start	end	text
20400	27400	Hey, everyone. Welcome to the basics of breaking BLE. I'm Preeti Sen. I want to thank you for
27400	33140	joining me and I want to thank the Wireless Village for featuring me today. Also, I want to
33140	41220	thank DEF CON for going into safe mode and allowing us the space to interact and learn with each
41220	51780	other. So, I've got a few things planned for us today. We've got some just going over the basics
51780	63120	of what BLE is as far as the technology, just how expansive it is, some kind of tools and techniques
63120	71140	that you can use for pen testing or just exploring Bluetooth low energy devices around you.
71840	81720	So, as you can see here on the desk, I have a few devices. We have the Bombadge from
83100	95120	DC27, Team IDES. We have Hacknar's BLE CTF. If any of you have seen any of my in-person talks,
95120	102020	I usually try to feature this piece a lot because I feel like it's a very easy
103000	112920	a sort of entry point for people to learn how to interact with GAT services on Bluetooth devices.
114120	123320	So, going on, we also have a Thingy 52. This is a development tool and learning tool from Nordic.
123680	129880	This has its own application that you can interact with sound and
132940	139080	different gyroscopes and LEDs and all sorts of fun things. And then, of course, we have
139080	147600	Anode XOR's DC27 badge that has a Bluetooth mesh network on it. We'll look at some of this and
148100	151940	some interesting things that I found on the badge poking around looking for demonstration
151940	162460	items for today. We actually also have the LG Phoenix LG150. This phone is important because
162460	172460	it's the only one that I have found so far that allows for live capture of the BT Snoop
173100	180400	file from an Android device into Wireshark. I feel that the live capture is important when you're
180400	185200	auditing devices because you can actually see the command interactions between devices
186400	193220	and the changes in real time. If I hit this button and this command comes across the wire,
193220	198540	then it's probably pretty obvious that that is the command that's controlling that. And if you
198540	203120	can see a difference in the variables, then you have an easier time in reversing the commands
203120	209040	and actually being able to find meaningful exploits or meaningful ways of interacting
209040	220260	with devices. So going on, the last item that we have is the Adafruit Bluefruit LE. This has
221470	229440	some services that I built on it for DC27, actually. So we will look at actually cloning
229440	240460	this device and spoofing it against a target. So just a short introduction to who I am.
240460	247180	My name is Maxine Filcher. I also go by Freaky Zen online. Security consultant with IOActive.
247180	255380	Sarmie veteran. Graduated class of 2020 with a BS in Info Assurance and Cybersecurity. I also
255380	262900	have a minor in Law and Policy. I'm also a member of the SANS Women's Academy 2018 cohort,
262900	270520	where I earned the GSEC, the GCIH, and the GPEN. I am also in the process of studying for the
270520	279480	GAWN. So just a small disclaimer, I'm not a Bluetooth developer by any means. But I have
279480	289080	been teaching about Bluetooth hacking and just general Bluetooth concepts for a couple of years
289080	299780	now. So I feel like I am fairly well versed in this topic. So in any of my demonstrations,
299780	308640	I always like to frame wireless security as greater than just Wi-Fi or just Bluetooth.
309940	317280	In pen testing, when we see companies talk about wireless, you know, pen tests, generally they're
317280	323980	talking about their Wi-Fi and they are, you know, completely ignoring a lot of other vectors that
323980	333040	could occur with wireless. So I always like to bring up this kind of definition, I guess,
333040	339920	this contrast in definition, you know, this weak definition from Wikipedia where it's wireless
339920	345540	networks. Which I mean, I guess, could be broadly interpreted. But I much prefer the NIST,
346220	352760	which I believe is still current. It may have been updated. But the NIST definition of wireless
352760	358740	enabled technologies, I feel it's more encompassing of everything that you could encounter.
362440	367490	So we talk about wireless, you know, just kind of continuing that discussion.
367880	374540	You know, many different technologies. We have Bluetooth, Wi-Fi, ZigBee, RFID, NFC, Cell,
375260	382860	and these come into a number of different industries. So medical is one that is growing
382860	389420	pretty rapidly as far as Bluetooth low energy. And then, of course, IoT, the things around us,
389420	396080	all these smart devices that really rely heavily on Bluetooth low energy to communicate.
396440	402880	Then, you know, industry 4.0, Bluetooth is starting to get more into, you know,
402880	409740	automated systems within factories and smart buildings. And also, you know, smart automated,
409740	415560	you know, HVAC systems, or just building control systems. So Bluetooth is really starting to make
415560	425720	its way into these important and sometimes, you know, high risk sort of systems. So Bluetooth is
425720	435040	becoming more of an important research topic and, you know, target for actually pen testing
435040	442140	as we go and as the technology develops. So just a few basics about Bluetooth.
442640	451780	You'll find it in, you know, within the ISN band. So 2.4 to 2.485 gigahertz in this case for
451780	459080	Bluetooth low energy. It comes in a few different flavors, you could kind of call them. Although
459080	466820	the protocol stacks are different in some ways and similar in some ways.
467860	475620	The original Bluetooth that came out, we refer to as Bluetooth classic or enhanced data rate.
475620	484680	Any more you will find that in things like wireless headsets. So, you know, your Bluetooth
484680	491710	headsets, anything where you're streaming data that needs larger packets and maybe higher throughput,
491960	498600	that will generally go through on Bluetooth classic or BREDR is what it's known as now.
499160	505860	Bluetooth low energy is what it is described as. It's a low energy protocol. It's intended
505860	511540	to be used in devices that could run on a coin cell battery for up to a year.
511980	519860	So that's a pretty heavy design specification for something, you know, that is low touch. You can
519860	523800	put it somewhere and it's supposed to be able to work and, you know, you're not supposed to
523800	531340	worry about the power and you can interact with it all day long. Something new that's emerging,
531340	537560	and I mentioned it with the N on XOR badge, is Bluetooth mesh. Bluetooth mesh is actually,
537560	542320	you can kind of think of it as a hat that goes on top of Bluetooth low energy. It uses some of
542320	547620	the underlying components, but it adds things like provisional keys and application keys.
