Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The mobile operating systems Bluetooth module must not permit any data transfer between devices prior to Bluetooth mutual authentication.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-33090 | SRG-OS-000114-MOS-000068 | SV-43488r1_rule | Medium |
| Description |
|---|
| Bluetooth mutual authentication provides assurance that both the mobile device and Bluetooth peripheral are legitimate. If the authentication does not occur immediately before permitting a network connection, there is the potential for a man-in-the-middle attack in which a third device intercepts the traffic between the two legitimate devices. Mutual authentication prevents this from occurring. |
| STIG | Date |
|---|---|
| Mobile Operating System Security Requirements Guide | 2013-07-03 |
Details
| Check Text ( C-41349r1_chk ) |
|---|
| The local Bluetooth stack either supports this functionality or it does not. Review the system documentation to determine if the functionality is supported. If the Bluetooth stack permits any data transfer between devices prior to Bluetooth mutual authentication, this is a finding. |
| Fix Text (F-36990r1_fix) |
|---|
| Configure the operating system's Bluetooth stack to prohibit data transfer between devices prior to Bluetooth mutual authentication. |