Practical Man-in-the-Middle Attacks Against Bluetooth Secure Simple Pairing

We propose two practical MITM (Man-In-The-Middle) attacks against Bluetooth SSP (Secure Simple Pairing). Our first attack requires some kind of visual contact to the victim devices in order to mislead the user to select a less secure option instead of using a more secure OOB (Out-Of-Band) channel. Our second attack illustrates how widely used Bluetooth headsets and hands-free devices are susceptible to MITM attacks without even requiring the attacker to have visual contact to the victim devices. Moreover, we propose countermeasures that render these attacks impractical although not totally eliminating their potential danger.