547620	555700	And it's a mini to mini connection and it's very interesting. It can use, you know,
556580	562480	pathways across other devices and set up nodes. It's a very interesting portion of the protocol.
562860	571760	But we aren't really going to get into Bluetooth mesh too much. So just some other numbers,
571760	577120	of course, you know, Bluetooth low energy is blowing up still all across the world,
577120	584400	all these different technologies. I'm sure you have more than a few Bluetooth low energy devices
584400	596460	around you right now. I also love to throw in, you know, little tidbits of history about Bluetooth.
596460	604040	I think it's got kind of a fun origin with the name and kind of the intentions behind it. So
604040	609980	you can see that if you've ever wondered where the Bluetooth symbol comes from, it's actually a
609980	617240	mixture of two runic symbols, one for H and one for B. And this is actually for Harald Bluetooth,
617240	624440	who was the king of Norway and Denmark. He was seen as a great unifier of these countries and
624440	630040	brought together these nations. If you've watched Vikings, the History Channel series,
630040	636720	you might recognize the guy whose picture I've pasted up there. But yes,
636720	644560	it's loosely based on the same person, on the same historical character or figure.
644720	650240	Another person that I really love that is integral to the development in Bluetooth,
650240	656400	but not really in sort of a direct creating of the protocol or anything like that,
656400	664880	Hedy Lamarr. I love the story of Hedy Lamarr. I love the story of her, you know, totally being
664880	671980	just underestimated, but being so brilliant. And for those who aren't familiar, she was an actress
672880	681320	in the early part of the 20th century. And she came from Austria, fairly scandalous kind of
681320	688600	background, had left her husband, who had decided to supply arms to the Nazi party.
688600	696480	She came to the United States and she befriended a man named George Anthel. And together they
696480	707880	worked on a concept for creating a torpedo that was basically protected against jamming,
708440	715020	or the interruption of the signal, whether that was intentional or unintentional, for torpedoes
715020	723840	that were fired from either allied submarines or allied ships. A lot of times these torpedoes,
723840	728080	when they were fired, they would either get jammed or they would lose connection. And sometimes they
728080	734000	could actually backtrack around and hit the ship that fired the torpedo originally. So this was,
734000	738380	at the time, was actually a fairly large concern. And it was something that was
740460	746140	kind of an operational hazard that you had to put up with. And together they came up with
746880	755300	this concept of frequency hopping spread spectrum. And this is where two devices,
755940	765320	two transceivers, would have the set channel hopping, or it would have channels set within
765320	772760	them that they would hop across at a set interval and at a set rate. So once these were loaded in,
772760	780580	they would hop across the frequency spectrum in a way that would skip just pinpoint jamming,
780580	785060	or just any kind of natural interference since it was skipping across frequencies.
785060	794760	So this was actually a fairly unique idea at the time. It was based on player pianos,
794760	800500	synced player pianos, which is kind of cool. If you have more interest about this story,
800500	806780	there is an amazing documentary on Netflix called Hedy Lamarr, or Bombshell the Hedy Lamarr Story.
806780	809900	Highly recommend that you check it out. It's a little bit sad, but
809900	814580	if you're curious about the background, it's a really amazing story.
816760	825040	So let's get into a little bit of terminology. So as far as devices within Bluetooth connections,
825040	831920	we can think about devices in two ways. Central and peripheral. So your central devices are
831920	839920	generally going to be your phone, or the device that the user is actually interacting with.
840420	846500	So, you know, whether that's a tablet, or a laptop, or a TV, or something like that,
846500	853140	where it's actually initiating the connection to whatever peripheral device. Say that's
854600	859200	any kind of device that you're going to connect to, that's a peripheral device. It's not something
859200	862560	that you are directly interacting with, with like an application on your phone,
862560	871300	that's generally going to be a peripheral. So connections are also something that's important
871300	876680	in Bluetooth, obviously, it's a wireless protocol. So there has to be some sort of
877240	883340	way the connections are handled. Bluetooth Low Energy, just like Bluetooth, has set channels
883340	892660	where it advertises itself on, or to central devices that may be looking to connect to it.
893120	898420	So it has three set channels, Bluetooth Low Energy has three set channels that will broadcast across
898420	907760	37, 38, and 39. And there are also four advertising PDU types. I won't go over those,
907760	912620	you can look them up. They don't really have too much impact on what we're going to talk about
912620	924600	today. So we also have 36 channels for Bluetooth Low Energy separated by two megahertz across the
924600	931840	spectrum. And when we're also speaking about connections, we think about them in two phases,
931840	938590	sort of. Once you see the advertising of a device that you want to connect to,
938590	945730	from your phone, you will initiate the pairing process. I'm fairly confident that most people
945730	953550	are familiar with the pairing process. But it's where you initiate a wireless connection.
953950	959830	And these come in kind of two phases. So you have your basic pairing session where you're unbonded,
959830	967650	or you've passed your short term keys between the devices. So they have established a connection,
967650	974670	but it's not trusted on certain levels, and it's not been placed into... the devices haven't been
974670	981130	placed into each other's sort of trusted devices list. So once you create a bonded connection,
982030	987490	that will actually... those devices are actually transferring long term key information between
987490	996190	each other. In most cases, they'll go into a trusted device list, so that either the short
996190	1002710	term key pairing process can be skipped, or there's no need to even initialize the pairing
1002710	1008330	process again at all. You can just, you know, whenever you're in proximity of the device,
1008330	1013250	it will just automatically connect to you. So that's one of the benefits of bonding.
1013250	1020890	Another benefit of bonding is you will oftentimes have greater leeway in the
1022570	1030130	amount of kind of tolerance for fuzzing on a device. So if you just have a short term key
1031250	1037810	pair with a device, and you try to start fuzzing GAT services, there's a good likelihood that that
1037810	1044390	device will end that pair. Once you've bonded with a device, there is a greater chance that
1044390	1049930	that connection will survive any kind of fuzzing that you do onto the GAT services.
1054610	1062090	So we can talk a little bit about sort of the evolution of the Bluetooth protocol stack.
