How does a Key Negotiation of Bluetooth Attack (KNOB) attack work?

It typically unfolds over 3 phases. It begins with: [Discovery] Using an established Person in the Middle setup, search for Bluetooth devices beginning the authentication process.

How do you prevent CAPEC-668?

Newer Bluetooth firmwares ensure that the KNOB is not negotaited in plaintext. Update your device.

What weaknesses does CAPEC-668 target?

CAPEC-668 exploits 3 CWE weaknesses, including CWE-285 (Improper Authorization), CWE-425 (Direct Request ('Forced Browsing')), CWE-693 (Protection Mechanism Failure).

How severe is CAPEC-668?

MITRE rates CAPEC-668 as High severity with low likelihood of attack.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Standard attack pattern

Draft

CAPEC-668: Key Negotiation of Bluetooth Attack (KNOB)

An adversary can exploit a flaw in Bluetooth key negotiation allowing them to decrypt information sent between two devices communicating via Bluetooth. The adversary uses an Adversary in the Middle setup to modify packets sent between the two devices during the authentication process, specifically the entropy bits. Knowledge of the number of entropy bits will allow the attacker to easily decrypt information passing over the line of communication.

Last updated June 1, 2026

High

Typical severity

Per MITRE

Low

Likelihood of attack

Per MITRE

3

Related weaknesses

CWEs this targets

Standard

Abstraction

MITRE classification

Overview

CAPEC-668 (Key Negotiation of Bluetooth Attack (KNOB)) is a standard-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.

How the attack works

The phases an attacker typically follows to carry out this attack.

Step 1
Explore
[Discovery] Using an established Person in the Middle setup, search for Bluetooth devices beginning the authentication process.
- Use packet capture tools.
Step 2
Experiment
[Change the entropy bits] Upon recieving the initial key negotiation packet from the master, the adversary modifies the entropy bits requested to 1 to allow for easy decryption before it is forwarded.
Step 3
Exploit
[Capture and decrypt data] Once the entropy of encryption is known, the adversary can capture data and then decrypt on their device.

What the attacker needs

Prerequisites

Person in the Middle network setup.

Skills required

Medium skill: Ability to modify packets.

Resources required

Bluetooth adapter, packet capturing capabilities.

Consequences

What a successful CAPEC-668 attack can achieve.

Read Data

Affects: Confidentiality

Bypass Protection Mechanism

Affects: Confidentiality, Access Control, Authorization

Modify Data

Affects: Integrity

How to mitigate it

Defenses that reduce the risk of CAPEC-668.

Newer Bluetooth firmwares ensure that the KNOB is not negotaited in plaintext. Update your device.

Examples

Given users Alice, Bob and Charlie (Charlie being the attacker), Alice and Bob begin to agree on an encryption key when connecting. While Alice sends a message to Bob that an encryption key with 16 bytes of entropy should be used, Charlie changes this to 1 and forwards the request to Bob and continues forwarding these packets until authentication is successful.

Terminology & mappings

Mapped taxonomies

ATTACK: Data Manipulation: Transmitted Data Manipulation (1565.002)

Frequently asked questions

Common questions about CAPEC-668.

What is CAPEC-668?: An adversary can exploit a flaw in Bluetooth key negotiation allowing them to decrypt information sent between two devices communicating via Bluetooth. The adversary uses an Adversary in the Middle setup to modify packets sent between the two devices during the authentication process, specifically the entropy bits. Knowledge of the number of entropy bits will allow the attacker to easily decrypt information passing over the line of communication.
How does a Key Negotiation of Bluetooth Attack (KNOB) attack work?: It typically unfolds over 3 phases. It begins with: [Discovery] Using an established Person in the Middle setup, search for Bluetooth devices beginning the authentication process.
How do you prevent CAPEC-668?: Newer Bluetooth firmwares ensure that the KNOB is not negotaited in plaintext. Update your device.
What weaknesses does CAPEC-668 target?: CAPEC-668 exploits 3 CWE weaknesses, including CWE-285 (Improper Authorization), CWE-425 (Direct Request ('Forced Browsing')), CWE-693 (Protection Mechanism Failure).
How severe is CAPEC-668?: MITRE rates CAPEC-668 as High severity with low likelihood of attack.

References

Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.

Defend against CAPEC-668

Track the CVEs and weaknesses attackers exploit with this technique, with AI-written analysis and remediation guidance.

Start free See pricing