1. How to hack into mobile phones via bluetooth & How to Hack Wireless Internet Connections in 3 Easy Steps PresentedBy Pradosh H.S

2. Hacking Mobile Phones via Bluetooth

3. Introduction SIM  Subscriber Identity Module

4. Introduction  Hackers today have a new technological device to target. With m-commerce (business transactions conducted with online mobile devices) becoming increasingly popular, the vulnerability of mobile devices has also become an area of concern.  Hacking chips of cellular phones.

5. Introduction  Due to hacking following mobile security threats has arisen:  IP theft ( applications,.. )  Subscription fraud  SIM locking cracking  Revocation of account data  Identity theft.

6. Bluetooth  Bluetooth operates in the 2.4 GHz frequency spectrum.  The Bluetooth specification allows a maximum data connection speed of 723 Kbps.  Bluetooth uses much lower power levels than do wireless LAN technologies (802.11x).

7. Bluetooth  Bluetooth uses a peer-to-peer networking model.  Bluetooth doesn’t require line of sight between any of the connected devices.  Bluetooth can also connect multiple devices together in a point-to- multipoint fashion.

8. Bluetooth Hacking

9. Four types of attack- Security Threats

10. BlueSnarf Attack IMEI  International Mobile Equipment Identity.

11. BlueSnarf Attack  IMEI, a code that uniquely identifies the phone to the mobile network.  IMEI can be used to clone illegal copies of a compromised phone and force the victim to pay phone changes he/she didn’t incur.

12. BlueDoor Attack WAP  Wireless Application Protocol. GPRS  General Packet Radio Service.

13. BackDoor Attack  The backdoor attack involves establishing a trust relationship through the "pairing" mechanism, but ensuring that it no longer appears in the target's register of paired devices.  The attack itself is invisible to the victim and allows the attacker access to the victim's mobile phone anytime, anywhere.

14. BackDoor Attack  Not only can the attacker retrieve data from the phone, the attack also gives access to modem or Internet connections and WAP and GPRS gateways.  A backdoor attack also makes it easier for an attacker to launch the aforementioned Snarf data-theft attack.

15. BlueBug Attack

16.  BlueBug is based on AT Commands (ASCII Terminal).  Very common for the configuration and control of telecommunications devices.

17. BlueBug Attack  High level of control.. Call control (turning phone into a bug), Call control (turning phone into a bug), Sending/Reading/Deleting SMS, Sending/Reading/Deleting SMS, Reading/Writing Phonebook Entries, Reading/Writing Phonebook Entries, Eavesdrop on phone, Eavesdrop on phone, Setting Forwards, Setting Forwards, -> causing costs on the vulnerable phones!!

18. Bluejacking Attack

19. Bluejacking  Bluejacking techniques involves abusing the bluetooth “pairing” protocol, the system by which bluetooth devices authenticate each other, to pass a message during the initial “handshake” phase.  Bluetooth devices have the ability to send so called wireless business cards.

20. Bluejacking  A recent trend has been to send anonymous business cards with offensive messages, and frankly, it’s very easy to do. But it doesn’t put data in jeopardy.  Bluejacking requires an attacker to be within 10 mts of a device.  Bluejacking kills battery life.

21. DOS Attack DOS  Denial Of Service

22. Mobile DOS Attack  DOS attacks occur when an attacker uses his Bluetooth device to repeatedly request pairing with the victim’s device. Unlike on the Internet, where this type of constant request can bring down services, a Bluetooth DOS attack is mostly just a nuisance, since no information can be transferred, copied or attained by the attacker.

23. Mobile DOS Attack  DOS attacks are the easiest to perform and can drain a device’s battery or temporarily paralyze the phone or PDA. However, since this attack relies on the proximity of the attacker to the victim, it’s easy to stop. Just walk away.  All Bluetooth device faces this problem. Currently, there are few software defenses against this type of assault.

24. Wireless Internet The term “wireless internet” is perfectly self-explanatory. It is internet access without the use of wires. Instead it uses radio frequency bands to exchange information between your computer and the Internet. The term “wireless internet” is perfectly self-explanatory. It is internet access without the use of wires. Instead it uses radio frequency bands to exchange information between your computer and the Internet. Wireless access allows users to connect to the internet from any location within range of a wireless access point. Wireless access allows users to connect to the internet from any location within range of a wireless access point.

