1 00:00:01,599 --> 00:00:03,600 hello thank you all for joining us at 2 00:00:03,600 --> 00:00:05,359 another wonderful car hiking village 3 00:00:05,359 --> 00:00:08,080 courtesy of defcon 30 recovery mode my 4 00:00:08,080 --> 00:00:10,639 name is kamel and today i'm going to be 5 00:00:10,639 --> 00:00:13,120 talking a little bit about bluetooth and 6 00:00:13,120 --> 00:00:15,839 the rf com protocol in particular and 7 00:00:15,839 --> 00:00:17,840 why you should consider it next time you 8 00:00:17,840 --> 00:00:19,920 go on a car hacking adventure 9 00:00:19,920 --> 00:00:21,680 before you just get started i just want 10 00:00:21,680 --> 00:00:23,760 to give a quick basic disclaimer all the 11 00:00:23,760 --> 00:00:25,519 views shared in this presentation are my 12 00:00:25,519 --> 00:00:27,760 own and do not represent the views of my 13 00:00:27,760 --> 00:00:30,720 employer or any other third parties 14 00:00:30,720 --> 00:00:32,000 uh of course gotta get that out of the 15 00:00:32,000 --> 00:00:34,640 way so starting off uh with a very 16 00:00:34,640 --> 00:00:36,960 simple who am i uh so i'm an automotive 17 00:00:36,960 --> 00:00:39,280 cyber security technology architect at 18 00:00:39,280 --> 00:00:41,440 white motion which is a subsidiary of 19 00:00:41,440 --> 00:00:43,120 the international automotive tier 1 20 00:00:43,120 --> 00:00:44,960 supplier morelli 21 00:00:44,960 --> 00:00:46,559 white motion is a special team within 22 00:00:46,559 --> 00:00:49,039 morelli that specializes in automotive 23 00:00:49,039 --> 00:00:51,360 cyber security carrying out penetration 24 00:00:51,360 --> 00:00:53,280 tests for our parent company and 25 00:00:53,280 --> 00:00:54,960 external companies alike 26 00:00:54,960 --> 00:00:56,559 and contributing to the automotive 27 00:00:56,559 --> 00:00:59,120 security industry overall by providing 28 00:00:59,120 --> 00:01:01,760 car hacking training and legislation or 29 00:01:01,760 --> 00:01:03,440 standards compliance 30 00:01:03,440 --> 00:01:05,040 i'm an active member of the automotive 31 00:01:05,040 --> 00:01:07,520 security research group or asrg 32 00:01:07,520 --> 00:01:09,920 and i love participating in car hacking 33 00:01:09,920 --> 00:01:12,320 communities so on and so forth even 34 00:01:12,320 --> 00:01:14,479 outside of my professional duties so i 35 00:01:14,479 --> 00:01:16,960 volunteer a little bit here and there 36 00:01:16,960 --> 00:01:18,960 among my recent areas of interest when 37 00:01:18,960 --> 00:01:21,600 it comes to security work uh we've got 38 00:01:21,600 --> 00:01:23,280 you know bluetooth which i'll be talking 39 00:01:23,280 --> 00:01:24,960 a little bit about today the usb 40 00:01:24,960 --> 00:01:28,400 protocol general rf stuff and reverse 41 00:01:28,400 --> 00:01:30,799 engineering the firmware update process 42 00:01:30,799 --> 00:01:32,880 for some really obscure taiwanese 43 00:01:32,880 --> 00:01:34,640 microcontrollers but thankfully that's 44 00:01:34,640 --> 00:01:36,799 over i don't have to do that anymore 45 00:01:36,799 --> 00:01:38,880 but besides the technical stuff and 46 00:01:38,880 --> 00:01:41,600 outside the office or garage i suppose 47 00:01:41,600 --> 00:01:43,439 i enjoy playing fighting games and 48 00:01:43,439 --> 00:01:46,240 cooking and i also love exploring new 49 00:01:46,240 --> 00:01:47,759 places so whenever i get the chance to 50 00:01:47,759 --> 00:01:49,600 go somewhere i always make sure i get 51 00:01:49,600 --> 00:01:51,840 lost once or twice before i go home 52 00:01:51,840 --> 00:01:52,960 so 53 00:01:52,960 --> 00:01:56,079 let's go over uh very briefly the table 54 00:01:56,079 --> 00:01:58,719 of contents for today's talk so i'd like 55 00:01:58,719 --> 00:02:00,159 to say that the overall objective of the 56 00:02:00,159 --> 00:02:01,600 talk is 57 00:02:01,600 --> 00:02:03,040 isn't only to talk about the rfcom 58 00:02:03,040 --> 00:02:05,040 protocol to say but to familiarize you 59 00:02:05,040 --> 00:02:07,280 with the complexity of the bluetooth 60 00:02:07,280 --> 00:02:09,280 specification as a technology and 61 00:02:09,280 --> 00:02:11,440 highlight how many different ways it can 62 00:02:11,440 --> 00:02:13,520 be viewed from a security perspective 63 00:02:13,520 --> 00:02:14,959 to that effect i'm going to start off 64 00:02:14,959 --> 00:02:16,480 with a short recap of what exactly 65 00:02:16,480 --> 00:02:18,239 bluetooth is including a look at how 66 00:02:18,239 --> 00:02:20,640 it's used in vehicles and talk a little 67 00:02:20,640 --> 00:02:23,280 bit about some scenarios or cases very 68 00:02:23,280 --> 00:02:24,959 very short case studies where bluetooth 69 00:02:24,959 --> 00:02:26,400 has been used 70 00:02:26,400 --> 00:02:28,720 uh to target vehicles in the past from a 71 00:02:28,720 --> 00:02:30,480 security perspective so we'll look over 72 00:02:30,480 --> 00:02:32,239 some some past research by other 73 00:02:32,239 --> 00:02:34,319 individuals not myself 74 00:02:34,319 --> 00:02:36,959 that have been more or less 75 00:02:36,959 --> 00:02:39,680 prominent parts of bluetooth's history 76 00:02:39,680 --> 00:02:41,599 in the automotive security landscape 77 00:02:41,599 --> 00:02:43,040 after that we're gonna take a closer 78 00:02:43,040 --> 00:02:45,120 look at the star of the show the rfcom 79 00:02:45,120 --> 00:02:47,680 protocol and then i'm going to introduce 80 00:02:47,680 --> 00:02:50,080 a very simple tool that i made called 81 00:02:50,080 --> 00:02:52,480 the rf comrade that you might be able to 82 00:02:52,480 --> 00:02:54,400 use yourself on your own rfcom testing 83 00:02:54,400 --> 00:02:55,760 in the future 84 00:02:55,760 --> 00:02:56,959 and finally i'm going to talk a little 85 00:02:56,959 --> 00:02:58,560 bit about the bluetooth ctf that we'll 86 00:02:58,560 --> 00:03:00,640 be featuring at the car hacking village 87 00:03:00,640 --> 00:03:02,159 this year at defcon 88 00:03:02,159 --> 00:03:04,080 excuse me just a disclaimer i haven't 89 00:03:04,080 --> 00:03:05,840 hidden any flags in the presentation 90 00:03:05,840 --> 00:03:08,080 itself so don't feel like you'll be 91 00:03:08,080 --> 00:03:10,000 missing out on anything if you're not 92 00:03:10,000 --> 00:03:11,280 like paying super close attention and 93 00:03:11,280 --> 00:03:13,360 taking notes on everything screenshoting 94 00:03:13,360 --> 00:03:15,680 every every every slide that there won't 95 00:03:15,680 --> 00:03:17,599 be anything like that so feel free to 96 00:03:17,599 --> 00:03:20,080 just relax and and enjoy the talk right 97 00:03:20,080 --> 00:03:21,040 so 98 00:03:21,040 --> 00:03:22,480 let's get started 99 00:03:22,480 --> 00:03:24,480 so you probably already know what 100 00:03:24,480 --> 00:03:27,280 bluetooth is entirely independently of 101 00:03:27,280 --> 00:03:29,040 any technical understanding of how it 102 00:03:29,040 --> 00:03:30,879 works and that should be a testament to 103 00:03:30,879 --> 00:03:33,040 how widely used it is and that's really 104 00:03:33,040 --> 00:03:35,680 great you know all end user technologies 105 00:03:35,680 --> 00:03:37,840 should be easy to use even if you don't 106 00:03:37,840 --> 00:03:39,440 understand the technical details behind 107 00:03:39,440 --> 00:03:41,440 them and bluetooth is pretty widely used 108 00:03:41,440 --> 00:03:43,599 uh to that effect 109 00:03:43,599 --> 00:03:44,840 it's in your phone it's in your 110 00:03:44,840 --> 00:03:47,040 headphones maybe it's in your