1
00:00:20,400 --> 00:00:21,600
Hey, everyone.

2
00:00:21,600 --> 00:00:24,100
Welcome to the basics of breaking BLE.

3
00:00:24,100 --> 00:00:25,520
I'm Preeti Sen.

4
00:00:25,940 --> 00:00:32,100
I want to thank you for joining me and I want to thank the Wireless Village for featuring me today.

5
00:00:32,280 --> 00:00:42,380
Also, I want to thank DEF CON for going into safe mode and allowing us the space to interact and learn with each other.

6
00:00:42,860 --> 00:00:47,260
So, I've got a few things planned for us today.

7
00:00:47,380 --> 00:01:11,140
We've got some just going over the basics of what BLE is as far as the technology, just how expansive it is, some kind of tools and techniques that you can use for pen testing or just exploring Bluetooth low energy devices around you.

8
00:01:11,840 --> 00:01:18,680
So, as you can see here on the desk, I have a few devices.

9
00:01:18,680 --> 00:01:25,200
We have the Bombadge from DC27, Team IDES.

10
00:01:25,200 --> 00:01:30,260
We have Hacknar's BLE CTF.

11
00:01:30,260 --> 00:01:52,920
If any of you have seen any of my in-person talks, I usually try to feature this piece a lot because I feel like it's a very easy a sort of entry point for people to learn how to interact with GAT services on Bluetooth devices.

12
00:01:54,120 --> 00:01:58,700
So, going on, we also have a Thingy 52.

13
00:01:58,760 --> 00:02:03,320
This is a development tool and learning tool from Nordic.

14
00:02:03,680 --> 00:02:09,880
This has its own application that you can interact with sound and

15
00:02:12,940 --> 00:02:17,280
different gyroscopes and LEDs and all sorts of fun things.

16
00:02:17,720 --> 00:02:25,640
And then, of course, we have Anode XOR's DC27 badge that has a Bluetooth mesh network on it.

17
00:02:25,640 --> 00:02:34,140
We'll look at some of this and some interesting things that I found on the badge poking around looking for demonstration items for today.

18
00:02:34,140 --> 00:02:40,580
We actually also have the LG Phoenix LG150.

19
00:02:40,580 --> 00:02:56,900
This phone is important because it's the only one that I have found so far that allows for live capture of the BT Snoop file from an Android device into Wireshark.

20
00:02:56,900 --> 00:03:08,900
I feel that the live capture is important when you're auditing devices because you can actually see the command interactions between devices and the changes in real time.

21
00:03:08,900 --> 00:03:18,180
If I hit this button and this command comes across the wire, then it's probably pretty obvious that that is the command that's controlling that.

22
00:03:18,180 --> 00:03:30,560
And if you can see a difference in the variables, then you have an easier time in reversing the commands and actually being able to find meaningful exploits or meaningful ways of interacting with devices.

23
00:03:31,260 --> 00:03:38,500
So going on, the last item that we have is the Adafruit Bluefruit LE.

24
00:03:38,920 --> 00:03:46,560
This has some services that I built on it for DC27, actually.

25
00:03:46,740 --> 00:03:55,740
So we will look at actually cloning this device and spoofing it against a target.

26
00:03:57,020 --> 00:04:00,460
So just a short introduction to who I am.

27
00:04:00,460 --> 00:04:02,020
My name is Maxine Filcher.

28
00:04:02,020 --> 00:04:04,440
I also go by Freaky Zen online.

29
00:04:04,440 --> 00:04:07,180
Security consultant with IOActive.

30
00:04:07,180 --> 00:04:08,680
Sarmie veteran.

31
00:04:08,700 --> 00:04:15,060
Graduated class of 2020 with a BS in Info Assurance and Cybersecurity.

32
00:04:15,060 --> 00:04:17,620
I also have a minor in Law and Policy.

33
00:04:17,680 --> 00:04:26,620
I'm also a member of the SANS Women's Academy 2018 cohort, where I earned the GSEC, the GCIH, and the GPEN.

34
00:04:26,620 --> 00:04:32,300
I am also in the process of studying for the GAWN.

35
00:04:33,060 --> 00:04:38,420
So just a small disclaimer, I'm not a Bluetooth developer by any means.

36
00:04:38,420 --> 00:04:49,520
But I have been teaching about Bluetooth hacking and just general Bluetooth concepts for a couple of years now.

37
00:04:49,520 --> 00:04:55,600
So I feel like I am fairly well versed in this topic.

38
00:04:56,540 --> 00:05:08,640
So in any of my demonstrations, I always like to frame wireless security as greater than just Wi-Fi or just Bluetooth.

39
00:05:09,940 --> 00:05:26,700
In pen testing, when we see companies talk about wireless, you know, pen tests, generally they're talking about their Wi-Fi and they are, you know, completely ignoring a lot of other vectors that could occur with wireless.

40
00:05:26,700 --> 00:05:41,180
So I always like to bring up this kind of definition, I guess, this contrast in definition, you know, this weak definition from Wikipedia where it's wireless networks.

41
00:05:41,240 --> 00:05:43,740
Which I mean, I guess, could be broadly interpreted.

42
00:05:43,740 --> 00:05:47,760
But I much prefer the NIST, which I believe is still current.

43
00:05:47,760 --> 00:05:49,340
It may have been updated.

44
00:05:49,620 --> 00:05:58,740
But the NIST definition of wireless enabled technologies, I feel it's more encompassing of everything that you could encounter.

45
00:06:02,440 --> 00:06:07,490
So we talk about wireless, you know, just kind of continuing that discussion.

46
00:06:07,880 --> 00:06:09,700
You know, many different technologies.

47
00:06:09,700 --> 00:06:20,460
We have Bluetooth, Wi-Fi, ZigBee, RFID, NFC, Cell, and these come into a number of different industries.

48
00:06:20,460 --> 00:06:25,960
So medical is one that is growing pretty rapidly as far as Bluetooth low energy.

49
00:06:26,060 --> 00:06:36,080
And then, of course, IoT, the things around us, all these smart devices that really rely heavily on Bluetooth low energy to communicate.

50
00:06:36,440 --> 00:06:46,820
Then, you know, industry 4.0, Bluetooth is starting to get more into, you know, automated systems within factories and smart buildings.

51
00:06:46,980 --> 00:06:53,860
And also, you know, smart automated, you know, HVAC systems, or just building control systems.

52
00:06:53,860 --> 00:07:04,120
So Bluetooth is really starting to make its way into these important and sometimes, you know, high risk sort of systems.

53
00:07:04,120 --> 00:07:19,080
So Bluetooth is becoming more of an important research topic and, you know, target for actually pen testing as we go and as the technology develops.

54
00:07:19,140 --> 00:07:22,140
So just a few basics about Bluetooth.

55
00:07:22,640 --> 00:07:26,600
You'll find it in, you know, within the ISN band.

56
00:07:26,600 --> 00:07:33,420
So 2.4 to 2.485 gigahertz in this case for Bluetooth low energy.

57
00:07:33,440 --> 00:07:38,720
It comes in a few different flavors, you could kind of call them.

58
00:07:38,720 --> 00:07:46,820
Although the protocol stacks are different in some ways and similar in some ways.

59
00:07:47,860 --> 00:07:55,620
The original Bluetooth that came out, we refer to as Bluetooth classic or enhanced data rate.

60
00:07:55,620 --> 00:08:02,160
Any more you will find that in things like wireless headsets.

61
00:08:02,600 --> 00:08:18,600
So, you know, your Bluetooth headsets, anything where you're streaming data that needs larger packets and maybe higher throughput, that will generally go through on Bluetooth classic or BREDR is what it's known as now.

62
00:08:19,160 --> 00:08:23,520
Bluetooth low energy is what it is described as.

63
00:08:23,520 --> 00:08:25,400
It's a low energy protocol.

64
00:08:25,400 --> 00:08:31,540
It's intended to be used in devices that could run on a coin cell battery for up to a year.

65
00:08:31,980 --> 00:08:39,580
So that's a pretty heavy design specification for something, you know, that is low touch.

66
00:08:39,580 --> 00:08:47,980
You can put it somewhere and it's supposed to be able to work and, you know, you're not supposed to worry about the power and you can interact with it all day long.

67
00:08:49,120 --> 00:08:55,840
Something new that's emerging, and I mentioned it with the N on XOR badge, is Bluetooth mesh.

68
00:08:55,840 --> 00:09:01,600
Bluetooth mesh is actually, you can kind of think of it as a hat that goes on top of Bluetooth low energy.

69
00:09:01,600 --> 00:09:07,620
It uses some of the underlying components, but it adds things like provisional keys and application keys.

