1
00:00:02,080 --> 00:00:03,400
Yes, okay.

2
00:00:03,400 --> 00:00:06,200
Thank you for the kind introduction, John.

3
00:00:06,240 --> 00:00:14,000
Hello, DEF CON crowd, Car Hacking Village crowd, anyone after the fact, if you happen to be watching this sometime in the future.

4
00:00:14,120 --> 00:00:15,100
My name is Kamel.

5
00:00:15,100 --> 00:00:19,120
Today I'm going to be talking to you guys about Bluetooth in automotive.

6
00:00:19,500 --> 00:00:22,760
So, quick introduction for myself.

7
00:00:22,760 --> 00:00:28,640
This is just to make sure you believe that I'm, you know, qualified to be talking about the things I'm speaking about.

8
00:00:28,640 --> 00:00:32,780
So, I'm an automotive cybersecurity technology architect at WhiteMotion.

9
00:00:32,780 --> 00:00:41,700
WhiteMotion is a little-known, is a very small subsidiary of Morelli, the former Italian automotive OEM Magneti Morelli.

10
00:00:41,700 --> 00:00:47,460
They merged with a Japanese automotive supplier called CalSonic Kansai a few years ago.

11
00:00:47,460 --> 00:00:54,020
And since at the time, WhiteMotion was a subsidiary of CalSonic Kansai, we're now fully owned by Morelli Corporation.

12
00:00:54,020 --> 00:00:55,780
I'm based in Tokyo in Japan.

13
00:00:55,780 --> 00:00:56,800
I'm trilingual.

14
00:00:56,800 --> 00:00:58,980
I speak English, Arabic, and Japanese.

15
00:00:58,980 --> 00:01:03,200
I've been involved in the automotive cybersecurity industry for about three years now.

16
00:01:03,540 --> 00:01:12,180
I've been on all sides of the table, including, you know, private consultant, you know, trainer, red team, blue teamer, so on and so forth.

17
00:01:12,180 --> 00:01:23,100
I've kind of, I've worn a lot of hats in the last few years because auto cyber is a very new and, you know, expanding field and no one's, you know, job is as well-defined as they might like to think it is.

18
00:01:23,100 --> 00:01:27,180
I got involved in the community side of things a while back.

19
00:01:27,180 --> 00:01:37,060
I was a big, I was an administrator on the ASRG board in Detroit, and I started the ASRG chapter here in Japan.

20
00:01:37,060 --> 00:01:40,200
ASRG, by the way, stands for Automotive Security Research Group.

21
00:01:40,200 --> 00:01:45,760
It's a group that is, I believe we're sponsoring the Car Hacking 101 this year at DEF CON.

22
00:01:45,760 --> 00:01:49,060
So we're kind of managing things through that.

23
00:01:49,060 --> 00:02:03,300
But yeah, it's a group dedicated to sharing automotive security resources and information and helping, you know, expand awareness for the industry and help grow it as not only an industry for work and stuff, but also as a community.

24
00:02:03,840 --> 00:02:07,460
So I consider myself a jack of some trades and a master of none.

25
00:02:07,460 --> 00:02:12,360
I'm not especially good at anything that I do, I like to think, but I have a lot of interests.

26
00:02:12,360 --> 00:02:14,860
So lately I've been doing a lot of Bluetooth stuff.

27
00:02:14,860 --> 00:02:18,320
Bluetooth has kind of become my pet project, right?

28
00:02:18,320 --> 00:02:28,180
Studying Bluetooth vulnerabilities and techniques for car hacking as it relates to what I do at work, as well as things like RF, digital forensics and USB.

29
00:02:28,180 --> 00:02:31,960
My other hobbies are listed down there and, you know, they're not incredibly interesting.

30
00:02:32,020 --> 00:02:37,440
But the picture in the background, you might be able to see this is me.

31
00:02:37,440 --> 00:02:42,400
And this was my team for the 2019 Car Hacking Village CTF.

32
00:02:42,400 --> 00:02:47,640
So my team actually came in first place, we're Team Canucks, we're the best and no one is better than us.

33
00:02:47,720 --> 00:02:52,280
And I think it's just worth saying, right, just more for the qualification.

34
00:02:52,460 --> 00:02:57,260
But anyway, enough about me, enough of that boring stuff, let's get into the actual presentation.

35
00:02:57,540 --> 00:02:59,120
So what is Bluetooth?

36
00:02:59,740 --> 00:03:03,100
Bluetooth is a very common cable replacement technology.

37
00:03:03,100 --> 00:03:06,880
It's found in virtually all smartphones, all computers.

38
00:03:06,880 --> 00:03:14,820
And a lot of the wireless IoT devices worldwide use Bluetooth as their main mode of transportation.

39
00:03:14,840 --> 00:03:16,620
Communication, right?

40
00:03:16,740 --> 00:03:23,240
It operates in the 2.4 gigahertz frequency range, which is the same as some of the Wi-Fi standards, right?

41
00:03:23,240 --> 00:03:24,800
The 802.11 standards.

42
00:03:24,800 --> 00:03:30,760
And as a result, there's a lot of Wi-Fi chips that are bundled together with like a Bluetooth chip, right?

43
00:03:30,760 --> 00:03:41,780
So some manufacturers that make both Wi-Fi and Bluetooth hardware, they'll actually bundle those together because they're pretty similar from a physical frequency perspective, right?

44
00:03:42,660 --> 00:03:52,120
Some of the more unique things about Bluetooth compared to Wi-Fi, though, is that it utilizes something called frequency hopping, which makes it harder to monitor, right?

45
00:03:52,120 --> 00:04:00,240
Which is something I'll talk a little bit more about when we get to why Bluetooth is such a hard technology to research from a security standpoint, right?

46
00:04:00,240 --> 00:04:07,620
But I'm sure that at this point, you know, for most of you, Bluetooth is something you talk about in your everyday life, right?

47
00:04:07,620 --> 00:04:10,520
Like if you're using AirPods, they're using Bluetooth, right?

48
00:04:10,520 --> 00:04:17,600
If you connect your phone to your car stereo system, which, by the way, we'll be talking about, you're using Bluetooth, right?

49
00:04:17,660 --> 00:04:23,580
So in automotive, Bluetooth is mostly used for, well, exactly what I mentioned earlier, right?

50
00:04:23,580 --> 00:04:28,760
Connecting to your vehicle's stereo system, sharing your phone book with your car, right?

51
00:04:28,760 --> 00:04:33,620
That's a source of confidential information, which is, of course, of interest from a security perspective.

52
00:04:33,820 --> 00:04:41,520
But the main task delegated to Bluetooth is not, you know, a very high-impact one.

53
00:04:41,520 --> 00:04:45,600
It's mostly just controlling your music, you know, hands-free phone calls, etc.

54
00:04:46,100 --> 00:04:52,300
And, you know, things like your phone book access so that you can actually see who's calling you when you're on the road and you receive a text message.

55
00:04:52,300 --> 00:04:55,600
You know, some cars will actually support text message integration, too, right?

56
00:04:55,600 --> 00:04:59,620
So this is the basic use case for Bluetooth in automotive, right?

57
00:04:59,620 --> 00:05:08,200
And this is probably common sense to a lot of you, but what might be less common sense is how the Bluetooth protocol is actually organized.

58
00:05:08,220 --> 00:05:12,560
So I said Bluetooth protocol, but Bluetooth itself is actually a specification.

59
00:05:12,560 --> 00:05:14,800
It's not one specific technology.

60
00:05:14,800 --> 00:05:19,920
It is a set of specifications maintained by a company, or rather, it's a group.

61
00:05:19,920 --> 00:05:23,540
It's a group of companies called the Bluetooth Special Interest Group, right?

62
00:05:23,540 --> 00:05:36,980
They manage the specification for Bluetooth, they publish the standard, and they kind of monitor how it's performing, you know, make updates to it whenever a new version of the technology comes out.

63
00:05:36,980 --> 00:05:48,420
But at the end of the day, it's up to each individual manufacturer to actually implement the Bluetooth, you know, stack on their hardware however they like, right?

64
00:05:48,420 --> 00:05:54,080
And so this is where we get to the big divide in the different protocols that make up Bluetooth, right?

65
00:05:54,080 --> 00:06:00,540
So you can see on the screen here, I have the different protocols that make up Bluetooth split into a couple of categories.

66
00:06:00,540 --> 00:06:03,320
We have the blue ones up here, the RFComm, right?

67
00:06:03,320 --> 00:06:07,900
Radio Frequency Communication, SDP, Service Discovery Protocol, L2Cap.

68
00:06:07,900 --> 00:06:10,260
This is logical something.