fridge 111 00:03:47,040 --> 00:03:48,480 your microwave 112 00:03:48,480 --> 00:03:50,720 probably not your microwave 113 00:03:50,720 --> 00:03:52,720 maybe your coffee maker and it's almost 114 00:03:52,720 --> 00:03:54,560 certainly in your car 115 00:03:54,560 --> 00:03:57,599 but what exactly is bluetooth so 116 00:03:57,599 --> 00:03:59,360 the official definition is that 117 00:03:59,360 --> 00:04:02,159 bluetooth is a common cable replacement 118 00:04:02,159 --> 00:04:04,720 technology right found in virtually all 119 00:04:04,720 --> 00:04:06,799 smartphones computers and many wireless 120 00:04:06,799 --> 00:04:09,840 iot accessory devices worldwide 121 00:04:09,840 --> 00:04:11,120 it is 122 00:04:11,120 --> 00:04:12,959 designed to simplify short-range 123 00:04:12,959 --> 00:04:15,120 wireless communications by providing a 124 00:04:15,120 --> 00:04:17,279 uniform framework for connecting devices 125 00:04:17,279 --> 00:04:18,478 to one another 126 00:04:18,478 --> 00:04:20,399 it operates in the 2.4 gigahertz 127 00:04:20,399 --> 00:04:21,759 frequency range which is the same as 128 00:04:21,759 --> 00:04:23,919 wi-fi and as a result you will get a lot 129 00:04:23,919 --> 00:04:25,840 of wi-fi chips that are actually bundled 130 00:04:25,840 --> 00:04:27,840 together with bluetooth functionality 131 00:04:27,840 --> 00:04:30,639 just because they can use the same 132 00:04:30,639 --> 00:04:32,639 uh radio frequency band 133 00:04:32,639 --> 00:04:34,400 but of course like we mentioned you know 134 00:04:34,400 --> 00:04:36,080 bluetooth is used in a lot of devices 135 00:04:36,080 --> 00:04:37,919 wireless headphones medical equipment 136 00:04:37,919 --> 00:04:40,240 sensors interactive lighting you know 137 00:04:40,240 --> 00:04:42,160 even used for basic data transfers 138 00:04:42,160 --> 00:04:43,919 between devices you can do 139 00:04:43,919 --> 00:04:46,160 file transfer protocol over bluetooth or 140 00:04:46,160 --> 00:04:47,360 so on and so forth we'll see a little 141 00:04:47,360 --> 00:04:49,199 bit more about that later 142 00:04:49,199 --> 00:04:50,800 and then since bluetooth low energy came 143 00:04:50,800 --> 00:04:53,120 out especially it's been very popular 144 00:04:53,120 --> 00:04:54,080 with 145 00:04:54,080 --> 00:04:55,919 things that you would set up in a 146 00:04:55,919 --> 00:04:57,759 outside environment something like a 147 00:04:57,759 --> 00:04:59,919 like an environmental temperature sensor 148 00:04:59,919 --> 00:05:00,960 or 149 00:05:00,960 --> 00:05:02,720 a humidity sensor that needs to stay on 150 00:05:02,720 --> 00:05:04,240 for long periods of time maybe doesn't 151 00:05:04,240 --> 00:05:06,560 have access to direct power supply but 152 00:05:06,560 --> 00:05:08,240 runs on a battery and you want to save 153 00:05:08,240 --> 00:05:09,759 power over long periods of time that's 154 00:05:09,759 --> 00:05:11,039 when things like bluetooth low energy 155 00:05:11,039 --> 00:05:13,520 come into play and are very helpful 156 00:05:13,520 --> 00:05:15,280 and you know obviously you know as we 157 00:05:15,280 --> 00:05:16,160 mentioned 158 00:05:16,160 --> 00:05:17,680 bluetooth is pretty common in cars today 159 00:05:17,680 --> 00:05:18,960 if it wasn't i wouldn't be giving this 160 00:05:18,960 --> 00:05:20,720 presentation here i'd be trying to give 161 00:05:20,720 --> 00:05:22,000 it somewhere else 162 00:05:22,000 --> 00:05:24,400 but in a vehicle bluetooth is usually 163 00:05:24,400 --> 00:05:27,120 used by the infotainment system or the 164 00:05:27,120 --> 00:05:28,800 head unit or whatever you want to call 165 00:05:28,800 --> 00:05:30,880 it right the thing that has all the cool 166 00:05:30,880 --> 00:05:32,400 flashy buttons that you can play with 167 00:05:32,400 --> 00:05:34,160 and play your music through 168 00:05:34,160 --> 00:05:37,360 bluetooth is used primarily originally 169 00:05:37,360 --> 00:05:39,919 in cars for making hands-free phone 170 00:05:39,919 --> 00:05:41,520 calls so while you're driving the car 171 00:05:41,520 --> 00:05:43,360 you can answer answer a phone call and 172 00:05:43,360 --> 00:05:45,199 play it through your your car's speakers 173 00:05:45,199 --> 00:05:46,479 and microphone 174 00:05:46,479 --> 00:05:48,479 and it's also used to import your phone 175 00:05:48,479 --> 00:05:50,479 book from a phone for quality of life 176 00:05:50,479 --> 00:05:51,680 you can see you know have all your 177 00:05:51,680 --> 00:05:53,199 contacts listed so you can know who's 178 00:05:53,199 --> 00:05:54,240 calling you 179 00:05:54,240 --> 00:05:56,000 and some cars will actually even let you 180 00:05:56,000 --> 00:05:58,000 import your entire text message history 181 00:05:58,000 --> 00:05:59,120 uh so you can have all your text 182 00:05:59,120 --> 00:06:00,720 messages stored on your car so you can 183 00:06:00,720 --> 00:06:01,840 go back and look through them through 184 00:06:01,840 --> 00:06:03,520 your car's console 185 00:06:03,520 --> 00:06:06,639 i've even seen some phones that are 186 00:06:06,639 --> 00:06:08,240 excuse me some vehicles that through a 187 00:06:08,240 --> 00:06:10,560 bluetooth connection can actually let 188 00:06:10,560 --> 00:06:12,800 your phone send out a text message right 189 00:06:12,800 --> 00:06:14,880 so essentially you know if i'm driving 190 00:06:14,880 --> 00:06:16,400 obviously i'm driving i'm not trying to 191 00:06:16,400 --> 00:06:18,000 answer a phone call if i don't have the 192 00:06:18,000 --> 00:06:19,600 opportunity you know if it's especially 193 00:06:19,600 --> 00:06:20,800 if i'm going you know down the highway 194 00:06:20,800 --> 00:06:22,319 or something i can push a button that 195 00:06:22,319 --> 00:06:25,199 will tell my phone to respond to the the 196 00:06:25,199 --> 00:06:27,600 caller with a text message saying sorry 197 00:06:27,600 --> 00:06:29,440 i can't pick up i'm driving right now 198 00:06:29,440 --> 00:06:31,360 and so it's it's you can get very 199 00:06:31,360 --> 00:06:33,680 creative with how this uh seemingly 200 00:06:33,680 --> 00:06:35,039 simple 201 00:06:35,039 --> 00:06:36,639 application you know just an extension 202 00:06:36,639 --> 00:06:39,919 of your phone can actually be used right 203 00:06:39,919 --> 00:06:42,240 uh more recently though bluetooth and 204 00:06:42,240 --> 00:06:44,160 bluetooth low energy or ble have been 205 00:06:44,160 --> 00:06:46,560 used for more advanced functions in cars 206 00:06:46,560 --> 00:06:49,039 so ranging from things like updating the 207 00:06:49,039 --> 00:06:51,199 firmware on key fobs there's been some 208 00:06:51,199 --> 00:06:53,360 research on the tesla key fobs in there 209 00:06:53,360 --> 00:06:55,680 from our updating process over bluetooth 210 00:06:55,680 --> 00:06:57,680 uh to things like passive keyless entry 211 00:06:57,680 --> 00:06:59,120 systems and 212 00:06:59,120 --> 00:07:00,479 excuse me we'll look at a case where 213 00:07:00,479 --> 00:07:03,759 this was a a big target for a security 214 00:07:03,759 --> 00:07:06,240 research group in just a second 215 00:07:06,240 --> 00:07:08,240 but before we go into the full technical 216 00:07:08,240 --> 00:07:10,479 details like i said i do want to go over 217 00:07:10,479 --> 00:07:12,720 some of the more notable pieces of 218 00:07:12,720 --> 00:07:14,240 research that have come out regarding 219 00:07:14,240 --> 00:07:16,160 bluetooth security and vehicles over the 220 00:07:16,160 --> 00:07:18,240 last few years