70
00:09:07,620 --> 00:09:12,720
And it's a mini to mini connection and it's very interesting.

71
00:09:12,720 --> 00:09:19,600
It can use, you know, pathways across other devices and set up nodes.

72
00:09:19,600 --> 00:09:22,480
It's a very interesting portion of the protocol.

73
00:09:22,860 --> 00:09:27,560
But we aren't really going to get into Bluetooth mesh too much.

74
00:09:27,580 --> 00:09:39,020
So just some other numbers, of course, you know, Bluetooth low energy is blowing up still all across the world, all these different technologies.

75
00:09:39,020 --> 00:09:46,300
I'm sure you have more than a few Bluetooth low energy devices around you right now.

76
00:09:48,580 --> 00:09:56,460
I also love to throw in, you know, little tidbits of history about Bluetooth.

77
00:09:56,460 --> 00:10:03,540
I think it's got kind of a fun origin with the name and kind of the intentions behind it.

78
00:10:03,560 --> 00:10:14,100
So you can see that if you've ever wondered where the Bluetooth symbol comes from, it's actually a mixture of two runic symbols, one for H and one for B.

79
00:10:14,100 --> 00:10:19,220
And this is actually for Harald Bluetooth, who was the king of Norway and Denmark.

80
00:10:19,220 --> 00:10:26,580
He was seen as a great unifier of these countries and brought together these nations.

81
00:10:26,680 --> 00:10:35,160
If you've watched Vikings, the History Channel series, you might recognize the guy whose picture I've pasted up there.

82
00:10:35,160 --> 00:10:44,560
But yes, it's loosely based on the same person, on the same historical character or figure.

83
00:10:44,720 --> 00:10:57,480
Another person that I really love that is integral to the development in Bluetooth, but not really in sort of a direct creating of the protocol or anything like that, Hedy Lamarr.

84
00:10:58,520 --> 00:11:01,500
I love the story of Hedy Lamarr.

85
00:11:01,500 --> 00:11:07,980
I love the story of her, you know, totally being just underestimated, but being so brilliant.

86
00:11:07,980 --> 00:11:15,860
And for those who aren't familiar, she was an actress in the early part of the 20th century.

87
00:11:17,100 --> 00:11:28,600
And she came from Austria, fairly scandalous kind of background, had left her husband, who had decided to supply arms to the Nazi party.

88
00:11:28,600 --> 00:11:35,520
She came to the United States and she befriended a man named George Anthel.

89
00:11:35,520 --> 00:12:01,100
And together they worked on a concept for creating a torpedo that was basically protected against jamming, or the interruption of the signal, whether that was intentional or unintentional, for torpedoes that were fired from either allied submarines or allied ships.

90
00:12:01,100 --> 00:12:07,400
A lot of times these torpedoes, when they were fired, they would either get jammed or they would lose connection.

91
00:12:07,400 --> 00:12:13,280
And sometimes they could actually backtrack around and hit the ship that fired the torpedo originally.

92
00:12:13,280 --> 00:12:16,760
So this was, at the time, was actually a fairly large concern.

93
00:12:16,760 --> 00:12:24,020
And it was something that was kind of an operational hazard that you had to put up with.

94
00:12:24,020 --> 00:12:31,880
And together they came up with this concept of frequency hopping spread spectrum.

95
00:12:31,900 --> 00:12:49,680
And this is where two devices, two transceivers, would have the set channel hopping, or it would have channels set within them that they would hop across at a set interval and at a set rate.

96
00:12:49,680 --> 00:13:05,060
So once these were loaded in, they would hop across the frequency spectrum in a way that would skip just pinpoint jamming, or just any kind of natural interference since it was skipping across frequencies.

97
00:13:05,060 --> 00:13:12,160
So this was actually a fairly unique idea at the time.

98
00:13:12,160 --> 00:13:17,380
It was based on player pianos, synced player pianos, which is kind of cool.

99
00:13:17,380 --> 00:13:26,780
If you have more interest about this story, there is an amazing documentary on Netflix called Hedy Lamarr, or Bombshell the Hedy Lamarr Story.

100
00:13:26,780 --> 00:13:28,820
Highly recommend that you check it out.

101
00:13:28,820 --> 00:13:34,580
It's a little bit sad, but if you're curious about the background, it's a really amazing story.

102
00:13:36,760 --> 00:13:40,180
So let's get into a little bit of terminology.

103
00:13:40,600 --> 00:13:48,000
So as far as devices within Bluetooth connections, we can think about devices in two ways.

104
00:13:48,000 --> 00:13:49,880
Central and peripheral.

105
00:13:49,940 --> 00:13:59,920
So your central devices are generally going to be your phone, or the device that the user is actually interacting with.

106
00:14:00,420 --> 00:14:12,640
So, you know, whether that's a tablet, or a laptop, or a TV, or something like that, where it's actually initiating the connection to whatever peripheral device.

107
00:14:12,640 --> 00:14:18,440
Say that's any kind of device that you're going to connect to, that's a peripheral device.

108
00:14:18,440 --> 00:14:25,040
It's not something that you are directly interacting with, with like an application on your phone, that's generally going to be a peripheral.

109
00:14:27,900 --> 00:14:34,920
So connections are also something that's important in Bluetooth, obviously, it's a wireless protocol.

110
00:14:34,920 --> 00:14:39,120
So there has to be some sort of way the connections are handled.

111
00:14:39,120 --> 00:14:52,660
Bluetooth Low Energy, just like Bluetooth, has set channels where it advertises itself on, or to central devices that may be looking to connect to it.

112
00:14:53,120 --> 00:15:01,160
So it has three set channels, Bluetooth Low Energy has three set channels that will broadcast across 37, 38, and 39.

113
00:15:02,180 --> 00:15:05,800
And there are also four advertising PDU types.

114
00:15:06,220 --> 00:15:09,100
I won't go over those, you can look them up.

115
00:15:09,140 --> 00:15:13,200
They don't really have too much impact on what we're going to talk about today.

116
00:15:15,880 --> 00:15:25,540
So we also have 36 channels for Bluetooth Low Energy separated by two megahertz across the spectrum.

117
00:15:26,280 --> 00:15:32,780
And when we're also speaking about connections, we think about them in two phases, sort of.

118
00:15:32,920 --> 00:15:42,730
Once you see the advertising of a device that you want to connect to, from your phone, you will initiate the pairing process.

119
00:15:42,730 --> 00:15:49,110
I'm fairly confident that most people are familiar with the pairing process.

120
00:15:49,630 --> 00:15:53,550
But it's where you initiate a wireless connection.

121
00:15:53,950 --> 00:15:56,250
And these come in kind of two phases.

122
00:15:56,250 --> 00:16:05,050
So you have your basic pairing session where you're unbonded, or you've passed your short term keys between the devices.

123
00:16:05,050 --> 00:16:18,310
So they have established a connection, but it's not trusted on certain levels, and it's not been placed into... the devices haven't been placed into each other's sort of trusted devices list.

124
00:16:18,510 --> 00:16:28,750
So once you create a bonded connection, that will actually... those devices are actually transferring long term key information between each other.

125
00:16:28,870 --> 00:16:45,270
In most cases, they'll go into a trusted device list, so that either the short term key pairing process can be skipped, or there's no need to even initialize the pairing process again at all.

126
00:16:45,270 --> 00:16:50,810
You can just, you know, whenever you're in proximity of the device, it will just automatically connect to you.

127
00:16:50,810 --> 00:16:53,250
So that's one of the benefits of bonding.

128
00:16:53,250 --> 00:17:07,090
Another benefit of bonding is you will oftentimes have greater leeway in the amount of kind of tolerance for fuzzing on a device.

129
00:17:07,090 --> 00:17:19,930
So if you just have a short term key pair with a device, and you try to start fuzzing GAT services, there's a good likelihood that that device will end that pair.

130
00:17:20,230 --> 00:17:29,930
Once you've bonded with a device, there is a greater chance that that connection will survive any kind of fuzzing that you do onto the GAT services.

131
00:17:34,610 --> 00:17:42,090
So we can talk a little bit about sort of the evolution of the Bluetooth protocol stack.

132
00:17:42,190 --> 00:17:49,410
We talked about how it kind of comes in multiple flavors, and you can see that we have classic B-R-E-D-R there.

133
00:17:49,470 --> 00:18:00,700
And then you can see the hybrid version of Smart Ready, and now Bluetooth Smart, which most new Bluetooth low energy devices coming out should be Bluetooth Smart.

