Download Implementation of the Bluetooth stack for software defined radio

CHAPTER 8. FURTHER WORK
8.2
44
Hopping
Hopping is the only major hurdle left to a successful attack against a device,
and for this the clock signal is needed. Once the clock signal and address have
been found then the hopping pattern for the device can be discovered. The
hopping pattern can be calculated from only the UAP and LAP parts of the
address, and all 27 bits of the clock signal. The algorithm that determines
the frequency of the next hop is described in section 2.6.2 of the Bluetooth
spec[7].
8.3
Using commodity hardware
At the time of writing the GNU Radio hardware costs around $700 plus
an additional $275 per RFX-2400 daugtherboard[17]. This is not too much
for anyone who wishes to listen to the Bluetooth communications of others,
especially if there is financial gain to be had. However, the security of the
technology cannot really be said to have been compromised until communications can be sniffed with commodity hardware; this requires an attack
using only the $3 Bluetooth chip built into a device. In April 2007 a CSR
based device was reportedly turned into a Bluetooth sniffer using firmware
taken from a commercial sniffing tool[18]. However this is unconfirmed and
the capabilities are not known; if this can provide all of the functions that
are required to snoop a communication then it could be used to replace the
GNU Radio for an attack.
8.4
Mounting an attack
The overall goal of this, and all Bluetooth security research, is a successful
attack mounted against arbitrary devices, preferably using commodity hardware. However, all of the above problems need to be solved before this can
happen. The USRP seems well suited to the task of sniffing packets, but the
precise timing required for transmission and reception on the same device
may prove impossible with the current GNU Radio framework. One option