69
00:06:10,260 --> 00:06:16,940
I don't remember what this stands for exactly, but it's one of the higher layer protocols, right?

70
00:06:16,940 --> 00:06:20,080
And then down here, you have the ones in red, right?

71
00:06:20,080 --> 00:06:25,360
This is Device Manager, Link Manager, Baseband Resource Manager, Link Controller, and the PHY, right?

72
00:06:25,360 --> 00:06:28,240
And then in the middle, you have the Host Controller Interface, right?

73
00:06:28,240 --> 00:06:30,920
Which begs the question, what does that mean, Host Controller Interface?

74
00:06:30,920 --> 00:06:34,640
Well, I made this box here purple for a reason, right?

75
00:06:34,640 --> 00:06:37,080
So the ones on the top, they're blue, right?

76
00:06:37,080 --> 00:06:39,680
These are controlled by the host, right?

77
00:06:39,680 --> 00:06:40,580
Your operating system.

78
00:06:40,580 --> 00:06:44,840
Your operating system will have its own Bluetooth stack.

79
00:06:44,840 --> 00:06:48,600
And according to that Bluetooth stack, it operates in a certain way, right?

80
00:06:48,600 --> 00:06:56,040
So for those of you who are familiar with Linux, BlueZ is one of the more common Bluetooth stacks running on most Linux distributions.

81
00:06:56,240 --> 00:07:00,840
And it's made specifically for Linux, right?

82
00:07:00,840 --> 00:07:02,740
But then the controller side, right?

83
00:07:02,740 --> 00:07:04,860
We have Host Controller Interface.

84
00:07:04,860 --> 00:07:14,080
So the reason this whole architecture exists is because it makes it easier to interface with different hardware from the actual hardware manufacturers, right?

85
00:07:14,080 --> 00:07:24,860
Because they kind of abstract away everything that happens down here through the Host Controller Interface, the host doesn't need to worry too much about what's going on down here, right?

86
00:07:24,860 --> 00:07:29,080
So these are controller side protocols, right?

87
00:07:29,080 --> 00:07:36,800
And each one of these is going to be programmed a different way based on the actual manufacturer of the hardware itself.

88
00:07:36,800 --> 00:07:45,180
And by the hardware, I'm not talking about your laptop manufacturer, I'm talking about the actual Bluetooth chip manufacturer, right?

89
00:07:48,080 --> 00:07:52,560
So going over a short history of Bluetooth security, right?

90
00:07:52,560 --> 00:08:01,340
When Bluetooth first came out in the early 2000, there were a lot of gimmicks that exploited like protocol level issues in early Bluetooth, right?

91
00:08:01,340 --> 00:08:09,080
I would call these like... I call them gimmicks because they're kind of like, okay, the first time they designed it, they decided encryption wasn't important.

92
00:08:09,080 --> 00:08:11,880
So they didn't include encryption, right?

93
00:08:11,880 --> 00:08:13,420
For certain things like that.

94
00:08:13,420 --> 00:08:21,620
So a lot of these were fixed in 2007, when the Bluetooth 2.1 plus extended data rate update arrived, right?

95
00:08:21,620 --> 00:08:27,900
This introduced mandatory encryption for connection based data, except for service discovery protocol.

96
00:08:28,220 --> 00:08:30,700
And it introduced secure simple pairing, right?

97
00:08:30,700 --> 00:08:35,420
So legacy pairing was the process by which Bluetooth devices connected before this.

98
00:08:36,040 --> 00:08:40,540
The only way you could pair two devices was through inputting a pin, right?

99
00:08:40,540 --> 00:08:42,020
So a four digit pin, right?

100
00:08:42,020 --> 00:08:44,380
So 0000 or 1234, right?

101
00:08:44,380 --> 00:08:50,280
This sounds like a good enough way to do authentication for the connection process between two trusted devices.

102
00:08:50,280 --> 00:08:52,980
But for some devices, right?

103
00:08:52,980 --> 00:08:57,600
Say, for example, a pair of cheap Bluetooth headphones you bought online, they don't have a user interface.

104
00:08:57,600 --> 00:09:03,260
So you can't really pick the pin that the corresponding connecting cell phone is supposed to put in, right?

105
00:09:03,260 --> 00:09:08,580
So they usually be hard coded with something like 0000 or 1234, right?

106
00:09:08,580 --> 00:09:10,840
And this was kind of a bad system.

107
00:09:10,840 --> 00:09:16,320
And so that's why they introduced secure simple pairing, which introduced a couple of more options for pairing your device.

108
00:09:16,320 --> 00:09:21,580
So now they have passkey, you know, they still have the passkey input, but then they also have numerical comparison.

109
00:09:21,580 --> 00:09:24,120
They also have out of band, right?

110
00:09:24,120 --> 00:09:29,140
Out of band pairing is essentially you pair through a different mechanism other than Bluetooth, right?

111
00:09:29,140 --> 00:09:35,480
So you might have like NFC or something else, another technology entirely used to do the pairing.

112
00:09:35,480 --> 00:09:38,740
But then the actual data transfer, et cetera, is done over Bluetooth.

113
00:09:38,740 --> 00:09:42,000
And there's another one called just works, which is exactly what it sounds like.

114
00:09:42,000 --> 00:09:43,740
And it needs to go, to be honest.

115
00:09:43,740 --> 00:09:47,740
It's essentially no authentication at all.

116
00:09:48,320 --> 00:09:59,000
But that's for things like I mentioned earlier, things like headphones that don't have a user interface or like a keyboard or monitor where you can actually do a number comparison.

117
00:09:59,000 --> 00:10:02,200
They have to have something in place to work.

118
00:10:02,200 --> 00:10:04,560
So they introduced just works.

119
00:10:04,760 --> 00:10:11,040
But anyway, so after that happened, right, after the introduction of secure simple pairing, sorry, I got a little bit sidetracked.

120
00:10:11,040 --> 00:10:18,300
There was a pretty long year, long period of about eight years where there wasn't a lot of research done on Bluetooth.

121
00:10:18,300 --> 00:10:18,600
Right.

122
00:10:18,600 --> 00:10:21,160
So mostly old gimmicks didn't work anymore.

123
00:10:21,220 --> 00:10:28,500
Bluetooth low energy, which came out alongside Bluetooth 4.0, started out pretty insecure and was a pretty hot topic for research.

124
00:10:28,820 --> 00:10:31,640
But eventually a lot of those got patched out.

125
00:10:31,640 --> 00:10:38,020
And I think nowadays, Bluetooth low energy is getting closer to traditional Bluetooth security grade.

126
00:10:38,020 --> 00:10:38,360
Right.

127
00:10:38,360 --> 00:10:39,300
And so.

128
00:10:39,860 --> 00:10:56,220
What I mean by the traditional Bluetooth security grade is after all those protocol level bugs got, you know, hammered out, it's not it wasn't as easy to do research of Bluetooth, because if you think about it in comparison to Wi-Fi, I made that comparison earlier because they're very physical.

129
00:10:56,680 --> 00:11:03,080
Sorry, they're very similar from the physical perspective that they both occupy the 2.4 gigahertz space.

130
00:11:03,080 --> 00:11:09,160
Bluetooth uses that frequency hopping, which makes it a little bit harder to analyze.

131
00:11:09,160 --> 00:11:17,400
You can't buy a 10, 15 dollar Bluetooth sniffer online and just monitor Bluetooth traffic going through the air.

132
00:11:17,400 --> 00:11:17,900
Right .

133
00:11:17,900 --> 00:11:19,280
Another thing.

134
00:11:19,280 --> 00:11:19,600
Sorry.

135
00:11:19,600 --> 00:11:21,940
So I have a couple of these listed.

136
00:11:21,940 --> 00:11:22,180
Right.

137
00:11:22,180 --> 00:11:25,900
These problems surrounding Bluetooth security research.

138
00:11:25,900 --> 00:11:26,280
Right.

139
00:11:26,280 --> 00:11:32,240
So one of these one of the other problems, you know, I mentioned the earlier that it's not a specific technology.

140
00:11:32,240 --> 00:11:41,720
It's a specification defined by the Bluetooth special interest group and that the implementations will vary based on the operating environments and the chip firmware implementations.

141
00:11:41,740 --> 00:11:42,220
Right.

142
00:11:42,560 --> 00:11:49,060
And I also talked about how the frequency hopping means so you can't actually sniff it out of the air like you can with Wi-Fi.

143
00:11:49,060 --> 00:11:54,940
There does exist equipment for that, but that's going to cost about twenty thousand dollars minimum.

144
00:11:54,940 --> 00:11:55,100
Right.