1062190	1067290	We talked about how it kind of comes in multiple flavors, and you can see that we have classic
1067290	1075590	B-R-E-D-R there. And then you can see the hybrid version of Smart Ready, and now Bluetooth Smart,
1075590	1080700	which most new Bluetooth low energy devices coming out should be Bluetooth Smart.
1082200	1089400	Although most phones will have the ability to use B-R-E-D-R in the case of, say,
1089400	1095540	Bluetooth headphones or that sort of thing. There is also a new audio
1097760	1102880	protocol that is coming out, a new Bluetooth low energy audio protocol.
1103280	1109380	It was announced earlier this year. I haven't personally seen a lot of specifications on it,
1109380	1114320	but I'm sure that there are people that can answer lots of questions about it already.
1115240	1122840	But it's interesting. I'm excited from a security researcher perspective to get my hands on some of
1122840	1129860	the devices, just because it sounds like it might have some issues, but we'll have to see.
1130280	1134940	So, yeah, just some of the basic components of the protocol stack that we're going to really
1134940	1141620	pay attention on today is GATT. I've already mentioned it a couple of times, but it's the
1141620	1152100	generic attribute profile. These are where the profiles of the services that a device can offer
1152100	1160400	are stored. So you can think about this as sort of a catalog of things that a device can do,
1160400	1168320	whether that's measuring heart rate or giving temperature or measuring humidity levels.
1168320	1174440	There's a GATT service, and there's a way for that information or that service to be interacted
1174440	1180560	with. So there is a way to retrieve that temperature or that humidity measurement
1181200	1186320	through the GATT services. Primarily, we're going to be interested in GATT services today.
1188080	1191300	Okay. So we've already talked about that.
1192820	1202000	So when I talk about GATT hacking, what I'm really talking about is the abuse of read or
1202000	1212960	write privileges on a device over their GATT services. So in the case of iOS, read privileges
1212960	1221000	can be abused fairly easily. And you can do things like retrieve the cell phone username,
1221360	1230420	the battery level, the OS version, which may not be such an issue on the surface. But once you
1230420	1236500	start poking lower into the protocol or into this vulnerability, especially with the proof of
1236500	1244120	concept called Apple BLEEE, you can see that there are some significant interactions that are
1244120	1251160	available over GATT, and there are some very significant information disclosures from iOS.
1252400	1258740	So a few simple write privilege abuses that I have seen in devices that I have pin tested
1259800	1266480	are just sending simple code. So picking out a GATT service, and I just start fuzzing codes.
1267320	1277500	In some of the real world cases that I've seen, writing the hex value 0x08, and that enables me
1277500	1284880	to set up a new pin between the devices. So now I'm defeating one of the very few security measures
1284880	1290840	that you have for controlling Bluetooth connections. Further still, I've been able to
1290840	1299100	achieve over the air firmware update mode. So writing 01 to a GATT service will actually allow
1299100	1305680	you to push firmware to a device. I mean, you obviously could get, you know, lower interactions
1305680	1311420	than potentially placement malicious firmware onto a device. And then, you know, who knows,
1311420	1317460	you'd own that device then. Other devices I've seen like write 02 to a GATT service,
1317660	1322660	a specific GATT service, and it would start a heating cycle on a device. So, you know,
1322660	1330100	potentially there is danger there. So Bluetooth Low Energy does have security. It's developed
1330100	1337820	through the years, mainly in response to security research that's been done, where, you know,
1338060	1342100	a big set of vulnerabilities comes out and the technology has to respond to that in kind of a
1342100	1348240	dynamic way or, you know, they risk really losing their customer base. So Bluetooth SIG has done a
1348240	1357080	fairly decent job of responding to security researchers and trying to get chip manufacturers
1357080	1364280	and developers on board with everything. But yeah, so there's a lot of space for growing,
1364280	1369880	and there's also a lot of space for research. So Bluetooth Low Energy has
1370980	1380980	currently, I would say the standard would be 4.2. Although BLE 5.0, the new standard that came out,
1380980	1389880	has some pieces that strengthen the just works pairing by introducing some nonce values. The
1389880	1395020	more entropy, the better. We have protections against man in the middle. We have protections
1395020	1401220	against eavesdropping, and theoretically there's authentication via pairing and bonding,
1401220	1406820	but we can see that oftentimes that's not the case and that can be abused pretty easily.
1408500	1415000	So some of the Bluetooth vulnerabilities that have come out in the past. Once I started getting
1415000	1424380	into Bluetooth pretty heavily, Blueboard was pretty fresh. It was fairly new, and it
1424380	1429460	seemed to scare a lot of people. That's when I noticed Bluetooth security research really kind
1429460	1437300	of starting to kick up again. It seemed like it had died off before that. And since then,
1437300	1443120	there have been major vulnerabilities that's released every year. I think there were two,
1443120	1448780	well Sphintooth was released earlier this year, and then there was a new set that they released,
1448900	1453540	a new vulnerability set that they released just a couple of weeks ago for Sphintooth.
1454940	1461340	So interesting piece about, or interesting trivia piece about Sphintooth. It's actually
1461980	1469580	named after the son of Harold Bluetooth. So got a cool marketing piece that they did in there.
1469580	1477500	So Sphintooth, since it's brand new, we'll talk about that, really starts to attack the protocol
1477500	1485960	in ways that I personally haven't been testing it. And just fuzzing the header values and fuzzing
1485960	1491160	the protocol in a way that just makes things stop working. There are a lot of denial of service
1491160	1497580	vulnerabilities within this. A lot of deadlocks, security bypasses that are included within this.
1497740	1502680	And it's fairly expansive. There are a lot of vendors that are impacted by Sphintooth.
1502700	1507380	So a pretty cool piece of research. I personally haven't had a lot of time to jump into it,
1507380	1515880	but I have read through it quite a bit. And it's pretty interesting. These are just a few of the
1515880	1521860	Bluetooth tools out there that you can use. Some of these are proof of concepts, but they have
1521860	1526180	neat scripts that you could either alter or actually just use as they are.
1527720	1535060	So the first tool that we're going to look at is the Ubertooth One. Let me switch over here.