134
00:18:02,200 --> 00:18:12,420
Although most phones will have the ability to use B-R-E-D-R in the case of, say, Bluetooth headphones or that sort of thing.

135
00:18:13,400 --> 00:18:22,880
There is also a new audio protocol that is coming out, a new Bluetooth low energy audio protocol.

136
00:18:23,280 --> 00:18:25,960
It was announced earlier this year.

137
00:18:25,960 --> 00:18:34,320
I haven't personally seen a lot of specifications on it, but I'm sure that there are people that can answer lots of questions about it already.

138
00:18:35,240 --> 00:18:37,420
But it's interesting.

139
00:18:38,280 --> 00:18:49,860
I'm excited from a security researcher perspective to get my hands on some of the devices, just because it sounds like it might have some issues, but we'll have to see.

140
00:18:50,280 --> 00:18:59,060
So, yeah, just some of the basic components of the protocol stack that we're going to really pay attention on today is GATT.

141
00:18:59,060 --> 00:19:03,960
I've already mentioned it a couple of times, but it's the generic attribute profile.

142
00:19:04,420 --> 00:19:13,460
These are where the profiles of the services that a device can offer are stored.

143
00:19:13,460 --> 00:19:28,320
So you can think about this as sort of a catalog of things that a device can do, whether that's measuring heart rate or giving temperature or measuring humidity levels.

144
00:19:28,320 --> 00:19:34,960
There's a GATT service, and there's a way for that information or that service to be interacted with.

145
00:19:34,960 --> 00:19:43,120
So there is a way to retrieve that temperature or that humidity measurement through the GATT services.

146
00:19:43,120 --> 00:19:46,320
Primarily, we're going to be interested in GATT services today.

147
00:19:48,080 --> 00:19:49,200
Okay.

148
00:19:49,200 --> 00:19:51,300
So we've already talked about that.

149
00:19:52,820 --> 00:20:07,800
So when I talk about GATT hacking, what I'm really talking about is the abuse of read or write privileges on a device over their GATT services.

150
00:20:08,120 --> 00:20:16,640
So in the case of iOS, read privileges can be abused fairly easily.

151
00:20:16,640 --> 00:20:29,220
And you can do things like retrieve the cell phone username, the battery level, the OS version, which may not be such an issue on the surface.

152
00:20:29,220 --> 00:20:51,160
But once you start poking lower into the protocol or into this vulnerability, especially with the proof of concept called Apple BLEEE, you can see that there are some significant interactions that are available over GATT, and there are some very significant information disclosures from iOS.

153
00:20:52,400 --> 00:21:02,120
So a few simple write privilege abuses that I have seen in devices that I have pin tested are just sending simple code.

154
00:21:02,120 --> 00:21:06,480
So picking out a GATT service, and I just start fuzzing codes.

155
00:21:07,320 --> 00:21:19,740
In some of the real world cases that I've seen, writing the hex value 0x08, and that enables me to set up a new pin between the devices.

156
00:21:19,740 --> 00:21:27,860
So now I'm defeating one of the very few security measures that you have for controlling Bluetooth connections.

157
00:21:28,040 --> 00:21:33,900
Further still, I've been able to achieve over the air firmware update mode.

158
00:21:33,900 --> 00:21:41,900
So writing 01 to a GATT service will actually allow you to push firmware to a device.

159
00:21:41,900 --> 00:21:49,760
I mean, you obviously could get, you know, lower interactions than potentially placement malicious firmware onto a device.

160
00:21:49,760 --> 00:21:53,460
And then, you know, who knows, you'd own that device then.

161
00:21:53,520 --> 00:22:01,220
Other devices I've seen like write 02 to a GATT service, a specific GATT service, and it would start a heating cycle on a device.

162
00:22:01,220 --> 00:22:05,580
So, you know, potentially there is danger there.

163
00:22:05,620 --> 00:22:08,800
So Bluetooth Low Energy does have security.

164
00:22:08,980 --> 00:22:26,520
It's developed through the years, mainly in response to security research that's been done, where, you know, a big set of vulnerabilities comes out and the technology has to respond to that in kind of a dynamic way or, you know, they risk really losing their customer base.

165
00:22:26,520 --> 00:22:39,400
So Bluetooth SIG has done a fairly decent job of responding to security researchers and trying to get chip manufacturers and developers on board with everything.

166
00:22:39,780 --> 00:22:46,740
But yeah, so there's a lot of space for growing, and there's also a lot of space for research.

167
00:22:47,480 --> 00:22:55,120
So Bluetooth Low Energy has currently, I would say the standard would be 4.2.

168
00:22:55,540 --> 00:23:09,800
Although BLE 5.0, the new standard that came out, has some pieces that strengthen the just works pairing by introducing some nonce values.

169
00:23:09,800 --> 00:23:11,520
The more entropy, the better.

170
00:23:11,600 --> 00:23:14,300
We have protections against man in the middle.

171
00:23:14,300 --> 00:23:26,820
We have protections against eavesdropping, and theoretically there's authentication via pairing and bonding, but we can see that oftentimes that's not the case and that can be abused pretty easily.

172
00:23:28,500 --> 00:23:33,460
So some of the Bluetooth vulnerabilities that have come out in the past.

173
00:23:33,660 --> 00:23:40,140
Once I started getting into Bluetooth pretty heavily, Blueboard was pretty fresh.

174
00:23:40,140 --> 00:23:46,260
It was fairly new, and it seemed to scare a lot of people.

175
00:23:46,260 --> 00:23:51,680
That's when I noticed Bluetooth security research really kind of starting to kick up again.

176
00:23:52,100 --> 00:23:55,440
It seemed like it had died off before that.

177
00:23:56,200 --> 00:24:01,360
And since then, there have been major vulnerabilities that's released every year.

178
00:24:01,520 --> 00:24:13,540
I think there were two, well Sphintooth was released earlier this year, and then there was a new set that they released, a new vulnerability set that they released just a couple of weeks ago for Sphintooth.

179
00:24:14,940 --> 00:24:20,740
So interesting piece about, or interesting trivia piece about Sphintooth.

180
00:24:20,740 --> 00:24:26,100
It's actually named after the son of Harold Bluetooth.

181
00:24:26,100 --> 00:24:29,580
So got a cool marketing piece that they did in there.

182
00:24:29,580 --> 00:24:42,800
So Sphintooth, since it's brand new, we'll talk about that, really starts to attack the protocol in ways that I personally haven't been testing it.

183
00:24:42,800 --> 00:24:49,640
And just fuzzing the header values and fuzzing the protocol in a way that just makes things stop working.

184
00:24:49,640 --> 00:24:53,000
There are a lot of denial of service vulnerabilities within this.

185
00:24:53,080 --> 00:24:57,580
A lot of deadlocks, security bypasses that are included within this.

186
00:24:57,740 --> 00:24:59,740
And it's fairly expansive.

187
00:24:59,740 --> 00:25:02,680
There are a lot of vendors that are impacted by Sphintooth.

188
00:25:02,700 --> 00:25:04,880
So a pretty cool piece of research.

189
00:25:04,880 --> 00:25:10,140
I personally haven't had a lot of time to jump into it, but I have read through it quite a bit.

190
00:25:10,140 --> 00:25:12,360
And it's pretty interesting.

191
00:25:12,900 --> 00:25:18,520
These are just a few of the Bluetooth tools out there that you can use.

192
00:25:18,900 --> 00:25:26,180
Some of these are proof of concepts, but they have neat scripts that you could either alter or actually just use as they are.

193
00:25:27,720 --> 00:25:32,980
So the first tool that we're going to look at is the Ubertooth One.

194
00:25:33,260 --> 00:25:35,060
Let me switch over here.

195
00:25:35,060 --> 00:25:38,200
So I have one right here.

196
00:25:38,200 --> 00:25:40,860
It's an older device.

197
00:25:40,860 --> 00:25:42,220
It's a few years old.

198
00:25:42,440 --> 00:25:54,760
But it's still probably the best way to ingest externally viewed Bluetooth packets into Wireshark.

199
00:25:54,760 --> 00:26:05,660
And I say externally because this is what I consider to be looking from the outside in to a Bluetooth connection between devices.

200
00:26:06,000 --> 00:26:12,240
So generally, you won't see a lot because things should be encrypted.

201
00:26:12,400 --> 00:26:18,560
Although I have seen some devices that say they are doing things, but they aren't actually encrypting things.

202
00:26:18,560 --> 00:26:21,000
So you're able to pull commands out of the air.

203
00:26:21,380 --> 00:26:43,680
But this is still probably the best tool that you can use for that use case for trying to check encryption or trying to check a device connection for its strength against eavesdropping and passive sniffing.

204
00:26:43,680 --> 00:26:52,720
So the GreatFET One is a tool that's still currently in development, I would consider.

205
00:26:53,300 --> 00:27:01,800
The Quincy was announced as the first sort of hat that was going to be added to this, the add-on hat.

206
00:27:01,800 --> 00:27:05,920
And it would allow for full spectrum sniffing of Bluetooth Low Energy.

207
00:27:05,920 --> 00:27:26,040
So instead of having to use an Ubertooth, which is locked into one advertisement channel at a time, you would be able to sniff all 36 channels at a time and be able to see basically all the Bluetooth information that's going on.

208
00:27:26,040 --> 00:27:33,120
So much easier to kind of manage as far as mass sniffing operations.

209
00:27:33,700 --> 00:27:43,840
But as of yet, um, and I haven't heard anything about a price.

210
00:27:43,840 --> 00:27:46,120
Maybe that'll change with Defcon coming up.

211
00:27:46,120 --> 00:27:48,460
So this is being recorded beforehand.

212
00:27:48,460 --> 00:27:50,080
So maybe there's already been an announcement.

213
00:27:50,080 --> 00:27:53,420
And if that's the case, then disregard this portion.

214
00:27:54,920 --> 00:28:14,320
So another tool that you probably won't get to use or probably won't see unless you have a lot of money or you work for a bigger employer is the Eliasys system, which relies on SDR.

215
00:28:14,460 --> 00:28:24,380
And it's the same kind of concept as the Quincy in that it's looking to do a mass spectrum capture.

216
00:28:24,380 --> 00:28:29,080
So it's trying to capture all of the Bluetooth packets that it possibly can.

217
00:28:29,080 --> 00:28:33,440
And then you can go through there and sort it by connection and see everything.

218
00:28:33,900 --> 00:28:40,600
This actually, this system will go even further and in some cases will strip the encryption off of the packet.

219
00:28:40,600 --> 00:28:44,980
So the software is actually pretty cool.

220
00:28:44,980 --> 00:28:48,360
I've had the chance to use one of these systems.

221
00:28:48,640 --> 00:28:55,640
And yeah, it's it's a very powerful tool that you can do a lot of really meaningful research with.

222
00:28:55,640 --> 00:28:59,360
But there is a huge price tag that's associated with it.

223
00:28:59,940 --> 00:29:04,560
And so that brings us to nRF Connect.

224
00:29:04,600 --> 00:29:11,240
And nRF Connect is what I generally use on engagements first.

225
00:29:11,240 --> 00:29:21,640
So I will exhaust every avenue possible with nRF Connect because it's free and it installs on any smart device.

226
00:29:21,640 --> 00:29:24,080
So well, you know, Android or iOS.

227
00:29:24,080 --> 00:29:27,560
And so it's highly available.

228
00:29:27,560 --> 00:29:30,340
It's extremely simple to use.

229
00:29:30,340 --> 00:29:33,960
It allows for abuse of GATT services.

230
00:29:33,960 --> 00:29:37,020
It also allows for cloning and spoofing.

231
00:29:37,020 --> 00:29:41,500
So it's a fairly useful tool.

232
00:29:41,660 --> 00:30:08,200
So that's where I like to start all of my engagements with because if I can prove that there is impact from this free and highly available tool, then the chances are that you probably have larger problems and someone with more technical ability or more powerful tools is likely going to be able to have even greater impact on your systems.

233
00:30:08,200 --> 00:30:13,860
So, you know, let's take a sort of low hanging fruit first approach.

234
00:30:14,440 --> 00:30:16,980
So I always start with nRF Connect.

235
00:30:18,020 --> 00:30:23,520
You know, it was intended for debugging but it works wonderful for the purposes that I need.

236
00:30:23,660 --> 00:30:28,320
One of the great things that you can do with this is record macros.

237
00:30:28,320 --> 00:30:32,850
So sometimes devices will only allow for momentary connections.

238
00:30:33,780 --> 00:30:43,060
Just long enough for two devices to basically pass short-term keys and decide that one device says that I don't want to talk to you because I don't know who you are.

239
00:30:43,180 --> 00:30:51,920
Well, still in that period of time there may be two seconds, three seconds where you have the window to actually send GATT commands in.

240
00:30:51,920 --> 00:31:06,080
And if you can capture that and potentially send a command to a device, you may actually get interaction with it even though you're not establishing a long-term paired session, bonded session.

241
00:31:06,320 --> 00:31:08,900
You're just that momentary connection.

242
00:31:08,900 --> 00:31:12,600
So I really enjoy the macro feature.

243
00:31:12,600 --> 00:31:17,560
And of course you can also export the logs which you know help for reporting.

244
00:31:17,560 --> 00:31:19,720
nRF sniffer we won't actually talk about.

245
00:31:19,720 --> 00:31:35,420
So BetterCap is a tool capable of interacting or allowing you to interact with GATT services of a device but from a Linux machine using a BLE dongle.

246
00:31:35,760 --> 00:31:43,840
So Kismet has the ability to do this but I feel like BetterCap has a slightly better UI for this.

247
00:31:43,840 --> 00:31:47,560
But it can be a little bit difficult to install.

248
00:31:48,000 --> 00:31:54,400
But yeah, you have the ability to send requests and commands over GATT.

249
00:31:54,400 --> 00:32:04,420
So it's still a very powerful tool if you're interested in doing this from a laptop or a desktop rather than a mobile device.

250
00:32:04,420 --> 00:32:10,100
Another powerful tool from a desktop machine is Scapi.

251
00:32:10,100 --> 00:32:15,760
So Scapi actually will allow you the ability to script.

252
00:32:15,800 --> 00:32:20,920
And this is very powerful once you start looking at these deeper interactions.

253
00:32:20,920 --> 00:32:39,400
So if you wanted to follow along with the Sphintooth vulnerabilities, you could actually craft packets using the Scapi library to attack those specific pieces of the protocol and push different kinds of data to them and potentially push them over.

254
00:32:39,400 --> 00:32:51,680
So if you're looking to do that deeper kind of penetration testing or research on Bluetooth energy, low energy, the Scapi library is definitely something you'll want to check out.

255
00:32:52,720 --> 00:33:03,600
And another essential tool that I use on just about every one of my pen tests for Bluetooth low energy devices is Android Debug Bridge.

256
00:33:03,680 --> 00:33:13,900
For those of you who might not be familiar with this, this allows you to create a PC interface to your Android device over USB.

257
00:33:13,900 --> 00:33:30,180
And generally, most phones won't allow you to do the live capture of BT Snoop logs, which is where Bluetooth low energy connections and data is logged to.

258
00:33:30,380 --> 00:33:39,060
So in the case of the LG phone that I have here, the LG M150, that will allow for us to do a live capture into Wireshark.

259
00:33:39,060 --> 00:33:41,620
And we'll look at this here shortly.

260
00:33:42,080 --> 00:33:47,200
So just some basic installation instructions if you're not familiar with ADB.

261
00:33:47,200 --> 00:33:49,180
Very simple to set up.

262
00:33:49,420 --> 00:33:52,540
Very easy to get going and to use.

263
00:33:53,100 --> 00:33:55,280
So I mentioned Kismet earlier.

264
00:33:55,280 --> 00:34:06,760
If you're not familiar with Kismet, it also supports Bluetooth low energy, but it has some functionality, but they may be, you know, increasing that as we speak.

265
00:34:06,760 --> 00:34:15,500
So, you know, that tool is definitely growing in its functionality and its capabilities every day.

266
00:34:16,300 --> 00:34:29,880
And we've mentioned Apple BLEEE, a wonderful proof of concept for the security issues that are really inherent within the iOS Bluetooth low energy stack.

267
00:34:30,540 --> 00:34:32,240
This is a lot of fun.

268
00:34:32,240 --> 00:34:40,640
I've done some private talks where I've actually attacked entire rooms full of people and AirPods are popping up on everyone's phone.

269
00:34:40,900 --> 00:34:42,900
So it's a lot of fun.

270
00:34:42,900 --> 00:34:51,340
But it can also be scary for Apple users to see that you can get that much interaction with their devices just through Bluetooth low energy.

271
00:34:53,260 --> 00:35:01,700
The Blueborn scanner, it was deprecated, but I've actually seen it back on the store or on the Play Store.

272
00:35:01,700 --> 00:35:04,560
And I still download it and still use it.

273
00:35:04,560 --> 00:35:14,340
But the likelihood that you're going to find a device that is actually still vulnerable or pops up as vulnerable is going to be highly unlikely at this point.