145
00:11:55,100 --> 00:12:01,600
Like these are very high grade, like I would say, like government, military grade equipment.

146
00:12:01,600 --> 00:12:05,640
You cannot be expected to buy this if you want to do research on Bluetooth.

147
00:12:05,640 --> 00:12:06,300
Right.

148
00:12:06,780 --> 00:12:15,940
So and then what I mentioned before, I'm going to go back a couple of slides and show you the breakdown of the different the different protocols.

149
00:12:15,940 --> 00:12:16,740
Right.

150
00:12:17,320 --> 00:12:23,180
It's not as easy to analyze the lower level protocols as it should be.

151
00:12:23,180 --> 00:12:23,220
Right.

152
00:12:23,220 --> 00:12:25,500
Because if we think about this here.

153
00:12:25,500 --> 00:12:25,660
Right.

154
00:12:25,660 --> 00:12:28,300
So you have your your host layer protocols, right.

155
00:12:28,300 --> 00:12:30,480
RFCOM, STP and L2CAP.

156
00:12:30,800 --> 00:12:44,840
And these are decently well explored and the host controller interface exists and you have the ability to log host controller interface data on all Linux and all Android platforms, which I'll be showing later on in the presentation.

157
00:12:44,840 --> 00:12:53,040
But all of these red processes, all of these red protocols are essentially a black box.

158
00:12:53,040 --> 00:13:01,800
And because they're going to be so different from manufacturer to manufacturer, you know, there's no real understanding of what's going on inside these chips.

159
00:13:01,800 --> 00:13:02,200
Right.

160
00:13:02,200 --> 00:13:11,920
So that's another reason why security and Bluetooth is has been kind of on the down low for, you know, for a while, up until pretty recently.

161
00:13:11,920 --> 00:13:12,520
Right.

162
00:13:12,920 --> 00:13:17,960
And, you know, I said the spec is very complicated.

163
00:13:17,960 --> 00:13:19,460
And that is a big part of it.

164
00:13:19,460 --> 00:13:19,680
Right.

165
00:13:19,680 --> 00:13:33,540
Because, you know, there are certain parts of the Bluetooth specification that you wouldn't you wouldn't from a security perspective, you wouldn't assume that somebody read this and said, yes, this is OK, and then put it into the spec.

166
00:13:33,540 --> 00:13:39,120
And then it went undetected for, you know, since the birth of Bluetooth until last year, actually.

167
00:13:39,120 --> 00:13:39,360
Right.

168
00:13:39,360 --> 00:13:42,840
The this scenario I'm talking about actually happened.

169
00:13:42,840 --> 00:13:56,480
A vulnerability was released that essentially disclosed the fact that any Bluetooth device, when it's pairing with another device, it has the option to negotiate the entropy of the encryption keys used for the communication.

170
00:13:56,480 --> 00:13:57,320
Right.

171
00:13:57,320 --> 00:14:02,200
OK, that's a sounds like a good idea from from one perspective.

172
00:14:02,200 --> 00:14:02,620
Right.

173
00:14:02,620 --> 00:14:12,380
You have the option to if you have hardware that only supports, say, you know, a couple of bytes of entropy, you can negotiate, say, OK, well, I can only support this much.

174
00:14:12,380 --> 00:14:15,160
So can you please lower the security of the communication?

175
00:14:15,160 --> 00:14:15,280
Right.

176
00:14:15,280 --> 00:14:16,220
It's a compatibility thing.

177
00:14:16,220 --> 00:14:29,100
But the researchers that published the vulnerability found out that the minimum, according to the Bluetooth specification, right, the minimum allowed entropy for this encryption was only one byte.

178
00:14:29,100 --> 00:14:46,540
So they could forcibly, by modifying the firmware of one of their devices, they could negotiate down the connection, you know, the encryption entropy of the connection they were making down to one byte of encryption.

179
00:14:46,540 --> 00:14:46,740
Right.

180
00:14:46,740 --> 00:14:56,100
And one byte of encryption, one byte of entropy for encryption, sorry, is enough to essentially brute force in real time and monitor Bluetooth communications.

181
00:14:56,100 --> 00:14:56,160
Right.

182
00:14:56,160 --> 00:14:59,860
If you have some some cheaper hardware, you don't need the twenty thousand dollar hardware.

183
00:14:59,860 --> 00:15:06,580
You need some slightly less expensive hardware and you can actually sniff some of the packets, some of the packets out of the air.

184
00:15:06,580 --> 00:15:07,120
Right.

185
00:15:09,040 --> 00:15:11,980
That vulnerability itself is pretty interesting.

186
00:15:11,980 --> 00:15:13,180
It's called NOB.

187
00:15:13,180 --> 00:15:13,380
Right.

188
00:15:13,380 --> 00:15:14,760
K-N-O-B.

189
00:15:14,760 --> 00:15:15,020
Right.

190
00:15:15,020 --> 00:15:18,340
It's an acronym for key negotiation of Bluetooth.

191
00:15:18,420 --> 00:15:23,720
I'm not going to go too far in detail on that one because I have a couple more things I want to talk about.

192
00:15:23,860 --> 00:15:35,660
But that is a good segue into the fact that recently there has been more of a look at Bluetooth security, especially from some labs out in Europe.

193
00:15:35,660 --> 00:15:41,080
They have been putting out a lot of great research that I'll have linked to in the end of this demonstration.

194
00:15:41,280 --> 00:15:43,800
But back to the automotive things.

195
00:15:43,800 --> 00:15:46,940
I'm kind of going in circles because there's a lot to talk about here.

196
00:15:46,940 --> 00:15:59,160
But coming full circle to the automotive side of things, this is a diagram from a piece of research that was published by Tencent's Keen Security Labs.

197
00:15:59,160 --> 00:16:02,080
They published this in March of 2020.

198
00:16:02,080 --> 00:16:04,780
So this is really cutting edge research.

199
00:16:04,780 --> 00:16:18,860
Basically, there were some unpatched Bluetooth vulnerabilities on some Toyota vehicles that were in circulation that had been made outside of Japan, I want to say as early as 2016 or 2017.

200
00:16:19,720 --> 00:16:22,520
Unpatched Blueborn led to daemon level access.

201
00:16:22,520 --> 00:16:27,600
For any of you that have followed Bluetooth security at all, you might have heard of Blueborn before.

202
00:16:27,600 --> 00:16:40,980
Blueborn was a series of high profile Bluetooth vulnerabilities that were released, or I guess publicized, I believe in 2017 by Armist Labs.

203
00:16:41,080 --> 00:16:44,400
That's the name of the lab that came up with these vulnerabilities.

204
00:16:44,460 --> 00:16:53,920
It was essentially the ability to remotely execute code on any device that had Bluetooth enabled, even if the device wasn't in discoverable mode.

205
00:16:53,920 --> 00:17:06,300
Discoverable mode is when you make your Bluetooth device visible for the intent of pairing with another device, you have to make it visible through discoverable mode just so that it's easier to find.

206
00:17:06,300 --> 00:17:20,200
But they essentially showed that even without having to pair with the device, without the device being in discoverable mode, they could execute code on any device running Bluetooth remotely.

207
00:17:20,200 --> 00:17:46,020
The scenario behind this disclosure that happened this year by Tekine Labs, they showed that through exploiting these unpatched vulnerabilities in these automotive head units inside these Toyota slash Lexus vehicles, they were able to gain daemon level remote code execution because the Bluetooth service on the main board here,

208
00:17:46,020 --> 00:17:52,340
this board here, this is a wiring, a logical diagram of the inside of that head unit.

209
00:17:52,340 --> 00:17:57,640
This main board, which is running the Bluetooth service, was running Bluetooth at a pretty high privilege.

210
00:17:57,660 --> 00:18:00,040
It was running it at a daemon level privilege.

211
00:18:00,580 --> 00:18:10,140
So from there, they were actually able to get remote code execution, escalating privileges to root and establishing a Wi-Fi backdoor was the next thing they did.

212
00:18:10,140 --> 00:18:20,520
So they made a Wi-Fi backdoor that allowed them to SSH back into it from a slightly longer range than Bluetooth allows, because Wi-Fi has a better operating range than Bluetooth does.

213
00:18:20,740 --> 00:18:34,280
And through that, they were then able to make use of this main board's position inside the head unit to actually push updates to some of the other devices inside the head unit.

214
00:18:34,280 --> 00:18:36,460
Specifically, this UConn board.

215
00:18:36,460 --> 00:18:43,400
This UConn board is connected to the CAN buses that the head unit itself is connected to.