1535060	1544320	So I have one right here. It's an older device. It's a few years old. But it's still probably
1544320	1555820	the best way to ingest externally viewed Bluetooth packets into Wireshark. And I say externally
1555820	1564120	because this is what I consider to be looking from the outside in to a Bluetooth connection
1564120	1572860	between devices. So generally, you won't see a lot because things should be encrypted. Although
1572860	1578560	I have seen some devices that say they are doing things, but they aren't actually encrypting things.
1578560	1585960	So you're able to pull commands out of the air. But this is still probably the best tool that you
1585960	1595640	can use for that use case for trying to check encryption or trying to check a device connection
1595640	1608920	for its strength against eavesdropping and passive sniffing. So the GreatFET One is a tool that's
1608920	1617160	still currently in development, I would consider. The Quincy was announced as the first
1617690	1623320	sort of hat that was going to be added to this, the add-on hat. And it would allow for full
1623320	1630300	spectrum sniffing of Bluetooth Low Energy. So instead of having to use an Ubertooth, which is
1630300	1639880	locked into one advertisement channel at a time, you would be able to sniff all 36 channels
1640900	1646040	at a time and be able to see basically all the Bluetooth information that's going on.
1646040	1660280	So much easier to kind of manage as far as mass sniffing operations. But as of yet,
1661000	1666260	um, and I haven't heard anything about a price. Maybe that'll change with Defcon coming up. So
1666260	1670560	this is being recorded beforehand. So maybe there's already been an announcement. And
1670560	1680420	if that's the case, then disregard this portion. So another tool that you probably won't get to use
1680920	1685700	or probably won't see unless you have a lot of money or you work for a bigger employer
1686940	1698280	is the Eliasys system, which relies on SDR. And it's the same kind of concept as the Quincy
1699180	1706260	in that it's looking to do a mass spectrum capture. So it's trying to capture all of the
1706260	1711920	Bluetooth packets that it possibly can. And then you can go through there and sort it by connection
1711920	1718500	and see everything. This actually, this system will go even further and in some cases will strip
1718500	1725980	the encryption off of the packet. So the software is actually pretty cool. I've had the chance to
1725980	1733900	use one of these systems. And yeah, it's it's a very powerful tool that you can do a lot of
1733900	1739360	really meaningful research with. But there is a huge price tag that's associated with it.
1739940	1748320	And so that brings us to nRF Connect. And nRF Connect is what I generally use on
1748320	1757880	engagements first. So I will exhaust every avenue possible with nRF Connect because it's free
1758340	1764080	and it installs on any smart device. So well, you know, Android or iOS.
1764080	1772940	And so it's highly available. It's extremely simple to use. It allows for abuse of GATT
1772940	1781500	services. It also allows for cloning and spoofing. So it's a fairly useful tool.
1781660	1787600	So that's where I like to start all of my engagements with because if I can prove that there
1788160	1797660	is impact from this free and highly available tool, then the chances are that you probably have
1797660	1803980	larger problems and someone with more technical ability or more powerful tools is likely going
1803980	1811280	to be able to have even greater impact on your systems. So, you know, let's take a sort of low
1811280	1819660	hanging fruit first approach. So I always start with nRF Connect. You know, it was intended for
1819660	1825380	debugging but it works wonderful for the purposes that I need. One of the great things that you can
1825380	1832850	do with this is record macros. So sometimes devices will only allow for momentary connections.
1833780	1840040	Just long enough for two devices to basically pass short-term keys and decide that one device
1840040	1844800	says that I don't want to talk to you because I don't know who you are. Well, still in that
1844800	1849880	period of time there may be two seconds, three seconds where you have the window to actually
1849880	1856120	send GATT commands in. And if you can capture that and potentially send a command to a device,
1856120	1862740	you may actually get interaction with it even though you're not establishing a long-term
1863540	1868900	paired session, bonded session. You're just that momentary connection.
1868900	1874860	So I really enjoy the macro feature. And of course you can also export the logs which
1875420	1880040	you know help for reporting. nRF sniffer we won't actually talk about. So
1881000	1887140	BetterCap is a tool capable of interacting or allowing you to interact with GATT services of
1887260	1898700	a device but from a Linux machine using a BLE dongle. So Kismet has the ability to do this
1898700	1905920	but I feel like BetterCap has a slightly better UI for this. But it can be a little bit difficult
1905920	1915360	to install. But yeah, you have the ability to send requests and commands over GATT. So it's
1915360	1922240	still a very powerful tool if you're interested in doing this from a laptop or a desktop rather
1922240	1931920	than a mobile device. Another powerful tool from a desktop machine is Scapi. So Scapi actually will
1931920	1939740	allow you the ability to script. And this is very powerful once you start looking at these deeper
1939740	1946600	interactions. So if you wanted to follow along with the Sphintooth vulnerabilities, you could
1946600	1953800	actually craft packets using the Scapi library to attack those specific pieces of the protocol
1953800	1960920	and push different kinds of data to them and potentially push them over. So if you're looking
1960920	1967480	to do that deeper kind of penetration testing or research on Bluetooth energy, low energy,
1968020	1971680	the Scapi library is definitely something you'll want to check out.
1972720	1979700	And another essential tool that I use on just about every one of my pen tests for Bluetooth
1979700	1986840	low energy devices is Android Debug Bridge. For those of you who might not be familiar with this,
1986840	1993900	this allows you to create a PC interface to your Android device over USB.
1993900	2003960	And generally, most phones won't allow you to do the live capture of BT Snoop logs, which is
2003960	2013180	where Bluetooth low energy connections and data is logged to. So in the case of the LG phone that I
2013180	2019460	have here, the LG M150, that will allow for us to do a live capture into Wireshark. And we'll
2019460	2025780	look at this here shortly. So just some basic installation instructions if you're not familiar
2025780	2035280	with ADB. Very simple to set up. Very easy to get going and to use. So I mentioned Kismet earlier.
2035280	2040800	If you're not familiar with Kismet, it also supports Bluetooth low energy, but it has some
2040800	2048220	functionality, but they may be, you know, increasing that as we speak. So, you know,
2048220	2055500	that tool is definitely growing in its functionality and its capabilities every day.