so i've got two i'm not 221 00:07:18,240 --> 00:07:19,759 going to talk too extensively about i'm 222 00:07:19,759 --> 00:07:20,880 just going to kind of run through them 223 00:07:20,880 --> 00:07:22,479 real quick these are very 224 00:07:22,479 --> 00:07:23,599 uh 225 00:07:23,599 --> 00:07:26,880 well thought out research 226 00:07:26,880 --> 00:07:28,639 pieces and i definitely recommend you go 227 00:07:28,639 --> 00:07:30,560 and find the original source material by 228 00:07:30,560 --> 00:07:32,160 whoever published them to get the full 229 00:07:32,160 --> 00:07:34,080 details on what exactly they were doing 230 00:07:34,080 --> 00:07:36,080 but i'll just be quickly summarizing uh 231 00:07:36,080 --> 00:07:38,000 for for the sake of this talk 232 00:07:38,000 --> 00:07:39,680 so the first example i want to touch on 233 00:07:39,680 --> 00:07:42,800 is some research disclosed by tencent 234 00:07:42,800 --> 00:07:45,680 keen labs in 2020 so the researchers at 235 00:07:45,680 --> 00:07:47,759 keene were able to fully compromise the 236 00:07:47,759 --> 00:07:50,400 head unit of a lexus vehicle by using 237 00:07:50,400 --> 00:07:53,120 bluetooth of a bluetooth vulnerability 238 00:07:53,120 --> 00:07:55,440 as the initial compromise vector right 239 00:07:55,440 --> 00:07:56,960 so the 240 00:07:56,960 --> 00:07:58,240 first thing they were able to do is 241 00:07:58,240 --> 00:08:00,160 exploit the bluetooth stack on the 242 00:08:00,160 --> 00:08:02,400 vehicle to get some remote code 243 00:08:02,400 --> 00:08:04,479 execution and from there they were then 244 00:08:04,479 --> 00:08:06,560 able to you know expand their reach of 245 00:08:06,560 --> 00:08:07,680 influence throughout the vehicle's 246 00:08:07,680 --> 00:08:09,919 infotainment system to establish a wi-fi 247 00:08:09,919 --> 00:08:11,680 based backdoor 248 00:08:11,680 --> 00:08:13,599 the reason for this was wi-fi is 249 00:08:13,599 --> 00:08:17,039 generally you know a longer range 250 00:08:17,039 --> 00:08:18,639 technology than bluetooth so this gave 251 00:08:18,639 --> 00:08:20,639 them the ability to 252 00:08:20,639 --> 00:08:21,840 get their 253 00:08:21,840 --> 00:08:24,160 reverse shell as you might say on the 254 00:08:24,160 --> 00:08:26,240 car from a farther away range and then 255 00:08:26,240 --> 00:08:27,599 they could continue their their 256 00:08:27,599 --> 00:08:32,000 exploration of the vehicle at that point 257 00:08:32,000 --> 00:08:34,880 uh so they had set up a essentially you 258 00:08:34,880 --> 00:08:36,320 know some persistence in the vehicle 259 00:08:36,320 --> 00:08:38,000 where when it booted up it would 260 00:08:38,000 --> 00:08:39,360 actually phone home it would actually 261 00:08:39,360 --> 00:08:41,279 connect back to the researchers pc and 262 00:08:41,279 --> 00:08:43,120 they could then open a shell and 263 00:08:43,120 --> 00:08:45,920 continue exploration and exploitation 264 00:08:45,920 --> 00:08:46,800 so 265 00:08:46,800 --> 00:08:48,480 due to the fact that there were no 266 00:08:48,480 --> 00:08:50,399 firmware checks in place to prevent 267 00:08:50,399 --> 00:08:51,680 anyone from 268 00:08:51,680 --> 00:08:53,839 you know flashing unauthorized firmware 269 00:08:53,839 --> 00:08:55,680 to other parts of this infotainment 270 00:08:55,680 --> 00:08:56,720 system 271 00:08:56,720 --> 00:08:58,880 the researchers were actually able to 272 00:08:58,880 --> 00:09:02,000 flash other components inside that unit 273 00:09:02,000 --> 00:09:03,920 and essentially unlock can bus access 274 00:09:03,920 --> 00:09:05,920 the can bus was obviously available on 275 00:09:05,920 --> 00:09:09,279 the device however it was intended to be 276 00:09:09,279 --> 00:09:11,360 kind of filtered or locked off so that 277 00:09:11,360 --> 00:09:13,839 you couldn't just send and receive 278 00:09:13,839 --> 00:09:16,399 arbitrary messages at your whims but 279 00:09:16,399 --> 00:09:18,320 because of the ability to rewrite the 280 00:09:18,320 --> 00:09:19,760 firmware due to the lack of firmware 281 00:09:19,760 --> 00:09:21,200 checks they're actually able to bypass 282 00:09:21,200 --> 00:09:24,080 this and they were able to kind of 283 00:09:24,080 --> 00:09:26,399 expand their reach a bit further at this 284 00:09:26,399 --> 00:09:28,160 point there are further possibilities to 285 00:09:28,160 --> 00:09:30,480 pivot within the vehicle system 286 00:09:30,480 --> 00:09:32,080 for example using diagnostics to 287 00:09:32,080 --> 00:09:33,839 potentially reprogram other parts of the 288 00:09:33,839 --> 00:09:35,760 car but the researchers didn't quite go 289 00:09:35,760 --> 00:09:37,519 that far in the publication they 290 00:09:37,519 --> 00:09:39,600 released of course uh this will be 291 00:09:39,600 --> 00:09:40,959 linked in the references section at the 292 00:09:40,959 --> 00:09:42,399 end you're free to 293 00:09:42,399 --> 00:09:44,399 encourage to read up their full write-up 294 00:09:44,399 --> 00:09:46,320 it is incredibly educational and i think 295 00:09:46,320 --> 00:09:48,160 anybody uh could benefit from giving it 296 00:09:48,160 --> 00:09:49,279 a look 297 00:09:49,279 --> 00:09:50,720 the last attack i want to talk about is 298 00:09:50,720 --> 00:09:52,880 much more a little bit more recent uh 299 00:09:52,880 --> 00:09:55,760 this came out earlier this year in may 300 00:09:55,760 --> 00:09:58,720 of 2022. so this was some research that 301 00:09:58,720 --> 00:10:01,279 was disclosed by the ncc group after 302 00:10:01,279 --> 00:10:02,959 they found out that the passive keyless 303 00:10:02,959 --> 00:10:05,519 entry system used in tesla models 3 and 304 00:10:05,519 --> 00:10:07,839 models y i believe are susceptible to 305 00:10:07,839 --> 00:10:09,600 relay attacks right 306 00:10:09,600 --> 00:10:12,079 so a relay attack 307 00:10:12,079 --> 00:10:13,760 is not something new to vehicles right 308 00:10:13,760 --> 00:10:16,399 the idea that you can pass the 309 00:10:16,399 --> 00:10:19,440 signal from a key fob on to a car and 310 00:10:19,440 --> 00:10:21,360 unlock it without having the key fob 311 00:10:21,360 --> 00:10:23,600 within the intended range 312 00:10:23,600 --> 00:10:25,200 is is kind of a theoretical attack 313 00:10:25,200 --> 00:10:27,680 that's existed for a while but these 314 00:10:27,680 --> 00:10:29,279 researchers were able to perform this 315 00:10:29,279 --> 00:10:31,519 over bluetooth low energy 316 00:10:31,519 --> 00:10:32,959 so the challenge to getting the attack 317 00:10:32,959 --> 00:10:35,920 to work on the tesla's pke system was 318 00:10:35,920 --> 00:10:37,839 that the key exchange had to be done 319 00:10:37,839 --> 00:10:39,839 within a given time frame there's like a 320 00:10:39,839 --> 00:10:42,720 timeout in place that's designed to 321 00:10:42,720 --> 00:10:44,480 kind of prevent against this kind of 322 00:10:44,480 --> 00:10:46,079 relay attack because the communications 323 00:10:46,079 --> 00:10:47,440 have to happen there's cryptographic 324 00:10:47,440 --> 00:10:49,839 information exchanged and the idea is is 325 00:10:49,839 --> 00:10:50,720 that all right if there's someone 326 00:10:50,720 --> 00:10:52,640 sitting in between these two devices the 327 00:10:52,640 --> 00:10:53,839 actual car 328 00:10:53,839 --> 00:10:55,760 and the um 329 00:10:55,760 --> 00:10:57,839 and the intended user's key right their 330 00:10:57,839 --> 00:10:58,880 phone 331 00:10:58,880 --> 00:11:00,800 the added latency of passing