274
00:35:14,340 --> 00:35:19,440
Most manufacturers have patched or updated things against this.

275
00:35:19,440 --> 00:35:38,260
So it used to be a couple of years ago, you could walk into a Best Buy, run this Blueborn scanner, and almost every TV, every display TV that they had on, smart display TV would pop up on the on your Blueborn scanner and would give you all kinds of information.

276
00:35:38,260 --> 00:35:43,100
And then from there, you could actually use proof of concept scripts to actually attack these TVs.

277
00:35:43,520 --> 00:35:46,900
You know, those are different stories.

278
00:35:47,520 --> 00:35:54,220
But as far as I know, Blueborn is pretty much patched up and is no longer a risk.

279
00:35:56,340 --> 00:36:04,920
So a few challenges that we run into in Bluetooth low energy, as far as security researcher challenges.

280
00:36:06,720 --> 00:36:10,540
Most of the modern connections are encrypted.

281
00:36:10,540 --> 00:36:13,600
So they're hard to see from the outside.

282
00:36:13,600 --> 00:36:23,200
So unless there is a companion application on Android that I can use the Android debug bridge on, it's very hard to reverse commands.

283
00:36:23,200 --> 00:36:28,660
You know, the Ubertooth can follow connections, but it can't see inside of those connections that are encrypted.

284
00:36:28,680 --> 00:36:32,440
Crackle is largely ineffective anymore for breaking pins.

285
00:36:32,440 --> 00:36:36,140
So you know, good luck breaking pins.

286
00:36:36,140 --> 00:36:45,460
I know that there has been some research done in attacking the entropy levels of the pins that are generated.

287
00:36:45,460 --> 00:36:47,580
So that's kind of been a potential.

288
00:36:47,580 --> 00:36:56,040
But as far as I know, there isn't a reliable way of breaking pairing pins at this point.

289
00:36:56,960 --> 00:36:59,690
Commercial sniffers are also really expensive.

290
00:36:59,690 --> 00:37:06,510
And the cheaper alternatives really don't outperform the Ubertooth.

291
00:37:07,510 --> 00:37:10,890
So a few approaches to BLE.

292
00:37:10,890 --> 00:37:12,590
Sniff the broadcast traffic.

293
00:37:12,590 --> 00:37:14,890
So look from the outside in first.

294
00:37:14,890 --> 00:37:16,190
Is it encrypted?

295
00:37:16,190 --> 00:37:17,970
What can you see, basically?

296
00:37:17,970 --> 00:37:19,370
What are they leaking?

297
00:37:19,370 --> 00:37:25,890
What could you potentially do without any kind of interaction with the device?

298
00:37:25,890 --> 00:37:28,430
Is there any kind of information leak?

299
00:37:28,430 --> 00:37:31,490
Are there any issues with configuration?

300
00:37:32,250 --> 00:37:34,210
Yeah, that sort of thing.

301
00:37:35,930 --> 00:37:48,230
The next step would be to look from the inside out using something like Android Debug Bridge and looking at the unencrypted packets that are coming in.

302
00:37:48,230 --> 00:37:55,630
So Android Debug Bridge allows you to look at the Bluetooth Low Energy packets once they've crossed over the HCI threshold.

303
00:37:55,630 --> 00:38:04,510
So they've been stripped of the encryption layer and you can actually see the commands that are getting sent over the wire.

304
00:38:04,550 --> 00:38:06,290
Attempt out of app connection.

305
00:38:06,290 --> 00:38:10,430
So just try to, you know, use nrf connect.

306
00:38:10,630 --> 00:38:12,630
Connect to a device.

307
00:38:12,630 --> 00:38:16,470
See if you can create a paired or a bonded session.

308
00:38:16,590 --> 00:38:20,530
And then just start fuzzing values and see what interaction you get.

309
00:38:20,530 --> 00:38:23,850
Sometimes, you know, you'll get devices to lock out.

310
00:38:23,850 --> 00:38:28,210
Sometimes you'll get devices to actually do what they're supposed to.

311
00:38:28,210 --> 00:38:29,970
Sometimes you hit the trigger.

312
00:38:30,770 --> 00:38:38,090
And then the next thing is to spoof a device or check for cloning protections within the application itself.

313
00:38:38,410 --> 00:38:43,490
So these are kind of the four things that I really look for in a pen test.

314
00:38:43,990 --> 00:38:50,550
So hopefully that helps you kind of frame and contextualize what we're going to look at here in a second.

315
00:38:51,190 --> 00:38:54,510
So let's get into some hands-on stuff.

316
00:38:56,170 --> 00:38:58,530
So short list of equipment.

317
00:38:58,610 --> 00:39:01,690
The Nordic Thingy 52.

318
00:39:02,030 --> 00:39:03,730
Bluefruit LE.

319
00:39:03,770 --> 00:39:05,530
The LG M150.

320
00:39:05,590 --> 00:39:09,250
The Samsung S20 I'll be using as the victim.

321
00:39:09,390 --> 00:39:15,410
But I will also be showing you the screens that the attacker would see on that phone.

322
00:39:15,450 --> 00:39:20,030
It's just kind of a technology and display matter at this point.

323
00:39:20,030 --> 00:39:24,450
So and then we'll of course be using NRF Connect.

324
00:39:24,450 --> 00:39:28,930
We'll be using the Thingy app, then the Bluefruit Connect application.

325
00:39:28,930 --> 00:39:31,650
We'll also be using ADB and Wireshark.

326
00:39:31,650 --> 00:39:35,750
For an external scan, we're going to start with Ubertooth.

327
00:39:35,750 --> 00:39:37,950
And we're going to go through the setup.

328
00:39:37,950 --> 00:39:40,670
I just set this up on my computer.

329
00:39:40,670 --> 00:39:50,930
If you go to the GitHub page and go to their wiki for the Ubertooth, there are really good setup instructions.

330
00:39:50,930 --> 00:39:52,450
You just go line by line.

331
00:39:52,450 --> 00:39:56,610
I didn't have any issues on the newest version of Kali, so hopefully you don't.

332
00:39:56,610 --> 00:39:58,930
But yeah, you never know.

333
00:40:04,290 --> 00:40:15,070
So this is where we will be using ADB to do a live capture of the BT Snoop file on our LG M150.

334
00:40:15,490 --> 00:40:19,330
So let me get the phone hooked up here.

335
00:40:19,330 --> 00:40:21,430
We are going to launch ADB.

336
00:40:21,430 --> 00:40:26,230
So we would launch by using ADB start server.

337
00:40:26,350 --> 00:40:29,570
Mine's already started, but we'll just hit it again.

338
00:40:29,570 --> 00:40:32,870
And then we use ADB devices.

339
00:40:33,610 --> 00:40:36,870
And you can see our LG M150 is right there.

340
00:40:36,870 --> 00:40:38,750
So I plugged a different phone in.

341
00:40:39,310 --> 00:40:44,970
And we can see the device that I'm using here to capture the BT Snoop file on.

342
00:40:44,970 --> 00:40:48,490
We go over to Wireshark, which I already have started.

343
00:40:48,670 --> 00:40:56,590
And we can see that we have this BT Snoop interface that's opened up here.

344
00:40:56,590 --> 00:41:04,810
Now, it's important to note that the LG M150 has to be running Android version 7.

345
00:41:04,810 --> 00:41:15,010
So I just tried this a second ago with a different LG that I have, it's running version 6, and it does not open up the BT Snoop.

346
00:41:15,010 --> 00:41:19,470
So you'll have to actually update the version of Android.

347
00:41:19,470 --> 00:41:25,550
Luckily, we have pre-recorded videos this time, so I can go in and actually edit out some of that stuff.

348
00:41:26,630 --> 00:41:29,310
So we have our BT Snoop file here.

349
00:41:29,470 --> 00:41:31,870
Let's go ahead and start the sniffer.

350
00:41:31,870 --> 00:41:35,970
So our sniffer is now running from our phone.

351
00:41:36,650 --> 00:41:39,690
And so I have the phone connected here.

352
00:41:41,070 --> 00:41:46,450
And what we can do is start trying to connect to devices.

353
00:41:46,450 --> 00:41:52,890
So for instance, I have this thingy 52 on the desk here.

354
00:41:52,890 --> 00:41:58,350
I can turn this on and I can open up nrf connect.

355
00:42:00,710 --> 00:42:04,090
And you'll see the packets are starting to come in here.

356
00:42:07,950 --> 00:42:16,030
So we can see I'm going to connect to the thingy device here, and you'll see the packets start to change.

357
00:42:18,470 --> 00:42:26,290
We can create a connection to our thingy 52 using the thingy connect app.

