Wireless Network Hacking · Topic 3 of 3
Bluetooth Hacking and Wireless Defenses
Learn Bluetooth attacks such as bluejacking, bluesnarfing and bluebugging, plus wireless countermeasures and security tools that find rogue access points.
- 5 min
- Bluejacking is messages, bluesnarfing is data theft, bluebugging is control, bluesmacking is denial of service.
- Non discoverable mode and timely patching are the main Bluetooth controls.
- WPA3 plus 802.11w is the strongest Wi-Fi answer.
What it is
Bluetooth is a short range radio technology (usually about 10 meters) that links phones, headsets, cars and other devices. Bluetooth hacking abuses weak pairing, discoverable devices and old firmware.
Wireless attack countermeasures are the controls that make Wi-Fi and Bluetooth attacks harder. Wireless security tools find rogue devices, watch the air and audit settings. The exam asks you to match a Bluetooth attack name to its description and to pick the right control.
How it works
Bluetooth attacks
| Attack | What it does |
|---|---|
| Bluejacking | Sends unsolicited messages (such as a business card) to nearby discoverable devices. It is a nuisance and not a data theft. |
| Bluesnarfing | Steals data such as contacts or calendar entries from a device without the owner knowing, abusing a weakness in how files are exchanged |
| Bluebugging | Takes control of a device to make calls, send messages or listen in, without the owner knowing |
| Bluesmacking | A denial of service using an oversized ping packet against a device |
| Blueprinting | Not an attack on data. It collects information (make, model, services) about a device. |
| BlueBorne | A set of flaws in Bluetooth stacks that allowed takeover without pairing or user action |
| Car Whisperer | Uses default PINs to reach a car hands free system |
| MAC spoofing | Impersonates a trusted paired device |
| Sniffing pairing traffic | Captures the pairing exchange to learn the link key |
Bluetooth stays an attack surface because many devices stay in discoverable mode, use default PINs such as 0000, and receive updates rarely.
Bluetooth countermeasures
- Turn Bluetooth off when not needed, and keep devices non discoverable.
- Reject unknown pairing requests, and never accept unexpected files.
- Use a long PIN or passkey and Secure Simple Pairing with numeric comparison where available.
- Update firmware and the operating system to fix stack flaws such as BlueBorne.
- Pair in private, not in a crowded place, to limit capture of the pairing exchange.
- Remove old paired devices that are no longer used.
Wi-Fi countermeasures
| Layer | Control |
|---|---|
| Encryption | Use WPA3 where possible, or WPA2 with AES. Never use WEP or open networks for business traffic. |
| Passphrase | A long random PSK, or 802.1X with RADIUS and certificates for enterprise |
| Management | Disable WPS, change default administrator credentials, update firmware |
| Frames | Enable Protected Management Frames (802.11w) against forged deauthentication |
| Segmentation | Place guest Wi-Fi on a separate network from internal systems |
| Signal | Place APs centrally and tune power so the signal does not leak outside the building |
| Monitoring | Run a wireless intrusion detection or prevention system (WIDS or WIPS) |
| Users | Train staff not to join unknown networks, and use a VPN on public Wi-Fi |
| Rogue control | Scan for unknown BSSIDs and use switch port security to stop rogue APs on the wired side |
Hiding the SSID and MAC address filtering are weak controls and should only be seen as extras.
Wireless security tools
Wireless security tools fall into three groups.
- Intrusion detection and prevention: a WIPS watches the air, detects rogue APs, evil twins, deauthentication floods and misconfigured devices, and can block them. Vendor controllers from Cisco, Aruba and others include such features.
- Wi-Fi analyzers and survey tools: products such as AirMagnet Wi-Fi Analyzer and the open source Kismet map signal strength, channels and unknown devices.
- Auditing tools: Aircrack-ng and Wireshark, used by defenders as well as attackers, test the strength of a configuration the way an attacker would.
For Bluetooth, defenders use scanners that list nearby discoverable devices, which show what an attacker could see. The same scan is often the first step of an attack, so use it only on your own estate.
A worked example
An employee reports that a colleague's phone sent odd messages and their contact list appeared in a message they did not write. The phone had Bluetooth on in discoverable mode in a crowded station.
This matches bluesnarfing (data theft) or bluebugging (device control). The device must be checked and updated. The lasting fix is to keep Bluetooth non discoverable, remove unknown paired devices and apply patches.
How the exam asks about this
- "Which attack sends unsolicited messages to nearby Bluetooth devices?" → Bluejacking.
- "Which attack steals contacts and calendar data over Bluetooth?" → Bluesnarfing.
- "Which control detects rogue APs and deauthentication floods automatically?" → A wireless intrusion prevention system.
What to remember for the exam
- Bluejacking is messages, bluesnarfing is data theft, bluebugging is control, bluesmacking is denial of service.
- Non discoverable mode and timely patching are the main Bluetooth controls.
- WPA3 plus 802.11w is the strongest Wi-Fi answer.
- A WIPS detects and can block rogue access points.
- Use a VPN on untrusted Wi-Fi.
Bluejacking sounds harmful but only sends messages. If the question mentions stolen data, the answer is bluesnarfing, and if it mentions control of the device, it is bluebugging.
Common mistakes
Mixing the four blue names. Learn them by outcome: messages, data, control, denial of service.
Choosing SSID hiding as a strong control. It adds almost nothing, and the name is still visible to tools.
Forgetting the wired side of a rogue AP. The fix includes port security and monitoring, not only wireless scanning.
Check yourself
Which Bluetooth attack takes over a device's calls and messages?
Bluebugging.
Which Wi-Fi feature protects against forged deauthentication frames?
Protected Management Frames, defined in 802.11w.
What does a WIPS add over a WIDS?
It can block or contain a threat, not only detect and alert.
Topic 3 of 3 in Wireless Network Hacking
Test yourself on Wireless Network Hacking
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.