2056300	2064660	And we've mentioned Apple BLEEE, a wonderful proof of concept for the security issues that
2064660	2072460	are really inherent within the iOS Bluetooth low energy stack. This is a lot of fun. I've
2072460	2077960	done some private talks where I've actually attacked entire rooms full of people and
2077960	2084820	AirPods are popping up on everyone's phone. So it's a lot of fun. But it can also be scary for
2084820	2089720	Apple users to see that you can get that much interaction with their devices just through
2089720	2098620	Bluetooth low energy. The Blueborn scanner, it was deprecated, but I've actually seen it back
2098620	2105980	on the store or on the Play Store. And I still download it and still use it. But the likelihood
2105980	2110800	that you're going to find a device that is actually still vulnerable or pops up as vulnerable
2110800	2118060	is going to be highly unlikely at this point. Most manufacturers have patched or updated things
2118060	2124760	against this. So it used to be a couple of years ago, you could walk into a Best Buy,
2124760	2131180	run this Blueborn scanner, and almost every TV, every display TV that they had on, smart display
2131180	2138260	TV would pop up on the on your Blueborn scanner and would give you all kinds of information.
2138260	2143100	And then from there, you could actually use proof of concept scripts to actually attack these TVs.
2143520	2150040	You know, those are different stories. But as far as I know,
2150040	2154220	Blueborn is pretty much patched up and is no longer a risk.
2156340	2163020	So a few challenges that we run into in Bluetooth low energy, as far as security
2163020	2172000	researcher challenges. Most of the modern connections are encrypted. So they're hard
2172000	2177820	to see from the outside. So unless there is a companion application on Android that I can use
2177820	2184080	the Android debug bridge on, it's very hard to reverse commands. You know, the Ubertooth can
2184080	2188660	follow connections, but it can't see inside of those connections that are encrypted.
2188680	2195600	Crackle is largely ineffective anymore for breaking pins. So you know, good luck breaking
2195600	2204340	pins. I know that there has been some research done in attacking the entropy levels of the pins
2204340	2212480	that are generated. So that's kind of been a potential. But as far as I know, there isn't a
2212480	2219690	reliable way of breaking pairing pins at this point. Commercial sniffers are also really expensive.
2219690	2226510	And the cheaper alternatives really don't outperform the Ubertooth.
2227510	2234890	So a few approaches to BLE. Sniff the broadcast traffic. So look from the outside in first.
2234890	2241610	Is it encrypted? What can you see, basically? What are they leaking? What could you potentially do
2241610	2248430	without any kind of interaction with the device? Is there any kind of information leak?
2248430	2254210	Are there any issues with configuration? Yeah, that sort of thing.
2255930	2263230	The next step would be to look from the inside out using something like Android Debug Bridge
2263230	2270630	and looking at the unencrypted packets that are coming in. So Android Debug Bridge allows you to
2270630	2275850	look at the Bluetooth Low Energy packets once they've crossed over the HCI threshold. So
2276570	2282490	they've been stripped of the encryption layer and you can actually see the commands that are
2282490	2289570	getting sent over the wire. Attempt out of app connection. So just try to, you know, use nrf
2289570	2297210	connect. Connect to a device. See if you can create a paired or a bonded session. And then
2297210	2302790	just start fuzzing values and see what interaction you get. Sometimes, you know, you'll get devices
2302790	2308490	to lock out. Sometimes you'll get devices to actually do what they're supposed to. Sometimes
2308490	2316090	you hit the trigger. And then the next thing is to spoof a device or check for cloning protections
2316090	2321630	within the application itself. So these are kind of the four things that I really look for
2321630	2328130	in a pen test. So hopefully that helps you kind of frame and contextualize what we're
2328130	2334510	going to look at here in a second. So let's get into some hands-on stuff.
2336170	2347110	So short list of equipment. The Nordic Thingy 52. Bluefruit LE. The LG M150. The Samsung S20
2347110	2353290	I'll be using as the victim. But I will also be showing you the screens that the attacker would
2353290	2360030	see on that phone. It's just kind of a technology and display matter at this point. So
2361510	2366310	and then we'll of course be using NRF Connect. We'll be using the Thingy app,
2366310	2371650	then the Bluefruit Connect application. We'll also be using ADB and Wireshark.
2371650	2377150	For an external scan, we're going to start with Ubertooth. And we're going to go through the
2377150	2386110	setup. I just set this up on my computer. If you go to the GitHub page and go to their wiki
2386110	2392750	for the Ubertooth, there are really good setup instructions. You just go line by line. I didn't
2392750	2398930	have any issues on the newest version of Kali, so hopefully you don't. But yeah, you never know.
2404290	2415070	So this is where we will be using ADB to do a live capture of the BT Snoop file on our LG M150.
2415490	2422990	So let me get the phone hooked up here. We are going to launch ADB. So we would launch by using
2422990	2431350	ADB start server. Mine's already started, but we'll just hit it again. And then we use ADB
2431350	2438750	devices. And you can see our LG M150 is right there. So I plugged a different phone in.
2439310	2444970	And we can see the device that I'm using here to capture the BT Snoop file on.
2444970	2453470	We go over to Wireshark, which I already have started. And we can see that we have this BT
2453470	2462750	Snoop interface that's opened up here. Now, it's important to note that the LG M150 has to be
2462750	2471250	running Android version 7. So I just tried this a second ago with a different LG that I have,
2471250	2476850	it's running version 6, and it does not open up the BT Snoop. So you'll have to actually update
2476850	2483290	the version of Android. Luckily, we have pre-recorded videos this time, so I can go in
2483290	2490530	and actually edit out some of that stuff. So we have our BT Snoop file here. Let's go ahead and
2490530	2498590	start the sniffer. So our sniffer is now running from our phone. And so I have the phone connected
2498590	2510090	here. And what we can do is start trying to connect to devices. So for instance, I have this
2510090	2518350	thingy 52 on the desk here. I can turn this on and I can open up nrf connect.
2520710	2524090	And you'll see the packets are starting to come in here.
2527950	2534830	So we can see I'm going to connect to the thingy device here, and you'll see the packets start to
2534830	2546290	change. We can create a connection to our thingy 52 using the thingy connect app.
