Examkin

Question

Difficulty: MediumNetwork and Wireless Attack Indicators

A security analyst reviews device logs following reports of abnormal wireless activity on an executive's smartphone during an off-site conference. The logs indicate that the smartphone first accepted an unsolicited vCard contact file over an unauthenticated Bluetooth Object Exchange (OBEX) connection. Immediately after, an unauthorized background process queried and exfiltrated the device's internal calendar entries and contact lists over Bluetooth without requesting user pairing approval. Based on these technical indicators, which of the following wireless attacks occurred? (Select TWO).

  1. Bluejacking, indicated by the unsolicited transmission of messages or contact cards to a Bluetooth-enabled device.Answer
  2. Bluesnarfing, indicated by the unauthorized access and exfiltration of sensitive information from a Bluetooth device.Answer
  3. C
    Evil Twin attack, indicated by an unauthorized access point broadcasting a spoofed Service Set Identifier (SSID).
  4. D
    Radio Frequency (RF) Jamming, indicated by intentionally flooding the wireless spectrum to cause massive frame loss.

Answer

The scenario demonstrates both Bluejacking (receipt of unsolicited vCard data over Bluetooth OBEX) and Bluesnarfing (unauthorized access and exfiltration of device contacts and calendar schedules).
The scenario describes two distinct Bluetooth exploits. Bluejacking is characterized by sending unsolicited messages or contact files (vCards) to a recipient device over Bluetooth. Bluesnarfing occurs when an attacker gains unauthorized access to steal private device data, such as calendars, emails, and contact lists, without user consent.

Step-by-Step Solution

1
Analyze the first observed behavior in the audit log.
The device received an unsolicited vCard contact file via Bluetooth OBEX push without prior authorization.
This behavior fits the definition of Bluejacking, where an attacker pushes unwanted text or contact cards to a target device.
2
Analyze the second observed behavior in the audit log.
An unauthorized background query accessed and retrieved internal device data (contacts and calendar items).
This behavior fits the definition of Bluesnarfing, which specifically target the unauthorized reading and theft of sensitive data stored on a Bluetooth-enabled device.
3
Distinguish from non-applicable wireless attack indicators.
Discard options related to 802.11 Wi-Fi Rogue APs (Evil Twin) or physical layer signal disruption (RF Jamming).
The indicators in the scenario explicitly concern Bluetooth OBEX protocol exploitation, not 802.11 Wi-Fi impersonation or RF signal degradation.

Key Concept

Bluetooth Wireless Attack Indicators (Bluejacking vs. Bluesnarfing)
Estimated Time:1m 30s
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic