How do you use Solarwinds products to alert you when Bluetooth devices are compromised?

My InfoSec team talked to me yesterday about Bluetooth attacks they're seeing.

Bluetooth hasn't been a widely publicized target in the past. Its internal rights and hooks higher up in the hardware and OS, and its ubiquity make it (sadly) perfectly vulnerable and desirable to compromise.

The new BlueBorne exploit packages eight Zero Day vulnerabilities together, and combines them to make a hands-free attack and take-over of any Bluetooth device simple and silent. In ten seconds any vulnerable device (and I do mean ANY--Apple,

Android, and Linux are specifically vulnerable to this) is taken over--without any clicking by their owners.

And then the device goes & infects all the other Bluetooth devices it sees (even if you're not joined to them!).

Once compromised, a remote operator can access far too much on your device, and reconfigure more. They can see your keystrokes, your audio, your video, read/modify/download your files and your photographs . . .

Billions of devices imperiled by new clickless Bluetooth attack | Ars Technica

https://www.armis.com/blueborne/

New Bluetooth vulnerability can hack a phone in 10 seconds | TechCrunch

How have you fit Bluetooth monitoring into your Solarwinds solutions?

What can Solarwinds do to alert us about compromised Bluetooth devices?

Find more posts tagged with

monitor_bluetooth

Accepted answers

All comments

d09h

I once collaborated with a brilliant UNIX admin who presented results of a shell script via private MIBs.

http://www.net-snmp.org/wiki/index.php/Writing_your_own_MIBs

In essence, I would poll the private OID, which would cause his script to run, and the return was along the lines of

OK
investigate
down

Separate idea--traps and syslogs could be used.

d09h

Although the question was specifically about how SolarWinds can be used, one can blacklist bluetooth modules, disable and stop service, and remove the service.

https://unix.stackexchange.com/questions/392001/how-do-i-secure-linux-systems-against-the-blueborne-remote-attack

Was looking for best practices, but only found the above, so I paraprhased plagiarized it.

I can see SAM module being used to get visibility into these steps.

rschroeder

Strangely, each time I click your link, the connection is remotely reset. Might there be a white list assigned to it, and as a result I'm unable to view its contents?

d09h

Sounds like a job for Google cache search. I have the same obstacles, and frequently Google cache comes through.