the 332 00:11:00,800 --> 00:11:03,519 information between several devices uh 333 00:11:03,519 --> 00:11:06,000 may you know exceed that minimum time 334 00:11:06,000 --> 00:11:07,920 frame that you have to actually perform 335 00:11:07,920 --> 00:11:10,000 these operations and would make it much 336 00:11:10,000 --> 00:11:12,160 harder but uh 337 00:11:12,160 --> 00:11:12,959 the 338 00:11:12,959 --> 00:11:14,480 researchers were actually able to figure 339 00:11:14,480 --> 00:11:16,240 out a way to do that they would use one 340 00:11:16,240 --> 00:11:18,959 cell phone to kind of go near the target 341 00:11:18,959 --> 00:11:20,560 human being right the person with the 342 00:11:20,560 --> 00:11:22,320 actual phone to unlock the car they 343 00:11:22,320 --> 00:11:24,720 could then sniff this uh bluetooth low 344 00:11:24,720 --> 00:11:26,320 energy signal 345 00:11:26,320 --> 00:11:28,079 over the air and then pass it through 346 00:11:28,079 --> 00:11:29,680 over the internet like an ip network 347 00:11:29,680 --> 00:11:31,839 just like anything else uh to another 348 00:11:31,839 --> 00:11:33,920 phone that was close to the car 349 00:11:33,920 --> 00:11:35,680 and they could actually perform these 350 00:11:35,680 --> 00:11:38,480 cryptographic chain checks uh over the 351 00:11:38,480 --> 00:11:40,480 internet and this you know very close 352 00:11:40,480 --> 00:11:42,720 range communication between the the two 353 00:11:42,720 --> 00:11:44,880 attacker cell phones in a time frame 354 00:11:44,880 --> 00:11:46,959 that allowed them to bypass 355 00:11:46,959 --> 00:11:49,920 the uh latency bounding in place so this 356 00:11:49,920 --> 00:11:51,519 essentially gave them the ability to 357 00:11:51,519 --> 00:11:53,200 unlock the car and then the car thinks 358 00:11:53,200 --> 00:11:54,720 well i've got the key inside me i should 359 00:11:54,720 --> 00:11:56,399 unlock all functionality 360 00:11:56,399 --> 00:11:58,639 and well the next step obviously is 361 00:11:58,639 --> 00:11:59,920 going to be uh 362 00:11:59,920 --> 00:12:02,240 a room room right so you can break off 363 00:12:02,240 --> 00:12:04,240 with the car and all of a sudden you 364 00:12:04,240 --> 00:12:05,680 know you come back from your shopping 365 00:12:05,680 --> 00:12:07,600 trip and your car is missing and what 366 00:12:07,600 --> 00:12:10,320 happened right so again uh the link to 367 00:12:10,320 --> 00:12:12,079 the actual publication for this research 368 00:12:12,079 --> 00:12:14,160 will be in the references section at the 369 00:12:14,160 --> 00:12:16,160 end so i encourage you to go ahead and 370 00:12:16,160 --> 00:12:18,560 give it a full look 371 00:12:18,560 --> 00:12:19,839 so the next part is going to be the 372 00:12:19,839 --> 00:12:23,040 bluetooth breakdown i'm going to give a 373 00:12:23,040 --> 00:12:24,880 brief brief explanation of how the 374 00:12:24,880 --> 00:12:26,720 different protocols that make up 375 00:12:26,720 --> 00:12:29,120 bluetooth work so 376 00:12:29,120 --> 00:12:31,839 this uh picture is pretty ugly so bear 377 00:12:31,839 --> 00:12:33,920 with me for one moment um and it 378 00:12:33,920 --> 00:12:35,200 represents 379 00:12:35,200 --> 00:12:37,120 a visual representation of some of the 380 00:12:37,120 --> 00:12:38,480 different protocols 381 00:12:38,480 --> 00:12:41,440 that make up what we know as bluetooth 382 00:12:41,440 --> 00:12:43,200 and this is important because you know 383 00:12:43,200 --> 00:12:45,680 the way i see it bluetooth is not one 384 00:12:45,680 --> 00:12:47,680 protocol it's a bunch of smaller 385 00:12:47,680 --> 00:12:48,880 protocols 386 00:12:48,880 --> 00:12:50,399 standing on one another's shoulders all 387 00:12:50,399 --> 00:12:52,399 wearing a big a big coat right 388 00:12:52,399 --> 00:12:54,320 pretending to be just a one-on-one 389 00:12:54,320 --> 00:12:55,519 protocol 390 00:12:55,519 --> 00:12:57,440 but it's actually a technology standard 391 00:12:57,440 --> 00:12:59,680 for short-range wireless communication 392 00:12:59,680 --> 00:13:01,680 and each of these sub-protocols has its 393 00:13:01,680 --> 00:13:03,360 own specification 394 00:13:03,360 --> 00:13:04,399 and 395 00:13:04,399 --> 00:13:06,399 the all of these you know 396 00:13:06,399 --> 00:13:08,800 of of which are managed by the bluetooth 397 00:13:08,800 --> 00:13:10,399 special interest group or the bluetooth 398 00:13:10,399 --> 00:13:13,279 sig as is easier to call it uh so this 399 00:13:13,279 --> 00:13:15,040 is a group of companies and 400 00:13:15,040 --> 00:13:16,639 representatives of these companies that 401 00:13:16,639 --> 00:13:18,240 manage the bluetooth specification make 402 00:13:18,240 --> 00:13:20,240 edits to it manage security bulletins 403 00:13:20,240 --> 00:13:22,000 etc so on and so forth and the 404 00:13:22,000 --> 00:13:23,519 specification itself is you can actually 405 00:13:23,519 --> 00:13:25,839 read it for free it's available online 406 00:13:25,839 --> 00:13:28,560 um but while the specification itself is 407 00:13:28,560 --> 00:13:31,120 managed by the bluetooth sig the actual 408 00:13:31,120 --> 00:13:34,160 implementations of these are not right 409 00:13:34,160 --> 00:13:36,079 so this is this 410 00:13:36,079 --> 00:13:38,320 the source of one level of bluetooth's 411 00:13:38,320 --> 00:13:40,240 complexity as a protocol right each of 412 00:13:40,240 --> 00:13:41,920 these protocols can be implemented 413 00:13:41,920 --> 00:13:44,079 differently and many of these protocols 414 00:13:44,079 --> 00:13:46,560 are implemented on the chip the 415 00:13:46,560 --> 00:13:50,079 controller they're entirely invisible 416 00:13:50,079 --> 00:13:52,320 to the end user and so it sometimes 417 00:13:52,320 --> 00:13:54,079 makes them hard to analyze from a 418 00:13:54,079 --> 00:13:56,399 security perspective maybe this will 419 00:13:56,399 --> 00:13:57,920 give you a better idea of what i'm 420 00:13:57,920 --> 00:13:59,279 talking about 421 00:13:59,279 --> 00:14:00,240 so 422 00:14:00,240 --> 00:14:01,680 hopefully things look a little bit nicer 423 00:14:01,680 --> 00:14:02,560 now 424 00:14:02,560 --> 00:14:04,079 uh you can see here let me pull up the 425 00:14:04,079 --> 00:14:06,480 laser pointer uh we have 426 00:14:06,480 --> 00:14:07,360 the 427 00:14:07,360 --> 00:14:09,920 bottom part here which is the red 428 00:14:09,920 --> 00:14:11,519 protocols these are what we call the 429 00:14:11,519 --> 00:14:13,920 controller layer protocols then up here 430 00:14:13,920 --> 00:14:16,079 on top you have the the bluish ones 431 00:14:16,079 --> 00:14:19,360 these are the host layer protocols right 432 00:14:19,360 --> 00:14:21,040 so the lower layer represents the 433 00:14:21,040 --> 00:14:22,639 protocols that are controlled by the 434 00:14:22,639 --> 00:14:24,399 actual controller this means that these 435 00:14:24,399 --> 00:14:26,160 functions are controlled by the firmware 436 00:14:26,160 --> 00:14:28,160 on the bluetooth chip itself 437 00:14:28,160 --> 00:14:30,000 and the operating system that's using 438 00:14:30,000 --> 00:14:31,839 this bluetooth chip 439 00:14:31,839 --> 00:14:34,399 has close to no visibility into what's 440 00:14:34,399 --> 00:14:36,000 going on down there 441 00:14:36,000 --> 00:14:38,160 this is why low-level protocols such as 442 00:14:38,160 --> 00:14:40,240 the hardware focus baseband and radio 443 00:14:40,240 --> 00:14:41,600 layers operate 444 00:14:41,600 --> 00:14:43,600 uh and