Publications

BlueMaster: Bypassing and Fixing Bluetooth based Proximity Authentication

Published

Black Hat Europe

Date

2019.12.02

Research Areas

Abstract

Bluetooth enabled devices can indirectly check the proximity of other connected devices, and this proximity check can be used as an authentication means. Thanks to the widespread use of Bluetooth, popular software vendors such as Google and Microsoft offer this device proximity authentication method in their operating systems, namely, Android and Windows 10. On one hand, Google’s Android supports a feature called Android Smart Lock, which allows a user to register ‘trusted’ Bluetooth devices, and then utilize the presence of such trusted devices as an alternative to passcode. On the other hand, Microsoft Windows uses this proof-of-device-proximity in a reverse way. Windows 10 introduces Dynamic Lock, which automatically ‘locks’ the device if any of the paired Smartphone moves away, to block access to the computer while the user is unattended.