GSLC · Question #69
An executive in your company reports odd behavior on her PDA. After investigation you discover that a trusted device is actually copying data off the PDA. The executive tells you that the behavior…
The correct answer is D. Bluesnarfing. Bluesnarfing is a Bluetooth-based attack where an attacker gains unauthorized access to and copies data from a victim's device, often initiated through a malicious vCard or e-business card exchange.
Question
An executive in your company reports odd behavior on her PDA. After investigation you discover that a trusted device is actually copying data off the PDA. The executive tells you that the behavior started shortly after accepting an e-business card from an unknown person. What type
Options
- APDA Hijacking
- BSession Hijacking
- CPrivilege Escalation
- DBluesnarfing
How the community answered
(22 responses)- A5% (1)
- C9% (2)
- D86% (19)
Why each option
Bluesnarfing is a Bluetooth-based attack where an attacker gains unauthorized access to and copies data from a victim's device, often initiated through a malicious vCard or e-business card exchange.
PDA Hijacking is not a recognized standard attack classification and does not describe any specific Bluetooth-based data exfiltration mechanism.
Session hijacking involves taking over an active authenticated network session between two communicating parties, and has no connection to Bluetooth-based data theft.
Privilege escalation refers to gaining elevated system permissions beyond what was originally granted, which is unrelated to the Bluetooth data copying described in this scenario.
Bluesnarfing specifically involves unauthorized data theft from a Bluetooth-enabled device by exploiting the Bluetooth connection after an initial pairing or object-push interaction. The attacker tricks the victim into accepting a malicious e-business card (vCard over OBEX), which establishes a Bluetooth channel allowing the attacker's device to copy files and data off the target PDA. This matches the scenario precisely - data exfiltration began immediately after accepting an e-business card from an unknown person.
Concept tested: Bluesnarfing attack via Bluetooth vCard OBEX
Source: https://csrc.nist.gov/publications/detail/sp/800-121/rev-2/final
Topics
Community Discussion
No community discussion yet for this question.