as well as the link management 445 00:14:43,600 --> 00:14:45,920 protocol have such a bit of a like a 446 00:14:45,920 --> 00:14:47,600 mystery around them because it's not 447 00:14:47,600 --> 00:14:49,600 easy to see what they're doing right 448 00:14:49,600 --> 00:14:51,040 because the firmware will be implemented 449 00:14:51,040 --> 00:14:53,279 differently based on uh different uh 450 00:14:53,279 --> 00:14:55,600 vendors of these chips right 451 00:14:55,600 --> 00:14:57,120 because there are so many manufacturers 452 00:14:57,120 --> 00:14:58,720 each of their own unique compositions 453 00:14:58,720 --> 00:15:00,240 sometimes different architectures they 454 00:15:00,240 --> 00:15:01,279 use 455 00:15:01,279 --> 00:15:03,279 special you know commands we'll talk 456 00:15:03,279 --> 00:15:05,440 about hci in a second it can be quite 457 00:15:05,440 --> 00:15:07,360 complicated if you wanted to like first 458 00:15:07,360 --> 00:15:09,440 engineer these for example 459 00:15:09,440 --> 00:15:10,880 also some companies you know example 460 00:15:10,880 --> 00:15:13,440 companies that make uh bluetooth chips 461 00:15:13,440 --> 00:15:16,000 you've got broadcom you got qualcomm 462 00:15:16,000 --> 00:15:18,639 cambridge intel these are all 463 00:15:18,639 --> 00:15:21,440 different manufacturers you could find 464 00:15:21,440 --> 00:15:23,680 uh that have implemented their own you 465 00:15:23,680 --> 00:15:24,880 know 466 00:15:24,880 --> 00:15:27,440 version of the bluetooth specification 467 00:15:27,440 --> 00:15:29,759 on this chip right and the middle layer 468 00:15:29,759 --> 00:15:31,360 here this purple one because you know 469 00:15:31,360 --> 00:15:34,160 it's a mix of like the blue and the red 470 00:15:34,160 --> 00:15:36,160 uh is the host controller interface 471 00:15:36,160 --> 00:15:38,160 layer this is the protocol that's used 472 00:15:38,160 --> 00:15:40,079 to allow the host to communicate with 473 00:15:40,079 --> 00:15:41,360 the controller there is some 474 00:15:41,360 --> 00:15:43,920 standardization around how hci commands 475 00:15:43,920 --> 00:15:45,440 are implemented but there can also be 476 00:15:45,440 --> 00:15:47,519 vendor-specific instructions based on 477 00:15:47,519 --> 00:15:49,199 the vendor of the bluetooth chip again a 478 00:15:49,199 --> 00:15:50,320 lot of the stuff is going to be 479 00:15:50,320 --> 00:15:51,680 different from under defender which is 480 00:15:51,680 --> 00:15:53,360 another one of the reasons a little bit 481 00:15:53,360 --> 00:15:54,880 complicated 482 00:15:54,880 --> 00:15:57,120 if you've ever used bluetooth with linux 483 00:15:57,120 --> 00:15:58,560 before for example you know you might 484 00:15:58,560 --> 00:16:00,320 google okay how to use bluetooth on 485 00:16:00,320 --> 00:16:01,839 linux and one of the first commands 486 00:16:01,839 --> 00:16:04,160 they'll tell you to run is hci config 487 00:16:04,160 --> 00:16:06,000 and that's a pretty standard linux 488 00:16:06,000 --> 00:16:07,360 bluetooth tool and it stands for you 489 00:16:07,360 --> 00:16:08,800 know host controller interface 490 00:16:08,800 --> 00:16:10,000 configuration this will give you 491 00:16:10,000 --> 00:16:11,839 information about the bluetooth 492 00:16:11,839 --> 00:16:13,360 controller that you're using right any 493 00:16:13,360 --> 00:16:14,240 bluetooth controllers that are 494 00:16:14,240 --> 00:16:15,920 registered on your system you can see 495 00:16:15,920 --> 00:16:17,360 information about them with this command 496 00:16:17,360 --> 00:16:19,920 right another one is hci tool a couple 497 00:16:19,920 --> 00:16:22,560 of really useful tools implemented with 498 00:16:22,560 --> 00:16:24,880 the hci protocol right to read or write 499 00:16:24,880 --> 00:16:26,959 information on your bluetooth controller 500 00:16:26,959 --> 00:16:29,040 run scans lots of things you can do with 501 00:16:29,040 --> 00:16:29,839 it 502 00:16:29,839 --> 00:16:32,079 these tools work by sending standardized 503 00:16:32,079 --> 00:16:34,320 messages from the operating system to 504 00:16:34,320 --> 00:16:36,079 the controller to which the controller 505 00:16:36,079 --> 00:16:37,600 will say oh you're asking for this piece 506 00:16:37,600 --> 00:16:39,279 of data okay let me get that for you and 507 00:16:39,279 --> 00:16:40,480 then it'll feed it back up to the 508 00:16:40,480 --> 00:16:42,800 operating system 509 00:16:42,800 --> 00:16:44,480 and then finally the protocols on the 510 00:16:44,480 --> 00:16:46,000 top half of the screen are what we call 511 00:16:46,000 --> 00:16:47,519 the host layer protocols these are 512 00:16:47,519 --> 00:16:49,440 controlled by your operating system 513 00:16:49,440 --> 00:16:51,279 right so the host in this kind of 514 00:16:51,279 --> 00:16:53,279 equation is is your computer your 515 00:16:53,279 --> 00:16:54,639 operating system and the controller is 516 00:16:54,639 --> 00:16:56,880 the chip running the the firmware 517 00:16:56,880 --> 00:17:00,399 implemented by the vendor right 518 00:17:02,240 --> 00:17:03,680 depending on the system you're using 519 00:17:03,680 --> 00:17:04,640 they'll be implemented a little bit 520 00:17:04,640 --> 00:17:06,959 differently so for example there is the 521 00:17:06,959 --> 00:17:09,119 blue z stack right blue z is the 522 00:17:09,119 --> 00:17:11,119 official bluetooth stack for linux uh 523 00:17:11,119 --> 00:17:13,520 but it's not the only one that that 524 00:17:13,520 --> 00:17:14,720 being said 525 00:17:14,720 --> 00:17:17,280 uh it's used so 526 00:17:17,280 --> 00:17:18,959 widely that 527 00:17:18,959 --> 00:17:21,760 you'd have to have a really specific you 528 00:17:21,760 --> 00:17:24,559 know use case to bother with um coming 529 00:17:24,559 --> 00:17:26,160 up with your own bluetooth stack for 530 00:17:26,160 --> 00:17:28,160 linux environment and it's not seen very 531 00:17:28,160 --> 00:17:29,679 commonly so 532 00:17:29,679 --> 00:17:32,559 it's not a an exaggeration to say blue z 533 00:17:32,559 --> 00:17:36,240 is on like you know 98 plus of linux 534 00:17:36,240 --> 00:17:37,679 systems that run bluetooth in the first 535 00:17:37,679 --> 00:17:39,039 place so 536 00:17:39,039 --> 00:17:40,559 yeah bluesy is great and then i'll talk 537 00:17:40,559 --> 00:17:42,799 a little bit more about that in a bit 538 00:17:42,799 --> 00:17:45,679 but in the host protocol pool 539 00:17:45,679 --> 00:17:48,480 we find the logical link control and 540 00:17:48,480 --> 00:17:50,400 adaptation protocol i'm not going to say 541 00:17:50,400 --> 00:17:52,240 this acronym again because l2 cap is 542 00:17:52,240 --> 00:17:53,840 just much easier to say 543 00:17:53,840 --> 00:17:56,559 this is the base protocol in the host 544 00:17:56,559 --> 00:17:58,400 protocol pool side and everything else 545 00:17:58,400 --> 00:18:00,480 is more or less built on top of it 546 00:18:00,480 --> 00:18:02,160 this is because you know alt2 cap is 547 00:18:02,160 --> 00:18:04,480 developed to be a generic multiplexing 548 00:18:04,480 --> 00:18:06,559 layer of the host protocol stack it 549 00:18:06,559 --> 00:18:08,160 receives information from the higher up 550 00:18:08,160 --> 00:18:09,280 protocols 551 00:18:09,280 --> 00:18:10,960 and then 552 00:18:10,960 --> 00:18:13,200 passes them on through to the hci the 553 00:18:13,200 --> 00:18:15,039 host controller interface which then 554 00:18:15,039 --> 00:18:17,440 processes the information to be sent 555 