Bluetooth Security in Industrial Networks

The threats against the Bluetooth wireless industrial networks are caused by a logical design flaw, an implementation flaw or a fundamental weakness; so an attacker can pose a threat to damage the network. This work explores the threats against the Bluetooth industrial networks, when a built-in security mechanism is enabled or not. It puts an exclusive focus on attacker's capabilities equipped with protocol analyzer to get the required information for hop sequence synchronization to eavesdrop the Bluetooth communication; with capturing or without capturing the FHS packet, and also the analysis & development of various software defined radio applications using a MATLAB/Simulink and USRP2. This work also presents a complete SDR based prototype solution to get the master device address and its clock value; by intercepting and demodulating the FHS packet exchanged during the inquiry or the page procedure, furthermore without capturing the FHS packet just listing for a short time on a fixed RF frequency out of the 79 Bluetooth channels. The prototype system is build and interfaced with an USRP mother board and RFX2400 daughter board using the GNU radio framework.