CBC News:Harmless cellphone worm harbinger of worse to come

Posted in June 27th, 2004

Hmm, a virus that runs the battery down, by putting the phone into bluetooth search mode. I would say thats not harmless. At least data is not corrupted, but realisitically, running a battery down at the wrong time may well prevent an emergency call.

A more insideous hack would be to scramble the phones address and phone data, or to compromise corporate intelligence.

The obvious solution is to have bluetooth turned off, but thats going to require client interaction and setup. Not unlike leaving the IRDA port enabled today with most PDA’s.

Then again, one should have the security features of bluetooth enabled… Based upon this bluetooth virus, either a hole was found, or more probably, few had security enabled.

Looks like the corporate IS world has even more work ahead of them. Its going to be diifcult, especially with the myriad of phones available, and the different levels of bluetooth security. Add in the fact that the existing spec only deals with the link layer, yet leaves the application layer wide open to interpretation

I would also gather that the current security implementations may well be making serious compromises to keep life simple. An all too easy way to get a product to market, with an unverified threat.

Here are some links on bluetooth security.

http://www.thebunker.net/release-bluestumbler.htm

http://news.zdnet.co.uk/0,39020330,39145886,00.htm