Cross-protocol attacks: weaponizing a smartphone by diverting its Bluetooth controller

Romain Cayre (1, 2) , Géraldine Marconato (1) , Florent Galtier (2) , Mohamed Kaâniche (2) , Vincent Nicomette (2, 3) , Guillaume Auriol (3, 2)

1 APSYS (Blagnac)
2 LAAS-TSF - Équipe Tolérance aux fautes et Sûreté de Fonctionnement informatique
3 INSA Toulouse - Institut National des Sciences Appliquées - Toulouse

In this paper, we focus on a new type of wireless attacks, named cross-technology pivoting attacks. The main objective of these attacks is to divert the transceivers of compromised devices dedicated to a given protocol to allow them to communicate through another protocol, taking advantage of some similarities in their modulation schemes. The main contribution of this work consists in demonstrating the practical feasibility of pivoting attacks from off-the-shelf devices implementing the Bluetooth 5.0 specification. To our knowledge, this attack has not been explored so far in the state of the art.

Domaines: Traitement du signal et de l'image [eess.SP]; Cryptographie et sécurité [cs.CR]

Romain Cayre, Géraldine Marconato, Florent Galtier, Mohamed Kaâniche, Vincent Nicomette, et al.. Cross-protocol attacks: weaponizing a smartphone by diverting its Bluetooth controller. 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks, Jun 2021, Abu Dhabi, United Arab Emirates. ⟨10.1145/3448300.3468258⟩. ⟨hal-03355664⟩