216
00:18:43,400 --> 00:18:53,680
And for those of you who are coming from an automotive background and just wanted to learn a little bit about Bluetooth, you know that being connected to the CAN bus is essentially getting access to the car's nervous system.

217
00:18:53,680 --> 00:19:01,840
This is the in-vehicle, the controller area network, the in-vehicle network, along which a lot of the vehicle controls happen.

218
00:19:01,840 --> 00:19:10,420
So long story short, I could talk about this particular bit of research for about an hour on its own.

219
00:19:10,420 --> 00:19:24,700
But long story short, Bluetooth vulnerability led to further exploitation in the installation of a backdoor, which allowed the researchers to reflash this UConn board, which, by the way, didn't have any checks on the software that was pushed to it for updating it,

220
00:19:24,700 --> 00:19:26,800
which is an entirely separate problem.

221
00:19:26,800 --> 00:19:34,120
But we're then able to pivot from there onto both the CAN buses, the dedicated CAN bus and the infotainment CAN bus.

222
00:19:34,120 --> 00:19:44,200
One of the lucky, I suppose, features of this entire scenario is that the CAN buses were pretty well segregated by this central gateway ECU.

223
00:19:44,200 --> 00:19:53,420
So despite having this foothold, it was a big deal that the vehicle's steering, braking and acceleration were actually not affected.

224
00:19:53,420 --> 00:20:00,700
I believe that is in part due to the central gateway in place and the fact that the different CAN buses were physically separated.

225
00:20:01,800 --> 00:20:05,260
But anyway, that's a good, you know, just a good point to keep in mind.

226
00:20:05,360 --> 00:20:08,540
I'm going to double check and make sure there are no points I missed.

227
00:20:08,540 --> 00:20:15,820
So, yeah, one of the things that they had to do the updating for was the ability to remove filters on arbitrary CAN message sending.

228
00:20:15,820 --> 00:20:24,140
So that's the update that they actually sent to the UConn board was the ability to, they added the ability to send arbitrary CAN messages.

229
00:20:24,500 --> 00:20:29,340
The full technical report isn't out, but it's hopefully scheduled to be released in 2021.

230
00:20:29,820 --> 00:20:34,700
And it really, you know, anybody can say how well the rest of 2020 is going to go.

231
00:20:35,080 --> 00:20:40,900
But anyway, we have now time for a live demo.

232
00:20:40,900 --> 00:20:41,160
Right.

233
00:20:41,160 --> 00:20:46,180
So this is going to be a quick demo showing how to get started with Bluetooth in a Linux environment.

234
00:20:46,720 --> 00:20:50,440
As always, when it comes to live demos, you know, something always goes wrong.

235
00:20:50,440 --> 00:20:57,560
I actually have a automotive head unit that I was hoping to show a live interaction with it through Bluetooth.

236
00:20:57,560 --> 00:21:01,840
But unfortunately, today it decided it didn't want to stay on.

237
00:21:01,840 --> 00:21:04,980
So I'm going to be actually just showing how those Bluetooth tools work.

238
00:21:04,980 --> 00:21:12,520
But I'm going to be using my cell phone as the target for analysis instead.

239
00:21:12,520 --> 00:21:17,140
So I will switch over to my virtual machine and we'll head right back into the recording.

240
00:21:18,400 --> 00:21:22,760
OK, so let me increase the font size here.

241
00:21:23,200 --> 00:21:24,340
How's that look?

242
00:21:24,340 --> 00:21:25,700
A little bit bigger.

243
00:21:26,320 --> 00:21:34,940
OK, so for any of you wondering, I'm running a stock Kali Linux distribution on this virtual machine right on my Windows desktop.

244
00:21:35,360 --> 00:21:40,400
I don't have anything incredibly interesting installed from a Bluetooth perspective.

245
00:21:40,400 --> 00:21:47,220
So all of the tools I'm going to be showing are actually available in Kali Linux, you know, as you know, fresh upon installation.

246
00:21:47,220 --> 00:21:47,380
Right.

247
00:21:47,380 --> 00:21:49,220
So there's no there's no fancy software.

248
00:21:49,220 --> 00:21:50,960
It's no secret hardware I'm using.

249
00:21:50,960 --> 00:21:54,460
I'm just using the Bluetooth chip inside my computer.

250
00:21:54,460 --> 00:22:02,180
I want to give a disclaimer that sometimes things get a little bit strange if you use Bluetooth through a virtual machine.

251
00:22:02,180 --> 00:22:11,720
The reason is because your virtual machine and the actual hardware and your actual host machine are sharing the same hardware, right?

252
00:22:11,720 --> 00:22:13,140
The same Bluetooth hardware.

253
00:22:13,140 --> 00:22:19,600
So if I start connecting to something with my virtual machine, it will sometimes confuse the host machine.

254
00:22:19,600 --> 00:22:22,580
And that's, you know, it's a little bit of an annoyance.

255
00:22:22,580 --> 00:22:28,340
But for the sake of today's educational demonstration, I think we can we can live with that.

256
00:22:28,340 --> 00:22:28,760
Right.

257
00:22:29,020 --> 00:22:39,560
So the first thing I need to say, of course, a disclaimer that we're not I'm not going to be showing any, you know, vulnerabilities or exploits, you know, that could lead to compromise of any systems.

258
00:22:39,560 --> 00:22:39,860
Right.

259
00:22:39,860 --> 00:22:50,580
I'm just going to be showing some basic surveillance tools and showing what you can find very easily with the proper knowledge, with some, you know, open source software.

260
00:22:50,580 --> 00:22:54,580
I'm not talking about anything incredibly expensive, you know, you know how it is.

261
00:22:54,620 --> 00:23:03,960
But, you know, it's important that we understand, you know, the whole purpose behind all of this is that we understand what security risks might be present in the vehicles we operate.

262
00:23:03,960 --> 00:23:09,720
You know, the other devices running Bluetooth, any privacy concerns that might be, you know, unaddressed otherwise.

263
00:23:09,720 --> 00:23:10,100
Right.

264
00:23:10,100 --> 00:23:12,740
We don't learn these things in order to harm people.

265
00:23:12,840 --> 00:23:21,960
We use these techniques to arm ourselves with the appropriate knowledge to protect ourselves from those who may do us harm or may mean us harm.

266
00:23:21,960 --> 00:23:22,120
Right.

267
00:23:22,120 --> 00:23:27,340
Anyway, so now that that's out of the way, let's get to the actual interesting stuff.

268
00:23:27,340 --> 00:23:32,820
So the first thing I have to do is pseudo service Bluetooth start.

269
00:23:33,080 --> 00:23:33,380
Right.

270
00:23:33,380 --> 00:23:35,980
Put in my password and let that work.

271
00:23:35,980 --> 00:23:36,360
Right.

272
00:23:36,360 --> 00:23:44,560
So a lot of times, I don't know why this is, but the Bluetooth service will actually be disabled by default.

273
00:23:44,680 --> 00:23:45,080
Right.

274
00:23:45,080 --> 00:23:50,180
When you start up your device, you can actually change that in your settings so that it turns on by default.

275
00:23:50,180 --> 00:23:52,860
But whether or not you want to do that is up to you.

276
00:23:53,080 --> 00:24:00,240
But in any case, the next thing we're going to do is check what Bluetooth controllers are available on our machine.

277
00:24:00,240 --> 00:24:03,680
So that's done in Linux with hci-config.

278
00:24:03,680 --> 00:24:03,980
Right.

279
00:24:03,980 --> 00:24:07,260
That's host control interface configuration.

280
00:24:07,400 --> 00:24:12,040
So this now here shows all of the devices I have, all the Bluetooth devices.

281
00:24:12,040 --> 00:24:13,620
I have just one right now.

282
00:24:13,620 --> 00:24:19,500
I have my internal, you know, my laptop's Bluetooth chip.

283
00:24:19,500 --> 00:24:19,780
Right.

284
00:24:19,800 --> 00:24:21,660
Primary bus is USB.

285
00:24:21,660 --> 00:24:26,540
Depending on how your computer is built, this might actually be something different like I2C.

286
00:24:26,680 --> 00:24:26,780
Right.

287
00:24:26,780 --> 00:24:27,400
So on and so forth.

288
00:24:27,400 --> 00:24:29,640
But the way mine is, is set up to be USB.

289
00:24:29,640 --> 00:24:33,840
You can see the Bluetooth address of that Bluetooth chip.

290
00:24:33,840 --> 00:24:34,240
Right.

291
00:24:34,240 --> 00:24:37,620
Mine is currently up and it's running a PSCAN right now.

292
00:24:37,680 --> 00:24:43,660
You can see a lot more information if you say pseudo hci-config-a.