00:18:17,440 --> 00:18:19,760 to the controller side of things right 556 00:18:19,760 --> 00:18:21,280 so a look at some of the different 557 00:18:21,280 --> 00:18:23,360 protocols we have here very briefly 558 00:18:23,360 --> 00:18:25,760 we have on the right we have the sdp 559 00:18:25,760 --> 00:18:28,720 right the service discovery protocol 560 00:18:28,720 --> 00:18:30,880 sdp is used to allow bluetooth devices 561 00:18:30,880 --> 00:18:32,720 to learn more about one another someone 562 00:18:32,720 --> 00:18:34,640 two devices connect they kind of ask 563 00:18:34,640 --> 00:18:36,080 each other all right so what can you do 564 00:18:36,080 --> 00:18:37,520 you know oh you're you're a phone book 565 00:18:37,520 --> 00:18:39,039 server well i'm a phone book client i 566 00:18:39,039 --> 00:18:41,200 might ask you for some contacts right oh 567 00:18:41,200 --> 00:18:43,120 you can play audio well let me see if i 568 00:18:43,120 --> 00:18:44,480 can you know stream some audio through 569 00:18:44,480 --> 00:18:46,640 you this communication and establishment 570 00:18:46,640 --> 00:18:48,799 of what devices are capable of is done 571 00:18:48,799 --> 00:18:50,559 through sdp 572 00:18:50,559 --> 00:18:53,280 right so it's a very important part of 573 00:18:53,280 --> 00:18:55,200 bluetooth communication because it'll 574 00:18:55,200 --> 00:18:56,400 also give you 575 00:18:56,400 --> 00:18:58,880 uh information about oh this service i'm 576 00:18:58,880 --> 00:19:00,720 interested in this which rfcom channel 577 00:19:00,720 --> 00:19:02,320 is it using and we'll talk about our com 578 00:19:02,320 --> 00:19:03,360 channels in a bit because that's kind of 579 00:19:03,360 --> 00:19:05,840 what this talk is about but again this 580 00:19:05,840 --> 00:19:07,760 all ties back to 581 00:19:07,760 --> 00:19:11,200 sdp interestingly enough stp is always 582 00:19:11,200 --> 00:19:13,200 unencrypted it's just supposed to be 583 00:19:13,200 --> 00:19:15,120 freely available and you can usually 584 00:19:15,120 --> 00:19:17,280 query any bluetooth device for sdp 585 00:19:17,280 --> 00:19:18,960 information so no matter like what the 586 00:19:18,960 --> 00:19:20,160 security settings on your bluetooth 587 00:19:20,160 --> 00:19:23,039 device are sdp will usually be 588 00:19:23,039 --> 00:19:25,200 you know just unencrypted communication 589 00:19:25,200 --> 00:19:27,039 because it's not supposed to be secret 590 00:19:27,039 --> 00:19:28,240 you're supposed to share it with anyone 591 00:19:28,240 --> 00:19:31,600 that asks right interestingly enough um 592 00:19:31,600 --> 00:19:33,760 but and then rfcom as you can see here 593 00:19:33,760 --> 00:19:36,720 on the left of this of the screen has a 594 00:19:36,720 --> 00:19:38,240 lot of different applications or 595 00:19:38,240 --> 00:19:39,760 protocols built on top of it you have 596 00:19:39,760 --> 00:19:41,600 things like point-to-point which you 597 00:19:41,600 --> 00:19:43,919 know can can go into things like ip and 598 00:19:43,919 --> 00:19:46,000 tcp so you get like your basic you know 599 00:19:46,000 --> 00:19:47,520 traditional networking architecture 600 00:19:47,520 --> 00:19:49,280 built through bluetooth and then you 601 00:19:49,280 --> 00:19:51,200 know on top of rfcom 602 00:19:51,200 --> 00:19:53,120 you have serial port profile this is the 603 00:19:53,120 --> 00:19:55,919 the spp one right here you've got pbab 604 00:19:55,919 --> 00:19:57,919 this is the phone book access profile 605 00:19:57,919 --> 00:20:00,640 you have object exchange or obex vcard 606 00:20:00,640 --> 00:20:02,159 ftp we'll talk a little bit more about 607 00:20:02,159 --> 00:20:04,480 these um 608 00:20:04,480 --> 00:20:06,480 a little bit more detail but there's a 609 00:20:06,480 --> 00:20:08,320 lot of stuff that can be built on rfcom 610 00:20:08,320 --> 00:20:09,840 because rfcom is built to be very 611 00:20:09,840 --> 00:20:11,280 flexible 612 00:20:11,280 --> 00:20:13,360 so let's give it a quick look rfcom is 613 00:20:13,360 --> 00:20:16,880 designed to emulate an rs-232 serial 614 00:20:16,880 --> 00:20:19,840 port over the l2 cap protocol as 615 00:20:19,840 --> 00:20:21,840 literally as possible it actually 616 00:20:21,840 --> 00:20:24,000 includes features to emulate all nine 617 00:20:24,000 --> 00:20:26,720 pins of an rs-232 serial port which is 618 00:20:26,720 --> 00:20:28,159 really interesting 619 00:20:28,159 --> 00:20:29,600 and 620 00:20:29,600 --> 00:20:30,960 this is true to the extent that the 621 00:20:30,960 --> 00:20:32,640 rfcom protocol 622 00:20:32,640 --> 00:20:34,400 actually specifies this 623 00:20:34,400 --> 00:20:36,799 outright so if you open up the rfcom 624 00:20:36,799 --> 00:20:38,000 protocol you'll see in like the 625 00:20:38,000 --> 00:20:39,600 introduction section 626 00:20:39,600 --> 00:20:41,679 it'll actually say 627 00:20:41,679 --> 00:20:43,200 this document does not contain a 628 00:20:43,200 --> 00:20:44,799 complete specification instead 629 00:20:44,799 --> 00:20:46,480 references are made to the relevant 630 00:20:46,480 --> 00:20:50,320 parts of the gsm 07.10 standard so they 631 00:20:50,320 --> 00:20:52,000 really just telling you like we just 632 00:20:52,000 --> 00:20:53,520 wanted to make you know 633 00:20:53,520 --> 00:20:57,280 gsm 7.10 uh serial ports available 634 00:20:57,280 --> 00:20:59,360 over over wireless communications so 635 00:20:59,360 --> 00:21:01,200 rfcom is literally you know a radio 636 00:21:01,200 --> 00:21:03,280 frequency com port is kind of what they 637 00:21:03,280 --> 00:21:05,440 designed it uh to be 638 00:21:05,440 --> 00:21:06,559 so 639 00:21:06,559 --> 00:21:09,200 um it was designed to allow devices that 640 00:21:09,200 --> 00:21:12,159 already had rs-232 capability to be 641 00:21:12,159 --> 00:21:14,080 easily ported to wireless applications 642 00:21:14,080 --> 00:21:16,080 by simplifying the process of adding a 643 00:21:16,080 --> 00:21:17,600 wireless network interface you didn't 644 00:21:17,600 --> 00:21:19,919 have to change all that much you could 645 00:21:19,919 --> 00:21:21,440 just you know 646 00:21:21,440 --> 00:21:23,760 readjust which interface it's talking to 647 00:21:23,760 --> 00:21:25,520 and the rfcom 648 00:21:25,520 --> 00:21:27,200 channel would take all the information 649 00:21:27,200 --> 00:21:28,640 that would be sent to a regular serial 650 00:21:28,640 --> 00:21:30,640 port and move that 651 00:21:30,640 --> 00:21:32,799 over the you know the unguided medium 652 00:21:32,799 --> 00:21:34,720 that is the wireless communication and 653 00:21:34,720 --> 00:21:38,320 that 2.4 gigahertz uh frequency band 654 00:21:38,320 --> 00:21:39,360 right 655 00:21:39,360 --> 00:21:41,760 so in a practical sense though right the 656 00:21:41,760 --> 00:21:43,760 practicality of rfcom right don't worry 657 00:21:43,760 --> 00:21:45,200 too much about the specification yet 658 00:21:45,200 --> 00:21:46,640 that's if you want to read it it'll be 659 00:21:46,640 --> 00:21:48,240 linked in the end right but 660 00:21:48,240 --> 00:21:50,880 um rfcom channels work pretty similarly 661 00:21:50,880 --> 00:21:53,360 to tcp ports so 662 00:21:53,360 --> 00:21:55,520 like tcp rfcom provides some basic 663 00:21:55,520 --> 00:21:58,640 guarantees for reliability uh and it's a 664 00:21:58,640 --> 00:22:00,400 point-to-point connection you know 665 00:22:00,400 --> 00:22:02,240 communication uh 666 00:22:02,240 --> 00:22:04,320 style right the