358
00:42:27,170 --> 00:42:36,790
And now that I'm connected, I'm actually reading data from this device, from the thingy 52, onto my phone.

359
00:42:37,570 --> 00:42:43,550
So I can do things like play sounds.

360
00:42:48,780 --> 00:42:55,320
Now that's as I'm pressing here, you hear the sound on the thingy 52.

361
00:42:55,320 --> 00:43:00,380
So those commands are coming through the GAT services.

362
00:43:00,380 --> 00:43:06,760
Commands are being written from our phone to the GAT services that are being offered on the thingy 52.

363
00:43:06,900 --> 00:43:15,260
So since we have this hooked up in an internal fashion and we can see these packets, we can actually see what commands are controlling what.

364
00:43:15,260 --> 00:43:22,820
So if I hit this tone, we can see that there are packets coming across.

365
00:43:24,460 --> 00:43:26,500
Send write here.

366
00:43:30,390 --> 00:43:35,090
And this is the value that's being written to that GAT service.

367
00:43:35,290 --> 00:43:38,330
So let's try a different key.

368
00:43:40,610 --> 00:43:44,130
Okay, let's see if that value has changed.

369
00:43:44,830 --> 00:43:48,770
You can see it's changed to an 8, from a 5 to an 8.

370
00:43:56,110 --> 00:44:00,310
I would also suspect that 1 is the on and off, right?

371
00:44:00,310 --> 00:44:04,550
So the first write is the on, the second write is the off.

372
00:44:04,550 --> 00:44:12,110
You can see all Fs in the middle there, and then we see all 0s in the middle.

373
00:44:12,610 --> 00:44:15,670
All Fs, all 0s.

374
00:44:15,990 --> 00:44:26,570
Okay, so that's a pretty basic look at how we see commands and we're able to reverse command values that come across the wire internally.

375
00:44:26,570 --> 00:44:47,290
So how do we actually then interact with or take this information and use it to then test if there is any unauthorized access to the GAT services, or if we can get any interaction to the device from an unauthenticated source.

376
00:44:48,290 --> 00:44:54,070
So let me bring up the screen here.

377
00:44:54,210 --> 00:45:11,470
And I'm going to use my victim device here, or in this case my attacking device, to actually seek out the Thingy52 here over nrfconnect.

378
00:45:11,770 --> 00:45:15,230
So this would constitute an out-of-application connection.

379
00:45:15,230 --> 00:45:31,970
Since the Thingy52 has an application that controls all of the interactions, using an application like nrfconnect to directly interact with the GAT services would be considered an out-of-app interaction.

380
00:45:31,970 --> 00:45:34,610
So let me scan.

381
00:45:41,550 --> 00:45:44,510
So we have this thing here.

382
00:45:44,510 --> 00:45:47,650
That's my Thingy52.

383
00:45:47,890 --> 00:45:50,750
We'll go ahead and connect to that.

384
00:45:52,530 --> 00:45:58,850
And so you can see right off the bat we have a connection, but it's not bonded.

385
00:45:59,030 --> 00:46:03,430
You'll also notice up here in the right-hand corner is the DFU button.

386
00:46:03,430 --> 00:46:09,650
That will actually allow us to push firmware updates over the air.

387
00:46:09,650 --> 00:46:19,030
So not all devices, and most consumer devices will be locked down from this, but not all devices will have this.

388
00:46:19,270 --> 00:46:33,270
But if you do see this, this would constitute a fairly major vulnerability in this device, especially since we have a short-term connection, since there hasn't been long-term key information passed.

389
00:46:34,290 --> 00:46:37,450
Let's go ahead and open up our sound services.

390
00:46:37,810 --> 00:46:47,390
So when we were looking at the other screen here, let me go to Kali and phone.

391
00:46:47,490 --> 00:46:59,110
So when we were looking at the other commands that we captured from the internal, from the ADB capture, we saw our read and write commands.

392
00:46:59,170 --> 00:47:06,850
So those were being written to the handle 005B, and that was in the sound service.

393
00:47:06,850 --> 00:47:08,810
So let's look in the sound here.

394
00:47:11,970 --> 00:47:17,170
So if we open up the handle, we can see the full UUID there.

395
00:47:17,170 --> 00:47:24,750
Okay, so the thingy, speaker data characteristic, is what we saw being written to.

396
00:47:26,150 --> 00:47:36,110
So we can actually use this upload command, so we have write permissions to it, and we can use this value that we have here.

397
00:47:36,110 --> 00:47:48,310
So we have 8701FFF5A.

398
00:47:48,450 --> 00:47:51,850
So let's try and push this.

399
00:47:51,850 --> 00:47:56,530
This was a write command, so let's make sure that it's placed in command.

400
00:47:56,530 --> 00:48:02,930
You have the option between request or command, and this was sent as a command, X52.

401
00:48:02,930 --> 00:48:11,930
So we'll send it as a command, and we'll see if we can get any interaction here between our device and our attacking device.

402
00:48:21,680 --> 00:48:23,160
There it is.

403
00:48:23,300 --> 00:48:24,560
There it is.

404
00:48:25,860 --> 00:48:32,800
So we're now attacking from there, and just like I thought, so the all F command is the on command.

405
00:48:32,800 --> 00:48:37,120
So when we saw the write, that was the F.

406
00:48:37,120 --> 00:48:39,760
So we've sent it the option to be on.

407
00:48:39,760 --> 00:48:44,760
So it's on right now, and you can hear it in that tone.

408
00:48:45,440 --> 00:48:48,880
So now let's write the off command.

409
00:48:48,880 --> 00:49:03,220
So that was 870100005A, and we send that as the command, and now it's off.

410
00:49:03,220 --> 00:49:10,120
So that is a very robust look at your basic GAT hacking.

411
00:49:10,120 --> 00:49:30,620
We abused an unauthenticated out of application connection to a device, our thingy 52 in this case, and we used a command that we reversed from other information into getting this interaction from an attacking device.

412
00:49:30,620 --> 00:49:33,540
So say this was something else.

413
00:49:33,540 --> 00:49:44,000
Say this was, I don't know, I don't know what kind of user device you would have, but say it had some purpose and you had this in your pocket, but it also made noise like that.

414
00:49:44,320 --> 00:49:54,980
And say somebody had reversed these commands and knew that these devices were vulnerable or that you could just arbitrarily write these commands to GAT services.

415
00:49:55,600 --> 00:50:12,540
So if you could walk around, identify where these devices were or when they were in proximity, you could automatically attack these devices so that everybody was walking around that had one of these in their pockets, they would automatically get this tone just going off in their pocket and they would have to shut the device off.

416
00:50:12,540 --> 00:50:23,480
So you can see where there is user impact and there's also a circumventing of protections that are in place for Bluetooth Low Energy.

417
00:50:24,240 --> 00:50:28,980
So successful GAT hacking there.

418
00:50:29,800 --> 00:50:33,780
Let's switch over to some more slides here.

419
00:50:34,540 --> 00:50:43,040
We used internal scan to reverse the Bluetooth commands that we saw coming across the wire and then we used that in and out of application attack.

420
00:50:43,400 --> 00:50:47,400
So let's move into cloning some services.

421
00:50:50,020 --> 00:50:56,600
So this will enable us to really attack the application.

422
00:50:58,560 --> 00:51:06,300
Generally there isn't a lot of value in spoofing against a peripheral.

423
00:51:07,240 --> 00:51:10,180
Say like spoofing a user device.

424
00:51:10,180 --> 00:51:22,960
Although I have seen that be, you know, a valid find where you can impersonate a legitimate user's phone and then there is some interaction with the device.

425
00:51:22,960 --> 00:51:39,040
Without the long-term keys that have been passed, there's a really... you have an uphill battle basically in trying to spoof a user device against a peripheral.

426
00:51:39,040 --> 00:52:01,200
So what we are going to do is spoof a peripheral device and we are going to watch the victim attach to it from their application and basically see all of the interactions that you normally would and you don't even know that you haven't connected to your device.

427
00:52:01,200 --> 00:52:11,440
Meanwhile, if we were to push this further, what that would enable me to do is get a bonded session with my target.

428
00:52:11,500 --> 00:52:18,360
So I would have those long-term keys exchange with my target and be able to then exploit that further.

429
00:52:18,360 --> 00:52:29,240
So I could either use some sort of proof of concept or have that deeper interaction with that user's device.

430
00:52:30,660 --> 00:52:38,340
So what we're going to do is we are going to be spoofing the Bluefruit LE.

431
00:52:38,340 --> 00:52:41,760
Push some of this stuff out of the way here for a second.