293
00:24:43,660 --> 00:24:43,960
Right.

294
00:24:43,960 --> 00:24:45,620
We can see a little bit more now.

295
00:24:45,620 --> 00:24:45,840
Right.

296
00:24:45,840 --> 00:24:47,940
So we see the same information as before.

297
00:24:47,940 --> 00:24:49,100
We have the Bluetooth address.

298
00:24:49,100 --> 00:24:50,120
We have the status.

299
00:24:50,120 --> 00:24:51,440
You know, it's up and it's running.

300
00:24:51,440 --> 00:24:56,420
We see I haven't really sent very much, so I don't have any errors.

301
00:24:56,420 --> 00:24:59,440
You know, nothing incredibly special is happening here.

302
00:24:59,620 --> 00:25:02,580
And most of this information isn't incredibly useful.

303
00:25:02,720 --> 00:25:02,940
Right.

304
00:25:02,940 --> 00:25:07,240
Like off, you know, off the bat, it's not incredibly useful.

305
00:25:07,240 --> 00:25:08,300
I'll be perfectly honest.

306
00:25:08,300 --> 00:25:08,700
Right.

307
00:25:08,700 --> 00:25:11,400
But there are a couple of interesting things here.

308
00:25:11,400 --> 00:25:12,720
For example, the name.

309
00:25:12,720 --> 00:25:13,100
Right.

310
00:25:13,100 --> 00:25:14,200
Name is Kali.

311
00:25:14,200 --> 00:25:32,020
This is how my device appears when I go into discoverable mode and another device kind of scans me or finds my device through its scan for Bluetooth devices, because that's how Bluetooth devices find one another is they do a scan and any device that's discoverable in your area,

312
00:25:32,020 --> 00:25:33,280
you'll be able to pick up on it.

313
00:25:33,280 --> 00:25:33,360
Right.

314
00:25:33,360 --> 00:25:35,140
I'll be showing that in just a quick second.

315
00:25:35,180 --> 00:25:40,760
So more than that, there is this class object here.

316
00:25:40,760 --> 00:25:41,100
Right.

317
00:25:41,100 --> 00:25:45,880
So the class in this scenario is talking about the class of device.

318
00:25:45,880 --> 00:26:01,840
This, you know, this one, two, three, four, five, six, this three byte number or, you know, hexadecimal number is actually used to identify what type of device belongs to this or this Bluetooth chip belongs to.

319
00:26:01,840 --> 00:26:10,480
So the class will identify your device as a phone, as a laptop, as a desktop, as a pair of headphones, so on and so forth.

320
00:26:10,480 --> 00:26:20,740
Sometimes this is a big deal, right, because if you think about a car, most cars aren't designed with the expectation that they'll connect to a laptop over Bluetooth.

321
00:26:20,740 --> 00:26:34,620
It's not like the most outlandish thing to think in the world, but a lot of cars will actually refuse Bluetooth connections from devices that have their class identifying them as, you know, a laptop or a desktop computer.

322
00:26:34,620 --> 00:26:45,940
So depending on the actual type of Bluetooth chip you're using, you might be able to change the class of device that your device actually identifies as, right?

323
00:26:45,940 --> 00:26:51,840
So I don't believe I have the ability to do that with my internal laptop Bluetooth chip, right?

324
00:26:51,840 --> 00:26:57,880
This is entirely a metric of the Bluetooth chip installed inside of my laptop.

325
00:26:57,880 --> 00:27:02,060
I'm actually going to go ahead and give it a shot and see if I can change it, right?

326
00:27:02,060 --> 00:27:09,460
But the first thing I'll do is I'll show you guys, right, hci-config-hci0-class.

327
00:27:09,460 --> 00:27:13,260
This will give us a little bit more information about what my class is reporting, right?

328
00:27:13,500 --> 00:27:16,680
Currently my class is set to 0c0000.

329
00:27:18,080 --> 00:27:21,220
This is actually, I think, because I'm using a virtual machine, right?

330
00:27:21,220 --> 00:27:22,620
It's just labeled as miscellaneous.

331
00:27:22,620 --> 00:27:30,200
It doesn't have a actual, you know, real class of device because this is a virtual machine.

332
00:27:30,200 --> 00:27:31,920
But let's see if I can't change it, right?

333
00:27:31,920 --> 00:27:33,440
I'm actually doing this for the first time.

334
00:27:33,440 --> 00:27:35,120
I've never done this myself on this machine.

335
00:27:35,120 --> 00:27:46,220
But if I go for sudo hci-config-hci0-class and I enter the class ID I want to set it as 0x5a020c.

336
00:27:46,220 --> 00:27:47,720
I know that's for cell phone.

337
00:27:48,720 --> 00:27:50,620
Huh, let's see if that worked.

338
00:27:50,740 --> 00:27:52,320
Oh, there we go, right?

339
00:27:52,320 --> 00:28:00,540
So now I've successfully changed the class of device associated with my Bluetooth chip to that of a cell phone.

340
00:28:00,540 --> 00:28:03,800
So see the device class here now shows phone, smartphone.

341
00:28:03,800 --> 00:28:10,140
So you might be familiar with this, like when you're trying to pair your phone to your car, right?

342
00:28:10,140 --> 00:28:19,940
When you're searching for your car on your cell phone in the Bluetooth menu, it'll actually show like a little symbol next to each device, kind of giving you an idea of what kind of device that is, right?

343
00:28:19,940 --> 00:28:21,080
Is it a pair of headphones?

344
00:28:21,080 --> 00:28:26,740
Is it like, it'll show like a laptop, like a little, you know, clipart laptop if it's an actual computer, right?

345
00:28:26,740 --> 00:28:28,780
Or if it's another smartphone, it'll show a smartphone.

346
00:28:28,780 --> 00:28:36,220
So now when I scan or go discoverable with my laptop, it will display itself as though it was a smartphone, right?

347
00:28:36,220 --> 00:28:46,000
This is useful for spoofing if you want to copy someone else's device and try and do some research on intercepting a, you know, pairing request, for example.

348
00:28:46,000 --> 00:28:52,200
That's, you know, that's, you're getting very, very creative there at that point, right?

349
00:28:52,200 --> 00:28:54,480
But, you know, I'm glad this worked out.

350
00:28:54,480 --> 00:28:56,220
This gives me something to show for.

351
00:28:56,300 --> 00:28:58,480
But anyway, on with the demonstration, right?

352
00:28:58,480 --> 00:29:08,860
So the first, you know, in general, when you're doing a security test, the first thing you need to learn how to do is actually find what you're looking for, right?

353
00:29:08,860 --> 00:29:11,080
And so that means you need to scan.

354
00:29:11,080 --> 00:29:13,120
So HCI tool, scan.

355
00:29:13,120 --> 00:29:22,620
Let me, so because like I mentioned before, the actual device I'm using, the, or I wanted to use the extracted head unit currently isn't working.

356
00:29:22,620 --> 00:29:27,740
I'm going to actually turn Bluetooth on on my smartphone, and we're going to see if I can't find it by scanning.

357
00:29:27,740 --> 00:29:30,820
So HCI tool, scan, scanning, scanning.

358
00:29:30,820 --> 00:29:33,840
I'm currently discoverable, so it should pop up any minute now.

359
00:29:34,100 --> 00:29:38,080
If it doesn't, I'll have to think fast because, well, okay.

360
00:29:38,080 --> 00:29:39,540
Anyway, here we go.

361
00:29:39,540 --> 00:29:43,140
Okay, so this is my, these are my headphones, right?

362
00:29:43,140 --> 00:29:46,500
The name is in Japanese, so don't worry about it if you can't read it.

363
00:29:46,500 --> 00:29:48,820
But this here is my cell phone, right?

364
00:29:48,820 --> 00:29:50,880
It shows my cell phone's name, right?

365
00:29:50,880 --> 00:29:54,720
This is the name that my cell phone broadcasts itself as over Bluetooth.

366
00:29:54,720 --> 00:29:57,020
And this is my cell phone's Bluetooth address, right?

367
00:29:57,020 --> 00:29:58,880
I don't mind sharing this information.

368
00:29:59,000 --> 00:30:01,640
There's not a whole lot you can do with this.

369
00:30:01,700 --> 00:30:06,160
But there is a little bit more than you think that you can do with this, right?

370
00:30:06,320 --> 00:30:13,100
And I'll show off some of the features of what's actually contained inside a Bluetooth address in just a second.

371
00:30:13,100 --> 00:30:18,920
So this basic scan here gives us a very basic idea of what's around us.

372
00:30:18,920 --> 00:30:32,200
But if we say instead, this sudo hci-tool info, and then I copy this, right, and paste it into my command line, it's requesting information from my phone.