2547170	2554290	And now that I'm connected, I'm actually reading data from this device, from the thingy 52,
2554290	2563550	onto my phone. So I can do things like play sounds.
2568780	2577700	Now that's as I'm pressing here, you hear the sound on the thingy 52. So those commands are
2577700	2584020	coming through the GAT services. Commands are being written from our phone to the GAT services
2584020	2590500	that are being offered on the thingy 52. So since we have this hooked up in an internal fashion and
2590500	2596460	we can see these packets, we can actually see what commands are controlling what. So if I hit this
2596460	2611610	tone, we can see that there are packets coming across. Send write here. And this is the value
2611610	2618330	that's being written to that GAT service. So let's try a different key.
2620610	2628770	Okay, let's see if that value has changed. You can see it's changed to an 8, from a 5 to an 8.
2636110	2642710	I would also suspect that 1 is the on and off, right? So the first write is the on, the second
2642710	2652110	write is the off. You can see all Fs in the middle there, and then we see all 0s in the middle.
2652610	2662970	All Fs, all 0s. Okay, so that's a pretty basic look at how we see commands and we're able to reverse
2662970	2670750	command values that come across the wire internally. So how do we actually then interact
2670750	2677650	with or take this information and use it to then test if there is any unauthorized
2678470	2684710	access to the GAT services, or if we can get any interaction to the device from an
2685430	2696050	unauthenticated source. So let me bring up the screen here. And I'm going to use my
2696550	2704030	victim device here, or in this case my attacking device, to actually seek out the
2705970	2715230	Thingy52 here over nrfconnect. So this would constitute an out-of-application connection.
2715230	2722570	Since the Thingy52 has an application that controls all of the interactions,
2722570	2728130	using an application like nrfconnect to directly interact with the GAT services
2728130	2734610	would be considered an out-of-app interaction. So let me scan.
2741550	2750750	So we have this thing here. That's my Thingy52. We'll go ahead and connect to that.
2752530	2759550	And so you can see right off the bat we have a connection, but it's not bonded. You'll also
2759550	2766410	notice up here in the right-hand corner is the DFU button. That will actually allow us to push
2767150	2773630	firmware updates over the air. So not all devices, and most consumer devices will be locked down
2773630	2782970	from this, but not all devices will have this. But if you do see this, this would constitute a
2782970	2790250	fairly major vulnerability in this device, especially since we have a short-term connection,
2790250	2794890	since there hasn't been long-term key information passed.
2794890	2803490	Let's go ahead and open up our sound services. So when we were looking at the other screen here,
2803490	2812170	let me go to Kali and phone. So when we were looking at the other commands that we captured
2812170	2820370	from the internal, from the ADB capture, we saw our read and write commands. So those were being
2820370	2828810	written to the handle 005B, and that was in the sound service. So let's look in the sound here.
2831970	2839370	So if we open up the handle, we can see the full UUID there. Okay, so the thingy,
2839370	2844750	speaker data characteristic, is what we saw being written to.
2846150	2853590	So we can actually use this upload command, so we have write permissions to it, and we can use this
2853590	2874230	value that we have here. So we have 8701FFF5A. So let's try and push this. This was a write command,
2874230	2879650	so let's make sure that it's placed in command. You have the option between request or command,
2879650	2886090	and this was sent as a command, X52. So we'll send it as a command, and we'll see if we can get
2886610	2891930	any interaction here between our device and our attacking device.
2901680	2910080	There it is. There it is. So we're now attacking from there, and just like I thought,
2910080	2917900	so the all F command is the on command. So when we saw the write, that was the F. So we've sent
2917900	2927140	it the option to be on. So it's on right now, and you can hear it in that tone. So now let's write
2927140	2943220	the off command. So that was 870100005A, and we send that as the command, and now it's off.
2943220	2954140	So that is a very robust look at your basic GAT hacking. We abused an unauthenticated
2954140	2960740	out of application connection to a device, our thingy 52 in this case,
2961580	2968540	and we used a command that we reversed from other information into getting this interaction
2968540	2976560	from an attacking device. So say this was something else. Say this was, I don't know,
2976560	2980480	I don't know what kind of user device you would have, but say it had some purpose and you had
2980480	2987180	this in your pocket, but it also made noise like that. And say somebody had reversed these commands
2987180	2993040	and knew that these devices were vulnerable or that you could just arbitrarily write these
2993040	3000820	commands to GAT services. So if you could walk around, identify where these devices were or when
3000820	3004820	they were in proximity, you could automatically attack these devices so that everybody was
3005360	3009300	walking around that had one of these in their pockets, they would automatically get this tone
3009300	3013720	just going off in their pocket and they would have to shut the device off. So you can see where
3013720	3021560	there is user impact and there's also a circumventing of protections that are in place
3021560	3033780	for Bluetooth Low Energy. So successful GAT hacking there. Let's switch over to some more slides here.
3034540	3039920	We used internal scan to reverse the Bluetooth commands that we saw coming across the wire and
3039920	3047400	then we used that in and out of application attack. So let's move into cloning some services.
3050020	3056600	So this will enable us to really attack the application.
3058560	3066300	Generally there isn't a lot of value in spoofing against a peripheral.
3067240	3075940	Say like spoofing a user device. Although I have seen that be, you know, a valid find where
3075940	3082960	you can impersonate a legitimate user's phone and then there is some interaction with the device.
3082960	3093620	Without the long-term keys that have been passed, there's a really... you have an uphill battle
3093620	3101740	basically in trying to spoof a user device against a peripheral. So what we are going to do is spoof
3101960	3110760	a peripheral device and we are going to watch the victim attach to it from their application
3111320	3119000	and basically see all of the interactions that you normally would and you don't even know that
3119000	3126340	you haven't connected to your device. Meanwhile, if we were to push this further, what that would
3126340	3134200	enable me to do is get a bonded session with my target. So I would have those long-term keys
3134200	3139200	exchange with my target and be able to then exploit that further. So I could either
3140540	3149240	use some sort of proof of concept or have that deeper interaction with that user's device.