432
00:52:42,600 --> 00:52:45,300
We're going to be spoofing the Bluefruit LE.

433
00:52:45,300 --> 00:52:48,080
It's a real simple development tool.

434
00:52:48,080 --> 00:52:51,080
Adafruit has all these kinds of kits that you can use.

435
00:52:51,080 --> 00:52:53,240
This is intended for development.

436
00:52:53,240 --> 00:53:01,460
It's intended to learn with and to explore how Bluetooth development works.

437
00:53:01,600 --> 00:53:10,380
But why we're using it is because it has its own application and one that does not have spoofing protections in it.

438
00:53:10,380 --> 00:53:17,340
So it's easy to basically prove this cloning concept.

439
00:53:17,340 --> 00:53:21,420
So let me plug things in.

440
00:53:24,080 --> 00:53:27,760
You can see we've got power now there.

441
00:53:30,300 --> 00:53:31,200
Okay.

442
00:53:31,200 --> 00:53:34,040
So you can see that we have power there.

443
00:53:34,840 --> 00:53:39,120
The Bluefruit module is on.

444
00:53:40,720 --> 00:53:47,960
So what I'll be doing on my device is leveraging the scanner.

445
00:53:47,960 --> 00:53:52,080
So I'm going to scan for devices right now.

446
00:53:52,220 --> 00:53:58,420
Hopefully we see this Bluefruit pop up somewhere.

447
00:53:58,860 --> 00:54:01,080
Ah, there we go.

448
00:54:01,200 --> 00:54:11,780
Freaky Zen Sinister Sun Hat was a project that I had for Defcon last year, but it didn't quite make it all the way.

449
00:54:11,780 --> 00:54:18,820
So what we're going to do is we're going to clone here, this clone button.

450
00:54:18,820 --> 00:54:22,560
So what I'm doing is I'm cloning the advertisement data now.

451
00:54:22,560 --> 00:54:30,300
So basically I'll be able to impersonate the Adafruit unit on the advertisement channels.

452
00:54:30,680 --> 00:54:36,160
So now that we've cloned it, what we can do is we can actually connect to the device.

453
00:54:39,260 --> 00:54:46,540
And we connect to it to get a return on the GAT services that are available.

454
00:54:46,540 --> 00:54:57,160
So now that we've connected to, we can go here up into the upper right-hand corner and we can go to clone device services.

455
00:54:57,320 --> 00:55:02,860
And you can see the little box popped up there and we've cloned the GAT services now.

456
00:55:02,860 --> 00:55:07,720
So we've cloned the advertisement profiles and we've cloned the GAT profiles.

457
00:55:07,720 --> 00:55:14,260
So now if we're able to turn these on, we're basically impersonating that device.

458
00:55:14,380 --> 00:55:24,100
So what we have to do is then go to the GAT server and we have to turn on the GAT server to mimic the Sun Hat.

459
00:55:24,100 --> 00:55:27,800
So there we have the GAT services turned on.

460
00:55:27,800 --> 00:55:47,900
And what we also have to do is go to our advertiser and we turn on the advertisement for the Freaky Zen Sinister Sun Hat.

461
00:55:47,900 --> 00:55:52,260
So now we are impersonating this device.

462
00:55:54,300 --> 00:56:02,700
And hopefully we will get a connection to our target device.

463
00:56:02,860 --> 00:56:18,940
So now that we've cloned all of the GAT services, what we have to do is go into the advertiser, turn on the advertiser for the Sinister Sun Hat, and then we also have to go in and change the name of the device.

464
00:56:18,940 --> 00:56:22,820
We're now advertising as a Spoofed Sun Hat.

465
00:56:22,820 --> 00:56:29,940
So we will update our scan here on the Adafruit LE app.

466
00:56:32,540 --> 00:56:34,800
And we can see the Phoenix 3.

467
00:56:34,800 --> 00:56:37,640
This is actually the name of the phone.

468
00:56:37,640 --> 00:56:40,700
So the name didn't update on the phone.

469
00:56:41,320 --> 00:56:43,980
So let's try and connect to it.

470
00:56:45,940 --> 00:56:51,940
And it allows us to connect to it as if it were the Sun Hat.

471
00:56:52,040 --> 00:56:54,080
So the Phoenix 3 is this phone.

472
00:56:54,080 --> 00:56:55,900
This is my attacker phone.

473
00:56:55,900 --> 00:57:04,940
So I've created a spoof from this phone and I've now got a connection in the application, in the Bluefruit Low Energy application.

474
00:57:06,180 --> 00:57:12,680
And from there, it's not giving us the right information because we're not getting returns on that.

475
00:57:12,680 --> 00:57:23,760
However, if I go to the server information here on my attacker, I can change things like my manufacturer string.

476
00:57:24,380 --> 00:57:28,260
This is an attacker.

477
00:57:28,620 --> 00:57:30,460
We can set that.

478
00:57:31,840 --> 00:57:35,260
Now we should be able to see that pop up there.

479
00:57:35,260 --> 00:57:43,040
You see now we've provided information on our attacker on the GAT service for the manufacturer name.

480
00:57:43,040 --> 00:57:53,740
So now the end user is seeing that if we had a device that had more functionality, we could potentially send information from this device.

481
00:57:53,740 --> 00:58:03,200
Say we spoofed a Thingy 52 and we spoofed or we sent temperature data out from there and this read temperature data.

482
00:58:03,200 --> 00:58:14,620
So think about that in a real world example where say a building is relying on Bluetooth Low Energy sensors to control HVAC.

483
00:58:15,060 --> 00:58:29,860
Say we are able to impersonate one of those sensors and then provide, you know, fake information to whatever is reading that temperature and then making the judgments on what should be done about that temperature.

484
00:58:29,860 --> 00:58:42,300
If we can then create a scenario where it thinks maybe the temperature is rising uncontrollably, maybe there's cooling systems or maybe it kicks on the fire suppression systems or something.

485
00:58:42,300 --> 00:58:53,080
So there is the risk of, you know, spoofing something and then providing information from that spoof.

486
00:58:53,080 --> 00:59:01,720
But I also have a connection now, a bonded connection to my target device that I could potentially exploit even further.

487
00:59:01,720 --> 00:59:04,260
So we just went through the basic pieces.

488
00:59:04,260 --> 00:59:06,400
We cloned the advertisement data.

489
00:59:06,400 --> 00:59:08,700
We changed our device name.

490
00:59:08,700 --> 00:59:10,620
We cloned the device services.

491
00:59:11,780 --> 00:59:23,960
We went through and turned on the advertiser and then we actually connected through and provided a spoof that our victim connected to.

492
00:59:24,880 --> 00:59:32,940
So I do want to introduce you to Hacknarr's BLE CTF.

493
00:59:34,580 --> 00:59:38,600
It runs on ESP32.

494
00:59:39,740 --> 00:59:48,740
Like I said, if you've ever been to any of my in-person training sessions, I generally give these out to as many people as I can.

495
00:59:48,740 --> 00:59:52,200
So I have, you know, like maybe 10 or 20 of these that I give out.

496
00:59:52,680 --> 01:00:01,460
But obviously since we are all all safe mode and social distancing, then I can't really give a bunch of these out.

497
01:00:01,460 --> 01:00:06,040
But they're like $10 and you can upload all the information yourself.

498
01:00:06,520 --> 01:00:12,800
And you can actually go through a BLE CTF and it's more of just interacting on GAT services.

499
01:00:12,800 --> 01:00:19,460
So what we went through earlier where we were doing the abusing of right privileges.

500
01:00:19,460 --> 01:00:24,080
So there are a bunch of challenges on there.

501
01:00:24,080 --> 01:00:31,840
Some of them are, you know, decoding MD5 or, you know, following certain instructions that you get back from the services.

502
01:00:31,980 --> 01:00:42,800
So if you have, you know, interest in exploring more on the GAT side, then I would definitely recommend checking out Hacknarr's BLE CTF.

503
01:00:42,800 --> 01:00:48,540
And of course, if you need help, feel free to reach out to me on Twitter or wherever.

504
01:00:50,160 --> 01:00:58,160
And so a few recommendations for just kind of the individual Bluetooth low energy user or your consumer.

505
01:00:59,100 --> 01:01:02,520
Keep your Bluetooth turned off unless you really need it.

506
01:01:02,660 --> 01:01:12,940
I know with the prevalence of Bluetooth low energy devices, I find my Bluetooth is being turned on more and more and kept on for longer and longer.

507
01:01:12,940 --> 01:01:17,240
So this might not be valid information in a few years.

508
01:01:17,240 --> 01:01:20,900
We may just always have to just deal with Bluetooth being on.