373
00:30:32,200 --> 00:30:34,960
And now we have this whole little dump here.

374
00:30:34,960 --> 00:30:36,440
This dump is great, right?

375
00:30:36,440 --> 00:30:41,140
This is really, like, the first thing you want to do when you're testing a Bluetooth device.

376
00:30:41,140 --> 00:30:42,240
And I'll show you why.

377
00:30:42,240 --> 00:30:53,420
The first thing it shows you is the OUI company, the Organizationally Unique Identifier company, Samsung Electronics, right?

378
00:30:53,420 --> 00:30:54,500
I've been exposed.

379
00:30:54,500 --> 00:30:56,240
I'm using a Samsung phone, right?

380
00:30:56,240 --> 00:31:02,540
So you can find out what kind of phone I'm using without ever looking at my phone just by scanning my Bluetooth address, right?

381
00:31:02,540 --> 00:31:09,980
The reason for this is because the first half of a Bluetooth ID is actually this OUI.

382
00:31:09,980 --> 00:31:12,320
It's the Organizationally Unique Identifier.

383
00:31:12,320 --> 00:31:17,680
This identifier identifies Samsung Electronics Corporation, right?

384
00:31:17,680 --> 00:31:19,260
You see that DC748?

385
00:31:19,260 --> 00:31:21,420
It's right there, right?

386
00:31:21,420 --> 00:31:27,060
So all Samsung Galaxy S8 Pluses, I assume, will have this same Bluetooth address.

387
00:31:27,060 --> 00:31:39,680
I don't know if there are, like, sub-classifications for this, but, for example, what I mean by that is if there are...

388
00:31:39,680 --> 00:31:40,540
How should I say?

389
00:31:41,480 --> 00:31:47,020
I don't know if there are, like, different, like, lots of different Samsung Electronics OUIs.

390
00:31:47,020 --> 00:31:47,760
Maybe there are.

391
00:31:47,760 --> 00:31:51,720
I don't know exactly, but, you know, it might be.

392
00:31:51,720 --> 00:32:01,600
But the point is, the point is, there's actually a website, you know, where you can go and look up, I believe, on the Bluetooth Special Interest Group's website, they have a OUI lookup tool.

393
00:32:01,600 --> 00:32:03,580
So you can find any OUI, right?

394
00:32:03,580 --> 00:32:16,000
If you find it, you know, just by war driving in the street or something, and you find a device, but it doesn't return here, you might be able to look it up on the website and find out what kind of device or what the manufacturer of that device was.

395
00:32:16,820 --> 00:32:22,280
More interestingly here, right, is the actual LMP version of that device.

396
00:32:22,280 --> 00:32:24,520
So the LMP is the Link Manager Protocol.

397
00:32:24,960 --> 00:32:29,440
This is showing the version of the Link Manager Protocol that I'm running, right?

398
00:32:29,440 --> 00:32:34,720
And this information might come in handy because, you know, obviously the more information you have on your target, the better.

399
00:32:34,720 --> 00:32:41,800
You have more vectors by which to search for vulnerabilities or other ways to compromise the device, so on and so forth.

400
00:32:41,800 --> 00:32:50,140
So this is always a good bit of information to have because this will also give you information on what actual version of Bluetooth that device is running.

401
00:32:50,140 --> 00:32:57,660
But going on, so here, the manufacturer tab here, this is usually a big deal.

402
00:32:57,660 --> 00:33:00,420
I want to see if I can't find another Bluetooth device.

403
00:33:00,420 --> 00:33:11,500
Let's actually scan this one instead because I think that Samsung decided to obfuscate this, so it's not actually showing what the manufacturer is.

404
00:33:11,500 --> 00:33:19,480
But that manufacturer field is actually supposed to show the chip manufacturer.

405
00:33:20,040 --> 00:33:22,500
Okay, so this one isn't showing up either.

406
00:33:22,500 --> 00:33:25,940
This could be because I'm doing this on a virtual machine.

407
00:33:26,100 --> 00:33:35,960
I don't know why this is not showing an actual, how should I say, an actual company's name.

408
00:33:35,960 --> 00:33:45,260
Normally this will show something like Broadcom or Cambridge, you know, like any of the actual chip manufacturers, their name will usually show up here.

409
00:33:45,300 --> 00:33:52,100
This is the first time I've seen the whole not assigned thing, but well, not everything can go right, right?

410
00:33:52,100 --> 00:33:58,080
I mean, we already lost the head unit I wanted to test on.

411
00:33:58,080 --> 00:34:03,460
But anyway, now that we're here, we scan my headphones, you can see they're Bose Corporation.

412
00:34:03,620 --> 00:34:10,060
So any company that's making Bluetooth devices will usually have their own OUI registered, and you can find that out through here.

413
00:34:11,020 --> 00:34:16,120
I'm still not sure why this isn't showing up, but normally it does.

414
00:34:16,140 --> 00:34:17,680
I promise, I'm not making that up.

415
00:34:17,680 --> 00:34:29,340
Let me try and add one more device onto my Bluetooth network and see if I can't scan it and introduce another test subject.

416
00:34:29,340 --> 00:34:33,780
So let's scan, scanning, scanning, scanning.

417
00:34:34,080 --> 00:34:41,340
I just turned on my Xbox controller, so let's see if I can't find this through the Bluetooth scanning here.

418
00:34:41,340 --> 00:34:42,240
Aha!

419
00:34:42,240 --> 00:34:45,160
Okay, so we have this new address.

420
00:34:45,160 --> 00:34:49,660
Let's copy that and let's come over here and paste it.

421
00:34:49,660 --> 00:34:52,120
Let's see if we get lucky this time.

422
00:34:52,200 --> 00:34:53,620
So once again, not assigned.

423
00:34:53,620 --> 00:34:56,060
I don't know what's going on here.

424
00:34:56,060 --> 00:35:02,980
I suspect it might be an issue with the virtual machine setup, but that's surprising in and of itself.

425
00:35:02,980 --> 00:35:08,540
Anyway, so I've kind of gone in a circle here, wasting some of your time.

426
00:35:08,540 --> 00:35:12,640
I apologize for that, but let's get on with the rest of the tools.

427
00:35:12,780 --> 00:35:22,740
So after scanning, I mentioned earlier that one of the protocols running on the host side of Bluetooth is the Service Discovery Protocol.

428
00:35:22,740 --> 00:35:28,460
So Service Discovery Protocol is the only connection-based protocol that doesn't require encryption.

429
00:35:28,460 --> 00:35:38,020
And this is because what Service Discovery does is it advertises what services, what functionalities this Bluetooth device has.

430
00:35:38,020 --> 00:35:43,380
If it's a car, it's got to have phone book access, it's going to have audio-visual control.

431
00:35:43,380 --> 00:35:52,780
Each of these is its own set of functionalities that's dictated by those services.

432
00:35:52,780 --> 00:35:54,260
We call those services.

433
00:35:54,260 --> 00:36:01,580
So the way you actually look at what services are available on a device, right, let's go back to my cell phone and copy this here.

434
00:36:01,780 --> 00:36:03,140
Copy that.

435
00:36:03,480 --> 00:36:11,140
So if we come back down here to the command line and we go sdptool, Service Discovery Protocol tool, browse.

436
00:36:11,140 --> 00:36:12,660
I just paste that.

437
00:36:12,820 --> 00:36:16,080
Let's see if we can't ask it for some information.

438
00:36:16,080 --> 00:36:19,420
So sometimes it will refuse it based on the device.

439
00:36:19,420 --> 00:36:25,340
Sometimes you have to be paired with the device before it will actually concede any information to you.

440
00:36:25,660 --> 00:36:34,360
This is, the embarrassing part about this is that I wish I could tell you that all of these tricks worked 100% of the time, the first time, every time.

441
00:36:34,560 --> 00:36:37,680
Sometimes that's not, that doesn't actually work.

442
00:36:37,700 --> 00:36:40,340
Sometimes you have to just try it more than once.

443
00:36:40,340 --> 00:36:46,620
Sometimes the device just doesn't want to talk to you unless you do a fully established connection, right?

444
00:36:47,300 --> 00:36:52,340
So it looks like my cell phone is being pretty stubborn today, but...

445
00:36:57,020 --> 00:37:00,920
Okay, I might have to come back to this after I try and connect to it.

446
00:37:00,920 --> 00:37:02,500
Okay, yeah, so it looks like it's not working.

447
00:37:02,500 --> 00:37:09,940
But anyway, we're going to skip over Service Discovery Protocol and we're going to look at another part of Bluetooth in Linux, right?

