vice access to a requested service. Authorisation can be completed without user intervention if the requesting device is marked as "trusted". Trust is normally granted to a device by the user during an initial authorisation. Three levels of device security are also defined, as shown in Table 11-5. As a third security step, transmitted data can be encrypted using a key generated from the existing authentication key. The maximum length of the encryption key, up to 128-bit, is negotiated between master and slave Table 11-5: Bluetooth Device Security Levels Device type Security level Trusted devices Devices which are identified in the security database as trusted and are allowed unrestricted access to all services. Known untrusted Devices which have been paired and perhaps authenticated devices but which are not identified in the database as trusted. Access to certain services may be restricted. Unknown devices Devices which have not been paired and for which no security information is known. Only open services are accessible to unknown devices. Chapter Eleven as part of the process of initiating encryption. Although it is impossible to prevent the interception of data transmitted by radio, the use of FHSS makes Bluetooth virtually immune to eavesdropping by a device that does not follow the same hopping pattern. Bluetooth Vulnerabilities Provided that security modes above 1 are enabled and reasonably long passphrases or PINs are used, Bluetooth security generally prevents unauthorised access to data or services on enabled devices. However, there are two known vulnerabilities, "bluesnarfing" and "bluebugging" that affect some mobile phones, although software upgrades have been developed by vendors for phones affected by these vulnerabilities. "Bluejacking" is not strictly a security vulnerability, but represents a subversion of the normal pairing process that may lead to undesired pairing to another device. Bluesnarfing enables a hacker to access data stored on a Bluetooth mobile phone without alerting the phone's us