509
01:01:22,720 --> 01:01:27,560
Choose low traffic areas to do pin pairing sessions with.

510
01:01:27,560 --> 01:01:42,060
While it is fairly unlikely that there will be, you know, significant kind of leakage of keys or pins, there is the chance that that could happen.

511
01:01:42,060 --> 01:01:49,620
So you're better off to choose sort of a controlled RF space where you know there aren't going to be a lot of people eavesdropping.

512
01:01:49,740 --> 01:01:53,120
Generally, your home is a good option.

513
01:01:53,780 --> 01:01:58,940
Or, you know, an uninhabited part of your office, maybe.

514
01:02:00,540 --> 01:02:09,700
Also, be aware that like we saw with the Blue Fruit LE app, a lot of apps don't have spoofing protections.

515
01:02:09,700 --> 01:02:14,960
So you could very well be connecting to something that is not what you thought it was.

516
01:02:14,960 --> 01:02:24,280
And you've allowed an attacker to either provide you with false information or gain a bonded connection to your phone that they could then further abuse.

517
01:02:24,380 --> 01:02:35,980
And then I would also say that, you know, there are enough free tools out there that you could actually just start auditing all the Bluetooth devices around you and see, can I abuse GAT services?

518
01:02:35,980 --> 01:02:38,780
Can I create a spoof of this device?

519
01:02:39,080 --> 01:02:41,520
How does the application handle that?

520
01:02:41,520 --> 01:02:43,220
You might need two phones for that.

521
01:02:43,220 --> 01:02:44,500
But, yeah.

522
01:02:44,500 --> 01:02:52,080
And then, of course, if you want to get deeper into that, you know, maybe pick up a dedicated testing phone like an LG M150.

523
01:02:52,340 --> 01:02:54,380
Make sure it's running Android 7.

524
01:02:55,500 --> 01:02:56,180
So, yeah.

525
01:02:56,180 --> 01:02:59,380
Those are a few of my recommendations for consumers.

526
01:03:00,840 --> 01:03:18,540
As far as developers, I like to push out of band pairing options just because it pushes some of that very privileged and important information away from the channel that is being used for data.

527
01:03:18,540 --> 01:03:40,660
So, using something like NFC to actually pass long-term keys will increase the security of the Bluetooth data because... or the integrity of it because you don't have the risk of using basically an unprotected channel to pass keys to then protect it.

528
01:03:40,660 --> 01:03:43,860
So, you're using out of band practices.

529
01:03:44,920 --> 01:03:48,440
Don't focus solely on device security.

530
01:03:48,880 --> 01:03:53,060
You know, does your application have good spoofing protections?

531
01:03:54,420 --> 01:04:04,240
Is your app just looking for devices on name alone or is it looking, you know, for something deeper?

532
01:04:04,960 --> 01:04:22,020
What I like to, you know, dream and recommend is that, you know, that there be a remote server where you can actually validate the keys of a device before you ever connect to it through the cloud.

533
01:04:22,020 --> 01:04:30,760
So, say your cloud application would actually... or your application on your phone would have a connection to a cloud server somewhere.

534
01:04:30,760 --> 01:04:43,820
So, before you actually even start a connection with a device, that advertising data and that key or short-term key would be passed to your cloud and then validated.

535
01:04:43,820 --> 01:04:49,080
And if it's not valid, then obviously you wouldn't connect or you could blacklist it or something like that.

536
01:04:49,260 --> 01:04:51,700
So, that's what I tend to recommend.

537
01:04:52,340 --> 01:05:09,520
So, as far as further study, there are a number of Bluetooth researchers, but probably the one that I follow the most and the most enthusiastic is Jiska.

538
01:05:09,520 --> 01:05:11,620
I think I'm saying that right.

539
01:05:11,620 --> 01:05:23,820
But she is a... she's a security researcher and, yeah, an RF kind of wizard out of Europe.

540
01:05:25,040 --> 01:05:27,540
So, yeah, follow her on Twitter.

541
01:05:27,540 --> 01:05:31,380
She does a lot of talks all over the place.

542
01:05:31,680 --> 01:05:36,420
If you're looking for books, Hacking Exposed Wireless is amazing.

543
01:05:36,420 --> 01:05:43,360
I just went through the work for the GAWN and it's very, very similar.

544
01:05:43,360 --> 01:05:45,240
Obviously written by the same people.

545
01:05:45,240 --> 01:05:49,520
So, of course, there's going to be knowledge kind of overlap there.

546
01:05:49,980 --> 01:06:08,740
And if you're looking to get more on the hands-on side, then the Adafruit BlueFruit LE, the Thingy 52, ESP32s, and the UD100 Bluetooth USB adapter, which we didn't cover in this talk, is capable of doing more long-range stuff.

547
01:06:08,740 --> 01:06:13,240
So, that's definitely something you'll want to pick up if you have an interest in taking this further.

548
01:06:18,440 --> 01:06:19,480
Okay.

549
01:06:21,140 --> 01:06:35,040
So, with the badge just on, if you just turn it on, you can see the Bluetooth mesh pop up in nRF Connect.

550
01:06:37,380 --> 01:06:40,820
But I'm not able to connect to it.

551
01:06:49,400 --> 01:06:57,540
So, I'm able to see the Anode XOR badge within nRF Connect, the Bluetooth mesh you see there, it's listed as such.

552
01:06:57,540 --> 01:07:00,560
And I can try to connect to it.

553
01:07:01,280 --> 01:07:09,620
And I have a connection to it, and it's giving me certain options.

554
01:07:09,620 --> 01:07:14,200
I've done some poking around on this side, but I haven't found a lot.

555
01:07:14,580 --> 01:07:18,680
This SMP characteristic might be fun to poke around with.

556
01:07:20,440 --> 01:07:24,400
But what I have seen is,

557
01:07:33,570 --> 01:07:42,550
within the SMP characteristic, you can actually do some interesting commands that have these right values here.

558
01:07:42,550 --> 01:07:50,970
But, you know, OS echo commands, so you can echo commands through Bluetooth into the operating system.

559
01:07:50,970 --> 01:07:52,770
I haven't got much interaction from that.

560
01:07:52,770 --> 01:07:55,870
I've tried the commands, but it hasn't really worked.

561
01:07:55,870 --> 01:08:01,070
But the one that I have seen that works very well is the reset command.

562
01:08:01,070 --> 01:08:03,670
So, I will switch over here.

563
01:08:03,810 --> 01:08:10,270
So, as soon as I hit the reset command, you'll see the badge turns off.

564
01:08:11,790 --> 01:08:13,190
We'll send that.

565
01:08:13,550 --> 01:08:15,150
And then the badge turns off.

566
01:08:26,430 --> 01:08:43,390
Last year, if you were at DEF CON and they were talking about the Bluetooth mesh, where you could attack other people's devices, you could connect to the badges, and then you could send these commands, you know, turn people's badges off, or, you know,

567
01:08:43,390 --> 01:08:45,810
make it do different things, send different commands.

568
01:08:45,810 --> 01:08:53,050
So, very cool, very cool kind of puzzle and interaction and tool for learning.

569
01:08:53,050 --> 01:09:03,070
So, if you have one of these badges, one of these Anonyx or DC27 badges, or I believe the one before that also had a Bluetooth mesh on it.

570
01:09:03,830 --> 01:09:08,090
But if you have one of these badges, they would be awesome to hack on.

571
01:09:08,350 --> 01:09:12,670
Yeah, so they have that Bluetooth component.

572
01:09:12,670 --> 01:09:14,730
That's going to wrap up my presentation.

573
01:09:15,010 --> 01:09:22,190
And I just want to thank you for spending the time with me today and learning about Bluetooth low-energy hacking.

574
01:09:22,250 --> 01:09:23,990
Hopefully, you learned something.

575
01:09:23,990 --> 01:09:31,970
Hopefully, you found something that maybe caught your interest and, you know, you're ready to explore the Bluetooth low-energy devices around you.

576
01:09:33,030 --> 01:09:38,090
Don't forget the further study that I pushed out in one of the last slides.

577
01:09:38,090 --> 01:09:44,510
And if you have any questions, feel free to reach out to me on Twitter or LinkedIn or anywhere, really.

578
01:09:44,650 --> 01:09:48,410
And I will try my best to get in touch with you.

579
01:09:48,410 --> 01:09:50,850
I know sometimes I don't do a great job.

580
01:09:50,850 --> 01:09:54,950
But, yeah, so thank you so much for joining me.

581
01:09:54,950 --> 01:09:59,350
And I hope you have a wonderful, wonderful DEF CON safe mode.