448
00:37:09,940 --> 00:37:12,020
This is the last main thing I'm going to be showing.

449
00:37:12,080 --> 00:37:15,900
This is Bluetooth CTL.

450
00:37:15,900 --> 00:37:17,720
Bluetooth CTL is short for Bluetooth Control.

451
00:37:17,720 --> 00:37:23,120
This is the agent that BlueZ, right?

452
00:37:23,120 --> 00:37:28,620
The Linux Bluetooth Protocol stack uses to manage connections and stuff.

453
00:37:28,620 --> 00:37:34,480
So when I enter this, you know, Bluetooth Control, I get this like special little different terminal here, right?

454
00:37:34,480 --> 00:37:37,940
It's like blue and I have my own separate set of commands, right?

455
00:37:37,940 --> 00:37:40,620
Each of these is its own talk in itself.

456
00:37:40,620 --> 00:37:43,880
So I can't really go too far into detail, but I'll show you all the important ones.

457
00:37:43,880 --> 00:37:47,240
So the first one you want to show or I'd like to show is list, right?

458
00:37:47,240 --> 00:37:51,860
List will show me all of my controllers and it will tell you which one is the default controller, right?

459
00:37:51,860 --> 00:37:55,520
So this is important because sometimes you'll have more than one controller on your system.

460
00:37:55,720 --> 00:38:08,440
For example, if your controller, the internal controller, Bluetooth controller on your system doesn't allow you to change the class, for example, a USB, you know, an external one might allow you to do that, right?

461
00:38:08,440 --> 00:38:11,400
So you might have two and then you need to select which one you want to use.

462
00:38:11,400 --> 00:38:13,120
So in my case, I'm going to say select...

463
00:38:14,500 --> 00:38:15,960
to a tab complete.

464
00:38:16,220 --> 00:38:17,520
Yeah, it's my only one.

465
00:38:17,520 --> 00:38:22,100
So it's kind of redundant to do that, but it's a good thing to know how to do, right?

466
00:38:23,680 --> 00:38:26,220
So devices, what did my devices show?

467
00:38:26,220 --> 00:38:29,080
So I have my, these are not my AirPods.

468
00:38:29,080 --> 00:38:31,980
These are one of my friend's AirPods, but they're there.

469
00:38:31,980 --> 00:38:34,820
And if I go remove, will that remove them?

470
00:38:34,820 --> 00:38:35,360
Yes, it will.

471
00:38:35,360 --> 00:38:36,820
So now I go back to devices.

472
00:38:36,820 --> 00:38:39,840
So now we're back to an empty list of devices, right?

473
00:38:39,840 --> 00:38:46,200
So devices is used to show all the, well, devices that you encountered, right?

474
00:38:46,200 --> 00:38:50,100
So let's see if there's a part of this help screen here.

475
00:38:50,100 --> 00:38:51,200
It doesn't actually show.

476
00:38:51,200 --> 00:38:51,620
No, it does.

477
00:38:51,620 --> 00:38:53,060
Yeah, it lists the available devices.

478
00:38:53,060 --> 00:38:57,300
So anything that you've scanned, anything that you know is in your vicinity, right?

479
00:38:57,300 --> 00:38:59,100
will appear in that devices list.

480
00:38:59,100 --> 00:39:02,240
I removed this because these aren't with me right now.

481
00:39:02,240 --> 00:39:04,360
So they're not actually around here.

482
00:39:05,580 --> 00:39:10,220
But let's go ahead and turn on the scanning feature of Bluetooth control.

483
00:39:10,220 --> 00:39:16,560
It's a little bit different from the HCI control, but set scan on and then see what shows up, right?

484
00:39:16,560 --> 00:39:18,560
So as before, we have my phone, right?

485
00:39:18,560 --> 00:39:23,820
It shows up as a new device, which is now populated in my devices tab.

486
00:39:23,820 --> 00:39:25,820
And from here, I can go ahead and connect to it.

487
00:39:25,820 --> 00:39:27,080
Oh, there are my headphones again.

488
00:39:27,080 --> 00:39:30,520
Let's turn this scan off now because I've got my target device, right?

489
00:39:30,520 --> 00:39:31,460
It's already shown up here.

490
00:39:31,460 --> 00:39:37,320
There's no need to keep poking around and exposing my neighbor's Bluetooth devices.

491
00:39:38,140 --> 00:39:42,640
But from here, we have a couple of more cool things we can try.

492
00:39:42,640 --> 00:39:45,180
We can say info DC, right?

493
00:39:45,180 --> 00:39:46,640
And see what we got.

494
00:39:46,640 --> 00:39:55,320
You know, through this interface here, we have a similar dump of information that we got when we use HCI tool info.

495
00:39:55,320 --> 00:39:59,140
But here we can actually see the class of my cell phone, right?

496
00:39:59,140 --> 00:40:03,940
So it's showing that this is class 005A020C, right?

497
00:40:03,940 --> 00:40:07,580
This is the same one that I changed my internal computer to.

498
00:40:08,640 --> 00:40:14,460
But it shows like, you know, it shows what the class of the opposing device is, which might be useful information.

499
00:40:14,460 --> 00:40:18,980
And you know, icon is going to be a phone, not paired, not trusted, so on and so forth.

500
00:40:19,140 --> 00:40:21,280
And it does support legacy pairing, right?

501
00:40:21,280 --> 00:40:24,300
This might be a piece of information that you're interested in, right?

502
00:40:24,300 --> 00:40:25,720
Depending on what you're looking for.

503
00:40:25,720 --> 00:40:28,300
So let's go ahead and actually try and pair with my phone.

504
00:40:28,300 --> 00:40:33,140
Let me just unlock this thing and get to the pairing process.

505
00:40:33,140 --> 00:40:38,240
So if I say pair dc, tell me to pair with this.

506
00:40:38,240 --> 00:40:39,320
Okay, it says connected.

507
00:40:39,340 --> 00:40:41,180
Yes, so I have a connection.

508
00:40:41,480 --> 00:40:43,280
Okay, I have a added device.

509
00:40:43,280 --> 00:40:45,360
I'm going to hit OK on my phone.

510
00:40:46,400 --> 00:40:52,020
Because I'm doing this in a virtual machine, this might not work as I hope it will, but it's something, right?

511
00:40:52,020 --> 00:40:55,720
Okay, so now I have shows Allendite here saying I'm connected to it.

512
00:40:55,720 --> 00:41:04,920
I'm going to actually open a new tab and say SDP tool, browse this and see if this time we get a response from it.

513
00:41:05,640 --> 00:41:06,900
Hopefully this will work.

514
00:41:06,900 --> 00:41:16,400
If it doesn't, I'll have to include like a post recording, like screenshot of what the output of this tool looks like, but I'd like to be able to show it live if possible.

515
00:41:20,520 --> 00:41:23,860
Yeah, I knew doing this on a virtual machine was a mistake.

516
00:41:27,060 --> 00:41:28,580
Let's try this in sudo.

517
00:41:28,580 --> 00:41:38,840
I don't know if it got stalled somewhere before reaching the actual communication part because it's not showing the requesting information part that it was last time.

518
00:41:40,740 --> 00:41:47,520
In my experience doing Bluetooth, a lot of times things just don't work.

519
00:41:47,620 --> 00:41:49,800
That's the second time, right?

520
00:41:49,800 --> 00:41:52,240
Like they just don't.

521
00:41:52,640 --> 00:42:01,740
So as embarrassing as that is to admit, this is a genuine part of working with these tools, right?

522
00:42:01,740 --> 00:42:06,040
So here, if I come here and I say paired devices.

523
00:42:06,740 --> 00:42:09,000
Okay, so this didn't work.

524
00:42:09,800 --> 00:42:12,500
Let's try pairing to it again.

525
00:42:12,900 --> 00:42:15,760
Failed to pair in progress.

526
00:42:15,760 --> 00:42:18,160
Hold on a second, failed to connect.

527
00:42:18,160 --> 00:42:19,460
Operation now in progress.

528
00:42:19,460 --> 00:42:21,660
Okay, everything is going wrong right now.

529
00:42:21,660 --> 00:42:23,940
Okay , remove DC.

530
00:42:24,120 --> 00:42:26,360
Okay, authentication canceled.

531
00:42:26,360 --> 00:42:28,300
Okay, we have removed it.

532
00:42:28,300 --> 00:42:30,120
No longer my devices.

533
00:42:30,740 --> 00:42:34,080
Okay, so let's try this again from the top, right?

534
00:42:35,160 --> 00:42:39,760
No matter what the demo shows you, this is what working with Bluetooth is actually like, right?

