Bluetooth Attacks GAWN Practice Questions (Page 8)

Questions 36–38

1. 36foundation · easy

   Which of the following is a known vulnerability in legacy Bluetooth pairing (pre-2.1)?

   • AThe PIN is transmitted in plaintext
   • BThe PIN is often a weak 4-digit number and can be brute-forced offline
   • CThe PIN is derived from the device's MAC address
   • DThe PIN is fixed and cannot be changed
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security researcher is demonstrating the BlueBorne attack to a client. Which statement accurately describes the attack's scope?

   • ABlueBorne only affects Android devices.
   • BBlueBorne only affects devices with Bluetooth pairing enabled.
   • CBlueBorne requires the attacker to be paired with the target device.
   • DBlueBorne can spread from device to device without user interaction.
   Reveal Solution Discussion Select an answer first
3. 38application · medium

   A security auditor is mapping the Bluetooth attack surface of a corporate office. They need to identify all Bluetooth devices in the area, including those that are not discoverable. The auditor has a Linux laptop with a standard Bluetooth adapter. Which approach should they use?

   • AUse hcitool scan for discoverable devices and sdptool browse to enumerate services on each discovered device.
   • BUse hcitool cc to connect to a known MAC address and then use sdptool records to enumerate services.
   • CUse hcitool lescan to find all Bluetooth devices, including non-discoverable ones, because LE scan bypasses discoverability.
   • DUse hcitool scan to list discoverable devices, then use hcitool inq to force inquiry of non-discoverable devices.
   Reveal Solution Discussion Select an answer first