contrast to this would 667 00:22:04,320 --> 00:22:07,200 be something like l2 cap and udp uh 668 00:22:07,200 --> 00:22:08,960 where udp is usually you know considered 669 00:22:08,960 --> 00:22:11,360 connectionless uh but you know l2 cap 670 00:22:11,360 --> 00:22:12,799 can be connection based or 671 00:22:12,799 --> 00:22:14,880 connectionless it actually supports both 672 00:22:14,880 --> 00:22:18,480 both types um rfcom has way fewer ports 673 00:22:18,480 --> 00:22:20,000 available 674 00:22:20,000 --> 00:22:21,360 you know they work like ports but we 675 00:22:21,360 --> 00:22:23,280 call them channels i'm not the one who 676 00:22:23,280 --> 00:22:24,559 came up with this right it's just the 677 00:22:24,559 --> 00:22:26,720 way it is excuse me 678 00:22:26,720 --> 00:22:29,760 but uh whereas tcp has you know like 65 679 00:22:29,760 --> 00:22:32,400 000 different ports rfcom only supports 680 00:22:32,400 --> 00:22:34,799 30 channels the specification states 681 00:22:34,799 --> 00:22:37,280 that up to 60 simultaneous connections 682 00:22:37,280 --> 00:22:39,280 between two devices are possible but 683 00:22:39,280 --> 00:22:41,360 with only 30 ports to work with you need 684 00:22:41,360 --> 00:22:43,440 to kind of be careful when you allocate 685 00:22:43,440 --> 00:22:45,039 rfcom channels to your applications so 686 00:22:45,039 --> 00:22:46,240 when you're writing an application you 687 00:22:46,240 --> 00:22:48,799 might say all right specify to use 688 00:22:48,799 --> 00:22:51,440 this rfcom channel or 689 00:22:51,440 --> 00:22:53,120 random first available rfcom channel 690 00:22:53,120 --> 00:22:55,280 these are both options you can use 691 00:22:55,280 --> 00:22:57,440 and just you know may want to keep in 692 00:22:57,440 --> 00:22:59,360 mind how many you have left when you're 693 00:22:59,360 --> 00:23:02,480 writing bluetooth applications um i've 694 00:23:02,480 --> 00:23:04,559 linked both here and later in my 695 00:23:04,559 --> 00:23:05,760 references of course you can see the 696 00:23:05,760 --> 00:23:08,320 link here uh an old it's it's pretty 697 00:23:08,320 --> 00:23:10,480 dated it's like i think from like 2000 698 00:23:10,480 --> 00:23:13,440 like the early 2000s like before 2010 699 00:23:13,440 --> 00:23:15,440 it's a guide it's a very helpful guide 700 00:23:15,440 --> 00:23:17,679 to programming with bluesy uh you may 701 00:23:17,679 --> 00:23:19,360 remember i mentioned blue z is the linux 702 00:23:19,360 --> 00:23:22,080 stack uh for for the bluetooth stack for 703 00:23:22,080 --> 00:23:23,679 linux excuse me 704 00:23:23,679 --> 00:23:25,280 um but 705 00:23:25,280 --> 00:23:26,960 it is a little bit dated but it's a 706 00:23:26,960 --> 00:23:28,400 great introduction to programming with 707 00:23:28,400 --> 00:23:30,000 bluetooth and i would suggest anyone 708 00:23:30,000 --> 00:23:31,440 looking to make their own bluetooth 709 00:23:31,440 --> 00:23:33,280 applications either for testing purposes 710 00:23:33,280 --> 00:23:34,640 or just to learn more about how the 711 00:23:34,640 --> 00:23:37,120 protocols work so you can give it a look 712 00:23:37,120 --> 00:23:38,799 right but just take it with a grain of 713 00:23:38,799 --> 00:23:40,159 salt it is quite old so you might have 714 00:23:40,159 --> 00:23:41,840 to change things to fit you know more 715 00:23:41,840 --> 00:23:43,600 modern you know python packages or 716 00:23:43,600 --> 00:23:46,159 versions uh that are available right 717 00:23:46,159 --> 00:23:48,000 but then one final you know useful 718 00:23:48,000 --> 00:23:50,559 parallel between rfcom and tcp 719 00:23:50,559 --> 00:23:52,799 is that much how you might use nmap or 720 00:23:52,799 --> 00:23:54,080 something to 721 00:23:54,080 --> 00:23:56,080 do a port scan right kind of see what 722 00:23:56,080 --> 00:23:57,760 services are running on a device over 723 00:23:57,760 --> 00:23:59,679 the ip network 724 00:23:59,679 --> 00:24:02,000 excuse me you can use the sdp right 725 00:24:02,000 --> 00:24:04,480 service discovery protocol to 726 00:24:04,480 --> 00:24:05,919 do more or less the same thing over 727 00:24:05,919 --> 00:24:07,840 bluetooth and this is an rfcom specific 728 00:24:07,840 --> 00:24:09,360 uh this is more of a bluetooth thing 729 00:24:09,360 --> 00:24:12,159 overall but let's take a look here 730 00:24:12,159 --> 00:24:13,600 so so since the service discovery 731 00:24:13,600 --> 00:24:14,880 protocol is designed to let the 732 00:24:14,880 --> 00:24:16,559 bluetooth devices understand the 733 00:24:16,559 --> 00:24:19,760 capabilities of the other remote devices 734 00:24:19,760 --> 00:24:21,600 it makes sense that there would be you 735 00:24:21,600 --> 00:24:24,559 know a way to see right ask a device hey 736 00:24:24,559 --> 00:24:25,840 what do you do 737 00:24:25,840 --> 00:24:27,360 how can we communicate let's find 738 00:24:27,360 --> 00:24:29,520 something we can do together 739 00:24:29,520 --> 00:24:32,000 sdp tool for example is a basic linux 740 00:24:32,000 --> 00:24:32,799 tool 741 00:24:32,799 --> 00:24:34,720 that allows you to browse the sdp 742 00:24:34,720 --> 00:24:36,400 servers of remote bluetooth devices it 743 00:24:36,400 --> 00:24:38,240 can do a lot more but browsing is kind 744 00:24:38,240 --> 00:24:39,679 of the easiest way to use it for 745 00:24:39,679 --> 00:24:42,000 starting off it lets you add services to 746 00:24:42,000 --> 00:24:44,480 your own devices as well for example or 747 00:24:44,480 --> 00:24:45,360 you can 748 00:24:45,360 --> 00:24:47,760 you know search for a specific 749 00:24:47,760 --> 00:24:50,159 bluetooth service on a target device if 750 00:24:50,159 --> 00:24:52,400 you have something in mind right 751 00:24:52,400 --> 00:24:54,080 shown here on the right is part of the 752 00:24:54,080 --> 00:24:56,720 output from sdp tool when browsing on my 753 00:24:56,720 --> 00:24:58,400 samsung galaxy phone i use my own 754 00:24:58,400 --> 00:24:59,679 personal device for this i didn't want 755 00:24:59,679 --> 00:25:02,000 to get in trouble by posting some some 756 00:25:02,000 --> 00:25:04,400 customers stp tool outputs right that 757 00:25:04,400 --> 00:25:06,480 would that would that would be bad 758 00:25:06,480 --> 00:25:08,080 um but you can see here that there are a 759 00:25:08,080 --> 00:25:09,440 couple of applications running on my 760 00:25:09,440 --> 00:25:11,679 phone that are tied to rfcom channels 761 00:25:11,679 --> 00:25:12,960 with information on the type of 762 00:25:12,960 --> 00:25:15,520 application and which rfcom channel is 763 00:25:15,520 --> 00:25:16,720 in use 764 00:25:16,720 --> 00:25:19,200 so for example on phones obviously phone 765 00:25:19,200 --> 00:25:20,559 book access is something you would 766 00:25:20,559 --> 00:25:22,480 expect to see because my phone is used 767 00:25:22,480 --> 00:25:25,520 to sharing my contact book if i if i if 768 00:25:25,520 --> 00:25:27,520 i wanted to i usually don't but 769 00:25:27,520 --> 00:25:29,200 when you connect to a car you can import 770 00:25:29,200 --> 00:25:31,360 your contacts to the vehicle right so 771 00:25:31,360 --> 00:25:32,720 that you have access to your whole phone 772 00:25:32,720 --> 00:25:35,760 book you can use caller ids and so forth 773 00:25:35,760 --> 00:25:37,840 obex right i talked about object 774 00:25:37,840 --> 00:25:40,000 exchange earlier 775 00:25:40,000 --> 00:25:42,320 obex is a communication protocol used 776 00:25:42,320 --> 00:25:44,400 