535
00:42:39,760 --> 00:42:41,960
Sometimes it's just a real pain to deal with.

536
00:42:41,960 --> 00:42:43,340
So we found it again.

537
00:42:43,340 --> 00:42:44,280
Here it is.

538
00:42:44,280 --> 00:42:45,600
I'm going to copy that.

539
00:42:45,600 --> 00:42:48,280
I'm going to say pair this device.

540
00:42:48,280 --> 00:42:49,240
Something to pair.

541
00:42:49,240 --> 00:42:50,080
Yes.

542
00:42:50,620 --> 00:42:51,420
Okay.

543
00:42:52,720 --> 00:42:53,200
And...

544
00:42:55,300 --> 00:43:01,440
So they're connected, but my phone is no longer receiving the request to pair, right?

545
00:43:02,560 --> 00:43:12,740
You saw earlier how when I asked it to pair, this was a Windows notification that showed up saying, like, click here to set up your Bluetooth device.

546
00:43:12,740 --> 00:43:15,080
That's because I'm running a virtual machine.

547
00:43:15,180 --> 00:43:21,340
The host OS actually kind of grabs that connection and is like, what would you like me to do with this, right?

548
00:43:21,340 --> 00:43:29,760
So I think that I'm going to have to call it here for the Bluetooth demonstrations just because of the limitations of my hardware right now.

549
00:43:29,920 --> 00:43:36,240
Because I don't have an actual Linux machine that I can run this on bare metal, unfortunately.

550
00:43:36,460 --> 00:43:44,440
But anyway, hopefully, you know, despite all of the hiccups I ran into along the way, you were able to learn something about Bluetooth hands-on.

551
00:43:44,440 --> 00:43:55,680
I'm going to switch back over to the PowerPoint and just give you guys some resources to try out and just some closing remarks before ending this talk.

552
00:43:55,680 --> 00:43:58,080
So let's go over there real quick.

553
00:44:02,160 --> 00:44:05,840
All right, we're back in the PowerPoint.

554
00:44:05,960 --> 00:44:16,480
And the last thing I want to go over is a couple of tools that I would suggest looking into for anyone who's new to Bluetooth and wants to, you know, get into Bluetooth research, right?

555
00:44:16,480 --> 00:44:18,220
This is a great time to be getting into it.

556
00:44:18,220 --> 00:44:21,540
I'll point out why I feel that way in just a second.

557
00:44:21,540 --> 00:44:33,200
But here listed on the screen are a couple of resources that I found very helpful in the past and I think that are very relevant for modern day Bluetooth, you know, understanding, right?

558
00:44:33,200 --> 00:44:35,160
So pull out the laser pointer.

559
00:44:35,320 --> 00:44:40,940
So first and foremost, BlueZ, the Linux Bluetooth stack.

560
00:44:40,940 --> 00:44:44,440
There are APIs available for both Python and C.

561
00:44:44,440 --> 00:44:48,160
There is a guide online that I have linked in the next slide.

562
00:44:48,160 --> 00:44:49,640
It's kind of old.

563
00:44:49,640 --> 00:44:50,820
Okay, it's not kind of old.

564
00:44:50,820 --> 00:44:52,040
It's really old.

565
00:44:52,220 --> 00:45:07,080
But it still does a decently good job of explaining how to get started writing your own very basic Bluetooth programs and just running through that little... it's a pretty short textbook, but running through it is a good way to just get more familiar with how Bluetooth works,

566
00:45:07,080 --> 00:45:13,340
what the different components are, what kind of access to Bluetooth you have through BlueZ on your Linux system.

567
00:45:13,340 --> 00:45:15,340
I definitely recommend reading that book.

568
00:45:15,440 --> 00:45:17,400
Like I said, it's linked in the next slide.

569
00:45:18,020 --> 00:45:22,060
Bluetooth Stack Smasher, this is a fun little tool that was made a long time ago.

570
00:45:22,060 --> 00:45:27,280
It's not likely going to get you an awesome Pwn of a head unit, right?

571
00:45:27,280 --> 00:45:31,640
But it's essentially an L2 cap layer packet fuzzer, right?

572
00:45:31,640 --> 00:45:36,620
It will just blast random data, the L2 cap layer at a given Bluetooth address of your choice.

573
00:45:36,620 --> 00:45:42,660
It's very, very simplistic, but it has the ability to...

574
00:45:42,660 --> 00:45:49,860
you can actually customize the frame, the data that it sends out to the target device.

575
00:45:49,860 --> 00:45:57,480
So I've used it before with varying degrees of success, but it is good to know that it exists.

576
00:45:57,480 --> 00:46:03,320
It's about as good an over-the-air Bluetooth fuzzer as you can get.

577
00:46:03,960 --> 00:46:06,420
SpoofTooth, this is another quite old one.

578
00:46:06,420 --> 00:46:12,420
This was a project made for the express purpose of spoofing nearby Bluetooth devices.

579
00:46:12,420 --> 00:46:18,560
So it makes it a lot easier to do what I was showing, like with changing your class to copy a device.

580
00:46:18,560 --> 00:46:23,880
And you can change your Bluetooth address too, if your Bluetooth chip allows that, of course.

581
00:46:23,900 --> 00:46:29,900
So SpoofTooth kind of simplifies that process, of course, based on the allowances of your hardware.

582
00:46:29,900 --> 00:46:32,940
And then InternalBlue, this is really a big deal.

583
00:46:32,940 --> 00:46:39,140
I think that the lab doing this research here, this is the Simo lab somewhere.

584
00:46:39,140 --> 00:46:42,680
I don't remember the country they're based out of, but it's somewhere in Europe.

585
00:46:42,680 --> 00:46:48,680
And they are the ones who have really kick-started a lot of the recent Bluetooth research.

586
00:46:48,680 --> 00:46:52,080
So I mentioned before the knob attack, right?

587
00:46:52,080 --> 00:46:55,360
The key negotiation issue that was part of the Bluetooth protocol.

588
00:46:55,360 --> 00:47:02,780
That was discovered because the researchers who found that were using this, this InternalBlue.

589
00:47:02,780 --> 00:47:13,840
This is a framework for re-flashing Broadcom Bluetooth chips and essentially using them as very flexible Bluetooth adapters.

590
00:47:13,840 --> 00:47:19,780
I won't go into too much detail because I'll be honest, I'm not really qualified to talk about it.

591
00:47:19,780 --> 00:47:25,200
I don't want to say anything incorrect and have you all assume that I'm qualified at that level.

592
00:47:25,560 --> 00:47:27,300
But it's really, really great.

593
00:47:27,300 --> 00:47:29,540
You know, they have a lot of talks published.

594
00:47:30,300 --> 00:47:35,860
I believe they published a couple more recently that I still have to watch.

595
00:47:35,860 --> 00:47:43,000
But just going to their GitHub page will give you access to all of their papers and, you know, recorded presentations, so on and so forth.

596
00:47:43,000 --> 00:47:48,140
And I think everyone interested in Bluetooth could definitely benefit from checking them out, right?

597
00:47:48,420 --> 00:47:53,060
So speaking of the references page, this is my references page.

598
00:47:53,180 --> 00:47:58,500
The Introduction to Bluetooth Programming is the blue Z one that I talked about before.

599
00:47:58,500 --> 00:48:03,340
The internal blue GitHub, definitely a great resource for anyone.

600
00:48:03,340 --> 00:48:05,120
Like I mentioned, the Knob Attack.

601
00:48:05,120 --> 00:48:08,380
This is if you wanted to read more about the Knob Attack or Blueborn, right?

602
00:48:08,380 --> 00:48:16,480
These are the two vulnerabilities that I talked about to some degree of depth in this presentation.

603
00:48:16,740 --> 00:48:24,540
And lastly, but not least, this is the link to Bluetooth Stack Smasher, the tool that I mentioned before for L2 cap fuzzing.

604
00:48:24,540 --> 00:48:27,080
So hopefully you find any of these useful.

605
00:48:27,080 --> 00:48:28,520
Hopefully you learned something.

606
00:48:28,580 --> 00:48:33,240
Hopefully this will help you out, maybe in the CTF for our virtual car hacking village.

607
00:48:33,880 --> 00:48:37,440
And if you have any questions, of course, I'm always open to be emailed, right?

608
00:48:37,440 --> 00:48:40,580
Just send me an email at kamel.ghali at white motion dot com.

609
00:48:40,580 --> 00:48:47,600
I'm happy to provide you with these slides or any other resources if they're something that I own and I'm free to share.

610
00:48:47,600 --> 00:48:54,860
But hopefully you have a great DEF CON and yeah, on to the next Car Hacking 101.