about 300 feet) away from an unsuspecting victim. That’s tantamount to getting hacked by someone sitting on the 20th floor of a building while you relax on the ground floor! A related, more invasive attack called bluebugging goes a step further, letting an intruder take control of phone functions such as placing calls or sending texts, which could have dreadful consequences. Bluesnarfing itself, however, is read-only: it copies your data but does not operate your phone.

How Is Bluesnarfing Attack Carried Out?

The crux of staging a bluesnarf attack lies in a flaw in the OBEX (OBject EXchange) protocol, which Bluetooth uses to swap files wirelessly. On many early phones, the OBEX Push service that received incoming files would also answer "GET" requests without asking for a PIN or a pairing confirmation. An attacker simply requested well-known filenames (for example, the phonebook stored as telecom/pb.vcf or the calendar as telecom/cal.vcs) and the phone handed them over. The attack was first identified independently in 2003 by Marcel Holtmann and security researcher Adam Laurie, who disclosed it publicly that November.

Leveraging Sophisticated Bluesnarfing Tool Like Bluediving

When a device is using Bluetooth without authentication enabled and is set to ‘discoverable’, hackers have an easy way in. Hackers then use sophisticated tools like Bluediving to get access to personal information of the victim. It goes without saying that all of this is done without the victim knowing that his or her phone’s data is being swindled.

Exploiting Inherent Vulnerability Of OBEX Protocol

The problem is that the original developers of Bluetooth technology have consciously kept OBEX protocol open, i.e., without authentication policies in place (like asking for a PIN and/or a pairing request). They did so because Bluetooth was developed with the intent of sharing digital business cards (Source). 

The whole purpose was to make the sharing of business cards easy using wireless connectivity (Bluetooth). These business cards weren’t really sensitive data, so developers opted for the convenience of sharing and overlooked security, which is why bluesnarfing gained traction.

What Data Is At Stake In An Event Of A Bluesnarf Attack?

It’s unlikely to execute a successful bluesnarf attack without a laptop, a Bluetooth dongle, and knowledge of special tools and scripting.

So, in short, it requires a professional to pull this off.

Considering that the end result of these attacks is usually the theft of valuable data in the form of contacts, messages, pictures etc., such attacks are often part of larger shady data theft businesses. They basically sell this data to interested parties, usually on the dark web.

Believe it or not, even a reputed tech giant resorted to this kind of pernicious activity! In 2013 Google was found guilty of collecting data from unprotected wireless networks. This pilfering of data was done by special devices installed in Google’s Street View cars. During the trips, these cars would scan for unsecured wireless networks and then collect sensitive data, such as email with passwords (without consent). Google had to pay 7 million dollars for this misconduct.

While this wasn’t a case of bluesnarfing, per se, the modus operandi and intent were similar. Instead of discoverable open Bluetooth, these Street View cars were in quest of unsecured Wifi networks to slyly elicit crucial data from them.

An even more worrisome cousin of bluesnarfing is bluebugging. Where bluesnarfing merely copies your files, bluebugging hands the attacker control of the phone itself, including its calling and messaging functions. In principle, that means an intruder could place calls using the victim’s number and network, masking their own identity, which is exactly why these older Bluetooth flaws were taken so seriously by security researchers.

Should You Be Worried About Bluesnarfing?

Fortunately, the original loophole has long since been closed. Classic bluesnarfing was a mid-2000s problem: at the 2004 CeBIT trade fair, researcher Martin Herfurt famously tested 1,269 Bluetooth devices and found models like the Nokia 6310i and Sony Ericsson T610 wide open. Phone makers patched their firmware in response, and the introduction of Secure Simple Pairing and the Bluetooth 4.0 standard made authentication mandatory.

You have likely noticed that smartphones and other Bluetooth devices now refuse to share data until you approve a pairing request and, often, confirm a matching PIN. That single change makes the original bluesnarfing technique impractical against an up-to-date phone.

That said, Bluetooth security is not a solved problem. Newer research has uncovered entirely different classes of attack, such as BlueBorne (2017), a set of flaws that could spread without any pairing or even discoverable mode, and the KNOB attack (2019), which weakened the encryption used between paired devices. These are distinct from bluesnarfing, but they are a good reminder to keep your phone’s software updated.

A Final Word

With the ever-rising number of connected devices, the instances of cyberattacks to gain illegitimate access are also on the rise. The easiest way to safeguard from bluesnarfing is to keep your Bluetooth off when it is not needed.

Since smartphones these days come with built-in authentication, bluesnarfing attacks are on the decline. However, if you have a really old mobile with a Bluetooth feature, you should keep your mobile on non-discoverable/hidden mode for more security. Never accept Bluetooth pairing requests from unknown devices.

Although cyberattacks like bluesnarfing are scary, you can protect your mobile and data by staying alert and informed about basic digital safeguards!