Assessing cybersecurity risks in BLE-based asset management systems

• Autor(a) principal: Verde, David Luís Malhão
• Data de Publicação: 2024
• Tipo de documento: Dissertação
• Idioma: eng
• Título da fonte: Repositório Científico de Acesso Aberto de Portugal (Repositórios Cientìficos)
• Texto Completo: http://hdl.handle.net/20.500.11960/3949
• topic: Indoor-location security; Asset management; BLE beacons; Bluetooth; Cybersecurity; Localização indoor segura; Gestão de recursos; Cibersegurança

In the current era of digital transformation, Asset Management (AM) systems using Bluetooth Low Energy (BLE) beacons are being applied across various domains, allowing for the detection of individuals or objects within a building. While the impact of a compromised Indoor Positioning System (IPS) may not be significant in certain domains, in others it can pose risks and potentially lead to the loss of human lives or other significant consequences. This work starts with a literature review on vulnerabilities that target BLE beacon devices. With the gathered knowledge from the review, a risk assessment of cyber-attacks targeting AM systems using BLE devices in two specific scenarios is presented: health- care and industry. The aim is to estimate the attacks that pose the greatest risk in each application area. An experimental setup was also created with a focus on testing a set of vulnerabilities, such as replay attack, device cloning, jamming, battery exhaustion at- tack and physical hijacking. Lastly, mitigation measures and a list of best practices and guidelines are proposed to help harden these systems. Results show that, risk levels vary depending on the targeted scenario. Replay, battery exhaustion, jamming, fuzzing, blue-smack, and physical hijacking attacks are the ones that pose the greatest risk levels in the considered scenarios. Additionally, the vulnerabilities exploited in the experimental setup manifest a concerning accessibility, that can lead to irreversible damages.