Bluetooth Low Energy Attacks GAWN Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary weakness of the Just Works pairing method?

   • AIt does not provide authentication, making it vulnerable to MITM attacks
   • BIt only works with devices that have a display
   • CIt requires a long passkey that is hard to remember
   • DIt uses a weak encryption algorithm
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A retail store uses BLE beacons to trigger location-based promotions on customers' phones. An attacker wants to prevent customers from receiving these promotions without permanently disabling the beacons. Which technique is most effective and least persistent?

   • APerform a MITM attack on the beacon connection to modify the promotion data.
   • BSend malformed connection requests to the beacons to crash their firmware permanently.
   • CTransmit continuous noise on the 2.4 GHz advertising channels to block beacon advertisements temporarily.
   • DSpoof the beacons' MAC addresses and send conflicting advertisements to confuse customers' phones.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A facility uses BLE-enabled wristbands to control access to a secure area. An attacker wants to prevent legitimate users from entering by disrupting the wristband-reader communication. Which attack would achieve this?

   • AReplaying a previously captured unlock command to open the door
   • BPerforming a MITM attack to relay the wristband's authentication data
   • CFlooding the 2.4 GHz band with high-power BLE advertisements to cause interference and prevent the wristband from connecting to the reader
   • DSpoofing the wristband's MAC address to impersonate it and gain access
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security auditor is evaluating a BLE smart lock that uses legacy pairing with a fixed 6-digit PIN. The auditor has captured a full pairing exchange and subsequent encrypted traffic. The auditor wants to decrypt the traffic to prove the vulnerability. Which approach is most efficient?

   • ABrute-force the 6-digit PIN offline using the captured pairing exchange to derive the STK, then decrypt the traffic.
   • BReplay the captured pairing exchange to the lock to see if it reveals the PIN.
   • CExtract the LTK from the lock's flash memory using a physical attack, then use it to decrypt the traffic.
   • DPerform a MITM attack on a new pairing to force the lock to use a known PIN.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst is assessing the attack surface of a BLE device that uses advertisements to broadcast its presence and then establishes a connection for data transfer. Which phase of the BLE communication is most vulnerable to spoofing attacks?

   • AData transfer phase, because the data is transmitted in plaintext
   • BConnection phase, because the connection is encrypted and harder to spoof
   • CAll phases are equally vulnerable to spoofing
   • DAdvertising phase, because advertisements are broadcast unencrypted and can be easily spoofed
   Reveal Solution Discussion Select an answer first