3150660	3159260	So what we're going to do is we are going to be spoofing the Bluefruit LE. Push some of this
3159260	3166060	stuff out of the way here for a second. We're going to be spoofing the Bluefruit LE. It's a
3166060	3171520	real simple development tool. Adafruit has all these kinds of kits that you can use.
3171520	3179640	This is intended for development. It's intended to learn with and to explore how Bluetooth
3180100	3187780	development works. But why we're using it is because it has its own application and one
3187780	3193500	that does not have spoofing protections in it. So it's easy to basically prove this
3193500	3207760	cloning concept. So let me plug things in. You can see we've got power now there.
3210300	3219120	Okay. So you can see that we have power there. The Bluefruit module is on.
3220720	3230640	So what I'll be doing on my device is leveraging the scanner. So I'm going to scan for devices
3230640	3242640	right now. Hopefully we see this Bluefruit pop up somewhere. Ah, there we go. Freaky Zen Sinister
3242640	3251780	Sun Hat was a project that I had for Defcon last year, but it didn't quite make it all the way.
3251780	3260240	So what we're going to do is we're going to clone here, this clone button. So what I'm doing is I'm
3260240	3267260	cloning the advertisement data now. So basically I'll be able to impersonate the Adafruit unit
3267960	3272400	on the advertisement channels. So now that we've cloned it,
3272400	3276160	what we can do is we can actually connect to the device.
3279260	3287620	And we connect to it to get a return on the GAT services that are available. So now that we've
3287620	3296120	connected to, we can go here up into the upper right-hand corner and we can go to clone device
3296120	3302860	services. And you can see the little box popped up there and we've cloned the GAT services now.
3302860	3308640	So we've cloned the advertisement profiles and we've cloned the GAT profiles. So now if we're
3308640	3317600	able to turn these on, we're basically impersonating that device. So what we have to do is then go to
3317600	3325400	the GAT server and we have to turn on the GAT server to mimic the Sun Hat. So there we have
3325400	3337680	the GAT services turned on. And what we also have to do is go to our advertiser
3339760	3350900	and we turn on the advertisement for the Freaky Zen Sinister Sun Hat. So now we are impersonating
3350900	3363820	this device. And hopefully we will get a connection to our target device. So now that
3363820	3370360	we've cloned all of the GAT services, what we have to do is go into the advertiser, turn on
3370360	3377280	the advertiser for the Sinister Sun Hat, and then we also have to go in and change the name
3377280	3382880	of the device. We're now advertising as a Spoofed Sun Hat. So
3383820	3389940	we will update our scan here on the Adafruit LE app.
3392540	3397940	And we can see the Phoenix 3. This is actually the name of the phone. So
3397940	3403980	the name didn't update on the phone. So let's try and connect to it.
3405940	3414240	And it allows us to connect to it as if it were the Sun Hat. So the Phoenix 3 is this phone. This
3414240	3420340	is my attacker phone. So I've created a spoof from this phone and I've now got a connection
3420340	3429680	in the application, in the Bluefruit Low Energy application. And from there, it's not giving us
3429680	3433960	the right information because we're not getting returns on that. However, if I
3433960	3443760	go to the server information here on my attacker, I can change things like my manufacturer string.
3444380	3450460	This is an attacker. We can set that.
3451840	3458680	Now we should be able to see that pop up there. You see now we've provided information on our
3458680	3466340	attacker on the GAT service for the manufacturer name. So now the end user is seeing that if we
3466340	3473740	had a device that had more functionality, we could potentially send information from this device.
3473740	3481820	Say we spoofed a Thingy 52 and we spoofed or we sent temperature data out from there and this
3481820	3489820	read temperature data. So think about that in a real world example where say a building is relying
3489820	3497920	on Bluetooth Low Energy sensors to control HVAC. Say we are able to impersonate one of those sensors
3497920	3505640	and then provide, you know, fake information to whatever is reading that temperature
3506160	3511100	and then making the judgments on what should be done about that temperature. If we can then
3511660	3515940	create a scenario where it thinks maybe the temperature is rising uncontrollably,
3515940	3522300	maybe there's cooling systems or maybe it kicks on the fire suppression systems or something.
3522300	3531260	So there is the risk of, you know, spoofing something and then providing information
3531260	3538020	from that spoof. But I also have a connection now, a bonded connection to my target device
3538020	3544560	that I could potentially exploit even further. So we just went through the basic pieces. We
3544560	3550620	cloned the advertisement data. We changed our device name. We cloned the device services.
3551780	3558980	We went through and turned on the advertiser and then we actually connected through
3559600	3567120	and provided a spoof that our victim connected to. So I do want to introduce
3569680	3582240	you to Hacknarr's BLE CTF. It runs on ESP32. Like I said, if you've ever been to any of my
3582240	3589420	in-person training sessions, I generally give these out to as many people as I can. So I have,
3589420	3595600	you know, like maybe 10 or 20 of these that I give out. But obviously since we are all
3596280	3601460	all safe mode and social distancing, then I can't really give a bunch of these out.
3601460	3608000	But they're like $10 and you can upload all the information yourself. And you can actually go
3608000	3614320	through a BLE CTF and it's more of just interacting on GAT services. So what we went through earlier
3614320	3622700	where we were doing the abusing of right privileges. So there are a bunch of challenges
3622700	3629660	on there. Some of them are, you know, decoding MD5 or, you know, following certain instructions
3629660	3636020	that you get back from the services. So if you have, you know, interest in exploring more on
3636020	3643320	the GAT side, then I would definitely recommend checking out Hacknarr's BLE CTF. And of course,
3643320	3648540	if you need help, feel free to reach out to me on Twitter or wherever.
3650160	3657100	And so a few recommendations for just kind of the individual Bluetooth low energy user or your
3657100	3666340	consumer. Keep your Bluetooth turned off unless you really need it. I know with the prevalence of
3666340	3672060	Bluetooth low energy devices, I find my Bluetooth is being turned on more and more and kept on for
3672060	3678120	longer and longer. So this might not be valid information in a few years. We may just always
3678120	3687560	have to just deal with Bluetooth being on. Choose low traffic areas to do pin pairing sessions with.
