Threat I.Auth.HBISG.3

URI: I.Auth.HBISG.3

Package: LocalDeviceConnectivity

< prev | next >

Description: Spoofing a device RemoteHost in a Bluetooth pair with device Host in Space: an attacker with access to a location where Host is paired with RemoteHost, they can physically spoof the connection. This threat covers the case where the connection is freshly established in each location where it is needed.

Threat Type: Primary Threat

Matching Pattern:

I.Auth.HBISG.3
MP-HBISG

Finds a pair of hosts pairing via Bluetooth in a Space.

        (empty)

        (empty)

        (empty)

CSG-IgnorePhysicalThreatsFromWorld

Indicates that threats from as well as to the space Space can be ignored, i.e. that the risk model intentionally does not consider physical attacks from Space. This is only permitted if Space is the inferred global public space (the World) used when no locations are asserted in the model. This control strategy is a way to specify that physical security is out of scope for devices with no explicitly specified location(s), i.e. that they are considered physically secure.

CSG-SimpleSecurePairing-Full

Simple Secure Pairing (SSP) is used between RemoteHost and Host, following the Numeric Comparison or PassKey association model, in which the connection is confirmed by the user by entering a shared key or confirming successful sharing of such a key by the two devices.

CSG-SimpleSecurePairing-Local

Simple Secure Pairing (SSP) is used between RemoteHost and Host, following the Just Works association model with user confirmation at Host. This is effective in preventing spoofing in insecure locations, but depends on there being one secure location where the numerical comparison can be made safely, and then the result stored for subsequent use.

CSG-SimpleSecurePairing-Remote

Simple Secure Pairing (SSP) is used between RemoteHost and Host, following the Just Works association model with user confirmation at RemoteHost. This is effective in preventing spoofing in insecure locations, but depends on there being one secure location where the numerical comparison can be made safely, and then the result stored for subsequent use.