25. Wireless Internet Equipment For home use, the basic equipment is: Wireless NIC card Wireless NIC card Wireless router or access point Wireless router or access point Internet access Internet access

26. Advantages No wires No wires Mobility Mobility Faster speeds Faster speeds Widely available equipment Widely available equipment Convenience Convenience Inexpensive to set-up Inexpensive to set-up

27. Disadvantages Limited range Limited range Interference with other wireless access points Interference with other wireless access points Encryption can be broken even at its strongest Encryption can be broken even at its strongest

28. Hacking Wireless Internet Wireless networks are very common. It is also very common to find wireless networks that are unsecured. Maybe the users are lazy or maybe they are not savvy when it comes wireless networks. Whatever the reason, hackers have found wireless networks relatively easy to break into, and even use wireless technology to crack into non-wireless networks. Wireless networks are very common. It is also very common to find wireless networks that are unsecured. Maybe the users are lazy or maybe they are not savvy when it comes wireless networks. Whatever the reason, hackers have found wireless networks relatively easy to break into, and even use wireless technology to crack into non-wireless networks.

29. Wireless Encryption The main source of vulnerability associated with wireless networks are the methods of encryption. There are a few different type of wireless encryption including: The main source of vulnerability associated with wireless networks are the methods of encryption. There are a few different type of wireless encryption including:

30. WEP Stands for Wired Equivalent Privacy. Stands for Wired Equivalent Privacy. Breakable even when configured correctly Breakable even when configured correctly Can be broken in as little as 3 minutes Can be broken in as little as 3 minutes

31. WPA or WPA2 Stands for Wi-Fi Protected Access Stands for Wi-Fi Protected Access Created to provide stronger security Created to provide stronger security Still able to be cracked if a short password is used. Still able to be cracked if a short password is used. If a long passphrase or password is used, these protocol are virtually uncrackable. If a long passphrase or password is used, these protocol are virtually uncrackable. Even with good passwords or phrases, unless you really know what your doing, wireless networks can be hacked and here’s how……. Even with good passwords or phrases, unless you really know what your doing, wireless networks can be hacked and here’s how…….

32. A little info… When a user uses wireless internet they generate what are called data “packets”. When a user uses wireless internet they generate what are called data “packets”. Packets are transmitted between the wireless NIC card and the wireless access point via radio waves whenever the computer is connected with the access point. Packets are transmitted between the wireless NIC card and the wireless access point via radio waves whenever the computer is connected with the access point.

33. More info… Depending on how long the computer is connected, it can generate a certain number of packets per day. Depending on how long the computer is connected, it can generate a certain number of packets per day. The more users that are connected to one access point, the more packets are generated. The more users that are connected to one access point, the more packets are generated.

34. First… You must locate the wireless signal You must locate the wireless signal This can be done by using your default Windows tool “View Available Wireless Network” This can be done by using your default Windows tool “View Available Wireless Network” More useful tools include NetStumbler and Kismet. Kismet has an advantage over the other because it can pick up wireless signals that are not broadcasting their SSID. More useful tools include NetStumbler and Kismet. Kismet has an advantage over the other because it can pick up wireless signals that are not broadcasting their SSID.

35. Second… Once you located a wireless network you can connect to it unless it is using authentication or encryption. Once you located a wireless network you can connect to it unless it is using authentication or encryption. If it is using authentication or encryption then the next step would be to use AirSnort, a tool for sniffing out and cracking WEP keys. If it is using authentication or encryption then the next step would be to use AirSnort, a tool for sniffing out and cracking WEP keys.

36. AirSnort AirSnort must gather about 5 to 10 million packets before it can even begin to crack a wireless key. AirSnort must gather about 5 to 10 million packets before it can even begin to crack a wireless key. This could take anywhere between a few minutes to a few weeks depending on how many packets are being generated. If a small number of people are using the network then it will most likely take weeks. This could take anywhere between a few minutes to a few weeks depending on how many packets are being generated. If a small number of people are using the network then it will most likely take weeks.

37. Third… Once AirSnort has recovered enough packets it will then go to work on reading the captured information gathered from the packets and crack the key giving you access. Once AirSnort has recovered enough packets it will then go to work on reading the captured information gathered from the packets and crack the key giving you access. Other tools such as CowPatty can use dictionary files to crack hard WPA keys. Other tools such as CowPatty can use dictionary files to crack hard WPA keys.

38. Prevent Your Network from Getting Hacked Don’t broadcast your SSID. This is usually done during the setup of your wireless router. Don’t broadcast your SSID. This is usually done during the setup of your wireless router. Change the default router login to something else. Change the default router login to something else. If your equipment supports it, use WPA or WPA 2 because it offers better encryption which is still able to be broken but much harder. If your equipment supports it, use WPA or WPA 2 because it offers better encryption which is still able to be broken but much harder. Always check for updates to your router. Always check for updates to your router. Turn off your router or access point when not using it. Turn off your router or access point when not using it.

39. Prevent Your Network from Getting Hacked There is no such thing as 100% percent security when using wireless networks but at least with these few simple steps you can make it harder for the average person to break into your network. There is no such thing as 100% percent security when using wireless networks but at least with these few simple steps you can make it harder for the average person to break into your network.

40. THE END P. S I successfully hacked into my neighbors wireless connections to gain access to the net and gather information for the presentation.