3687560	3697240	While it is fairly unlikely that there will be, you know, significant kind of leakage of keys
3697640	3704660	or pins, there is the chance that that could happen. So you're better off to choose sort of
3704880	3709620	a controlled RF space where you know there aren't going to be a lot of people eavesdropping.
3709740	3718940	Generally, your home is a good option. Or, you know, an uninhabited part of your office, maybe.
3720540	3728860	Also, be aware that like we saw with the Blue Fruit LE app, a lot of apps don't have spoofing
3728860	3734960	protections. So you could very well be connecting to something that is not what you thought it was.
3734960	3740980	And you've allowed an attacker to either provide you with false information or gain a bonded
3740980	3746340	connection to your phone that they could then further abuse. And then I would also say that,
3746340	3751820	you know, there are enough free tools out there that you could actually just start auditing all
3751820	3757960	the Bluetooth devices around you and see, can I abuse GAT services? Can I create a spoof of this
3757960	3764500	device? How does the application handle that? You might need two phones for that. But, yeah.
3764500	3769560	And then, of course, if you want to get deeper into that, you know, maybe pick up a dedicated
3769560	3777080	testing phone like an LG M150. Make sure it's running Android 7. So, yeah. Those are a few of
3777080	3784940	my recommendations for consumers. As far as developers, I like to push out of band pairing
3784940	3794540	options just because it pushes some of that very privileged and important information away from
3795440	3802480	the channel that is being used for data. So, using something like NFC to actually pass
3802480	3811880	long-term keys will increase the security of the Bluetooth data because... or the integrity of it
3811880	3819120	because you don't have the risk of using basically an unprotected channel to pass
3819120	3827200	keys to then protect it. So, you're using out of band practices. Don't focus solely on device
3827200	3838640	security. You know, does your application have good spoofing protections? Is your app just
3838640	3844240	looking for devices on name alone or is it looking, you know, for something deeper?
3844960	3854560	What I like to, you know, dream and recommend is that, you know, that there be a remote server
3854560	3861040	where you can actually validate the keys of a device before you ever connect to it through the
3861040	3867860	cloud. So, say your cloud application would actually... or your application on your phone
3867860	3873360	would have a connection to a cloud server somewhere. So, before you actually even start
3873580	3880400	a connection with a device, that advertising data and that key or short-term key would be passed to
3880980	3886460	your cloud and then validated. And if it's not valid, then obviously you wouldn't connect or
3886460	3891700	you could blacklist it or something like that. So, that's what I tend to recommend.
3892340	3901720	So, as far as further study, there are a number of Bluetooth researchers, but
3903440	3910320	probably the one that I follow the most and the most enthusiastic is Jiska. I think I'm saying
3910320	3920920	that right. But she is a... she's a security researcher and, yeah, an RF kind of wizard
3920920	3931380	out of Europe. So, yeah, follow her on Twitter. She does a lot of talks all over the place.
3931680	3938120	If you're looking for books, Hacking Exposed Wireless is amazing. I just went through the
3938120	3945580	work for the GAWN and it's very, very similar. Obviously written by the same people. So,
3945580	3949520	of course, there's going to be knowledge kind of overlap there.
3949980	3956660	And if you're looking to get more on the hands-on side, then the Adafruit BlueFruit LE,
3957460	3965040	the Thingy 52, ESP32s, and the UD100 Bluetooth USB adapter, which we didn't cover in this talk,
3965040	3968940	is capable of doing more long-range stuff. So,
3968940	3973240	that's definitely something you'll want to pick up if you have an interest in taking this further.
3978440	3988600	Okay. So, with the badge just on, if you just turn it on,
3988600	4000820	you can see the Bluetooth mesh pop up in nRF Connect. But I'm not able to connect to it.
4009400	4014080	So, I'm able to see the Anode XOR badge within nRF Connect,
4014080	4020560	the Bluetooth mesh you see there, it's listed as such. And I can try to connect to it.
4021280	4031140	And I have a connection to it, and it's giving me certain options. I've done some poking around
4031140	4038680	on this side, but I haven't found a lot. This SMP characteristic might be fun to poke around with.
4040440	4044400	But what I have seen is,
4053570	4061290	within the SMP characteristic, you can actually do some interesting commands that have these
4061290	4068230	right values here. But, you know, OS echo commands, so you can echo commands through Bluetooth into
4069490	4073430	the operating system. I haven't got much interaction from that. I've tried the
4073430	4078910	commands, but it hasn't really worked. But the one that I have seen that works very well
4078910	4086870	is the reset command. So, I will switch over here. So, as soon as I hit the reset command,
4086870	4095150	you'll see the badge turns off. We'll send that. And then the badge turns off.
4106430	4110530	Last year, if you were at DEF CON and they were talking about the Bluetooth mesh,
4110530	4117030	where you could attack other people's devices, you could connect to the badges,
4117030	4122970	and then you could send these commands, you know, turn people's badges off, or,
4122970	4128610	you know, make it do different things, send different commands. So, very cool,
4129150	4135290	very cool kind of puzzle and interaction and tool for learning. So, if you have one of these badges,
4135290	4142330	one of these Anonyx or DC27 badges, or I believe the one before that also had a Bluetooth mesh on
4142330	4148950	it. But if you have one of these badges, they would be awesome to hack on. Yeah,
4148950	4154730	so they have that Bluetooth component. That's going to wrap up my presentation.
4155010	4160230	And I just want to thank you for spending the time with me today and learning about
4160230	4165870	Bluetooth low-energy hacking. Hopefully, you learned something. Hopefully, you found something
4165870	4170130	that maybe caught your interest and, you know, you're ready to explore the Bluetooth low-energy
4170130	4178090	devices around you. Don't forget the further study that I pushed out in one of the last slides.
4178090	4183870	And if you have any questions, feel free to reach out to me on Twitter or LinkedIn or anywhere,
4183870	4190210	really. And I will try my best to get in touch with you. I know sometimes I don't do a great
4190210	4197530	job. But, yeah, so thank you so much for joining me. And I hope you have a wonderful, wonderful
4197530	4199350	DEF CON safe mode.