Bluetooth

Bluetooth is an open standard for short-range radio communication, used to form small personal area networks between devices such as phones, headsets, keyboards, wearables and vehicles. NIST SP 800-121 Rev 2, Guide to Bluetooth Security, covers its two main forms: Bluetooth BR/EDR (Basic Rate and Enhanced Data Rate, often called Classic) and Bluetooth Low Energy, the low-power form common in sensors and wearables.

Its security rests on pairing, the process in which two devices establish a shared key and then authenticate and encrypt their link. Older pairing methods were weak, and the later Secure Connections modes moved to FIPS-approved algorithms. The pairing model matters too: the “Just Works” method gives no protection against a man-in-the-middle during pairing. Short range is not a security control. Directional antennas extend it, and a discoverable device announces itself to anyone nearby. Study sources commonly name three attacks: bluejacking (unsolicited messages), bluesnarfing (data theft) and bluebugging (control of the device), the latter two as exploits of firmware flaws in older devices.

Exam relevance: a scenario is likely to test whether a candidate treats short range as protection. Candidates are expected to point to pairing security, non-discoverable settings, firmware updates and policy on which devices may pair, and to match each named attack to what it gains.