Bluetooth Low Energy Attacks GAWN Practice Questions (Page 11)

Questions 51–55

1. 51expert · hard

   A penetration tester is assessing a BLE asset-tracking system. The system uses BLE tags that advertise their presence, and a central server logs the tags' locations. The tester wants to demonstrate that an attacker can create a fake tag that appears in a different location, while also causing the real tag to be ignored. Which technique is most effective?

   • AJam the real tag's advertising channels and then broadcast a fake advertisement with a different MAC address.
   • BPerform a MITM attack on the real tag's connection to the server and modify the location data.
   • CSpoof the real tag's MAC address and advertisement data, and transmit with higher power to override the real tag's signal.
   • DSend malformed advertisements to the server to crash its BLE receiver, then broadcast a fake tag.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A BLE-enabled garage door opener accepts a specific command packet to open the door. An attacker captures this packet and later retransmits it to open the door without authorization. Which BLE attack is being performed?

   • ASpoofing attack, where the attacker impersonates the remote's MAC address
   • BEavesdropping attack, where the attacker passively listens to the communication
   • CReplay attack, where the captured command packet is retransmitted to trigger the same action
   • DFuzzing attack, where malformed packets are sent to trigger unintended behavior
   Reveal Solution Discussion Select an answer first
4. 53foundation · easy

   Which tool is specifically designed to capture BLE traffic by acting as a passive sniffer that can decode advertisements and connection events?

   • AAircrack-ng
   • BKismet
   • CWireshark
   • DUbertooth
   Reveal Solution Discussion Select an answer first
5. 54foundation · easy

   Which BLE packet field is commonly spoofed to impersonate a legitimate device?

   • ATX power level
   • BConnection interval
   • CDevice address
   • DCRC value
   Reveal Solution Discussion Select an answer first
6. 55expert · hard

   A BLE fitness tracker transmits health data to a smartphone. The tracker uses legacy pairing with a fixed 4-digit PIN. An analyst captures the pairing process and wants to decrypt the subsequent data traffic. Which approach is most effective?

   • APerform an offline brute-force attack on the captured pairing exchange to recover the PIN and derive the session key
   • BPassively capture the data packets and attempt to decrypt them using a dictionary of common keys
   • CPerform a MITM attack during pairing to force the devices to use a known PIN
   • DReplay the captured data packets to the smartphone to extract the key
   Reveal Solution Discussion Select an answer first