for sharing files between devices and a 777 00:25:44,400 --> 00:25:46,240 lot of like the things like the ftp and 778 00:25:46,240 --> 00:25:48,080 the phone book access sometimes are 779 00:25:48,080 --> 00:25:50,559 built on top of obex right 780 00:25:50,559 --> 00:25:52,320 interestingly obex was originally 781 00:25:52,320 --> 00:25:55,039 developed for infrared communications 782 00:25:55,039 --> 00:25:56,960 right and it's actually managed 783 00:25:56,960 --> 00:25:59,520 by the infrared data association but 784 00:25:59,520 --> 00:26:01,520 it's just kind of been adopted by the 785 00:26:01,520 --> 00:26:03,679 bluetooth sig and it's just you know 786 00:26:03,679 --> 00:26:05,360 very common to find 787 00:26:05,360 --> 00:26:07,600 obex in in bluetooth devices to the 788 00:26:07,600 --> 00:26:09,600 point where you would a lot of people 789 00:26:09,600 --> 00:26:11,520 assume opex is initially made for 790 00:26:11,520 --> 00:26:13,279 bluetooth when it's actually in you know 791 00:26:13,279 --> 00:26:14,960 it was originally made for uh the 792 00:26:14,960 --> 00:26:16,559 infrared stuff 793 00:26:16,559 --> 00:26:18,960 and then like i said things like ftp and 794 00:26:18,960 --> 00:26:20,480 phonebook access 795 00:26:20,480 --> 00:26:22,480 can be built on top of obex but they 796 00:26:22,480 --> 00:26:24,559 don't necessarily have to be right this 797 00:26:24,559 --> 00:26:26,880 goes back to the idea that a bunch of 798 00:26:26,880 --> 00:26:28,799 pieces to bluetooth and you can kind of 799 00:26:28,799 --> 00:26:31,200 with some degree of flexibility you know 800 00:26:31,200 --> 00:26:34,159 assemble them however you like right 801 00:26:34,159 --> 00:26:37,120 so uh just kind of like visualize this 802 00:26:37,120 --> 00:26:38,720 you know with a very simple example 803 00:26:38,720 --> 00:26:40,559 let's just say you have you know an ip 804 00:26:40,559 --> 00:26:42,320 network two devices connected to the 805 00:26:42,320 --> 00:26:44,320 same ip network you can see we've got ip 806 00:26:44,320 --> 00:26:46,640 addresses associated on the left we have 807 00:26:46,640 --> 00:26:49,360 a host user you know a computer 808 00:26:49,360 --> 00:26:50,640 right side we've got a server or 809 00:26:50,640 --> 00:26:52,880 something maybe they're running a some 810 00:26:52,880 --> 00:26:56,080 ftp service on port 21. well when you 811 00:26:56,080 --> 00:26:57,600 want to use this service you would 812 00:26:57,600 --> 00:27:00,080 address the server you want to talk to 813 00:27:00,080 --> 00:27:02,000 by its ip address and you'd specify the 814 00:27:02,000 --> 00:27:03,840 port on that server that you want to 815 00:27:03,840 --> 00:27:05,360 communicate with right in this case you 816 00:27:05,360 --> 00:27:06,559 know we know the standard socket 817 00:27:06,559 --> 00:27:08,240 notation is shown up here we've got the 818 00:27:08,240 --> 00:27:11,760 ip address colon port number right 819 00:27:11,760 --> 00:27:13,440 pretty simple 820 00:27:13,440 --> 00:27:15,360 similarly when using bluetooth you would 821 00:27:15,360 --> 00:27:17,440 address the device you wish to use 822 00:27:17,440 --> 00:27:20,320 uh you wish to talk to with the rfcom 823 00:27:20,320 --> 00:27:22,000 channel that it's using uh for that 824 00:27:22,000 --> 00:27:24,399 particular service i've got two dummy ip 825 00:27:24,399 --> 00:27:26,000 or bluetooth addresses here please don't 826 00:27:26,000 --> 00:27:27,039 look these up they're not going to give 827 00:27:27,039 --> 00:27:28,960 you any interesting results of course 828 00:27:28,960 --> 00:27:30,399 it's one two three four five six seven 829 00:27:30,399 --> 00:27:32,240 eight a b c d f g 830 00:27:32,240 --> 00:27:34,000 right um but one thing i would like to 831 00:27:34,000 --> 00:27:36,240 know is the convention i'm using here by 832 00:27:36,240 --> 00:27:37,840 the way uh you can see here you have the 833 00:27:37,840 --> 00:27:40,720 bluetooth address and then you have the 834 00:27:40,720 --> 00:27:42,559 rfcom channel this is by no means like a 835 00:27:42,559 --> 00:27:44,399 standard convention for 836 00:27:44,399 --> 00:27:47,520 kind of displaying a bluetooth socket 837 00:27:47,520 --> 00:27:48,960 per se i just 838 00:27:48,960 --> 00:27:51,279 wrote it like this so so if 839 00:27:51,279 --> 00:27:52,559 this is not this is not there's no 840 00:27:52,559 --> 00:27:54,159 standard here for 841 00:27:54,159 --> 00:27:55,440 like like you would have in the ip 842 00:27:55,440 --> 00:27:58,080 network for like a common way to 843 00:27:58,080 --> 00:28:00,720 designate a socket we don't have that 844 00:28:00,720 --> 00:28:02,559 i i just kind of came up with it but it 845 00:28:02,559 --> 00:28:04,640 more or less works almost the same way 846 00:28:04,640 --> 00:28:06,399 and so you could have a similar service 847 00:28:06,399 --> 00:28:08,240 running over bluetooth and likewise 848 00:28:08,240 --> 00:28:10,000 you'd communicate targeting that 849 00:28:10,000 --> 00:28:12,159 bluetooth address and the rfcom channel 850 00:28:12,159 --> 00:28:15,200 that is hosting that the uh the target 851 00:28:15,200 --> 00:28:18,000 host is tied to 852 00:28:18,000 --> 00:28:20,080 that application right 853 00:28:20,080 --> 00:28:22,159 and lastly you know before we move on i 854 00:28:22,159 --> 00:28:24,640 just wanted to share that uh the rfcom 855 00:28:24,640 --> 00:28:26,080 specification 856 00:28:26,080 --> 00:28:28,320 has not been updated since november of 857 00:28:28,320 --> 00:28:30,640 2012. and maybe that's a testament to 858 00:28:30,640 --> 00:28:33,679 how well um put together it is that it 859 00:28:33,679 --> 00:28:35,760 has received you know no updates in the 860 00:28:35,760 --> 00:28:37,279 last 10 years 861 00:28:37,279 --> 00:28:38,159 um 862 00:28:38,159 --> 00:28:40,640 but i always find it interesting to see 863 00:28:40,640 --> 00:28:42,480 something that's still so widely used 864 00:28:42,480 --> 00:28:43,760 everywhere you know in different 865 00:28:43,760 --> 00:28:45,360 industries not just cars like i said 866 00:28:45,360 --> 00:28:46,320 medical 867 00:28:46,320 --> 00:28:48,799 you know other iot industries hasn't 868 00:28:48,799 --> 00:28:51,120 changed at all in the last 10 years and 869 00:28:51,120 --> 00:28:53,039 granted it is an underlying transport 870 00:28:53,039 --> 00:28:55,679 layer protocol so it doesn't 871 00:28:55,679 --> 00:28:57,120 maybe doesn't get that much attention 872 00:28:57,120 --> 00:28:58,960 but it's always worth you know poking 873 00:28:58,960 --> 00:29:00,480 through the specifications seeing if you 874 00:29:00,480 --> 00:29:02,000 can find anything you might be able to 875 00:29:02,000 --> 00:29:03,600 use or reviews 876 00:29:03,600 --> 00:29:05,440 but anyway on to the next part of the 877 00:29:05,440 --> 00:29:08,559 talk i'm going to introduce rf comrade 878 00:29:08,559 --> 00:29:11,679 so what exactly is rf comrade so 879 00:29:11,679 --> 00:29:13,919 rf comrade is a tool to assist in the 880 00:29:13,919 --> 00:29:16,240 testing of rfcom protocol on remote 881 00:29:16,240 --> 00:29:18,960 bluetooth devices i built it in python 882 00:29:18,960 --> 00:29:21,440 and it uses the pi blue z library which 883 00:29:21,440 --> 00:29:23,360 makes it very easy to get set up on any 884 00:29:23,360 --> 00:29:25,360 linux system pi blue z is a python 885 00:29:25,360 --> 00:29:26,880 implementation 886 00:29:26,880 --> 00:29:28,720 of the bluesy 887 00:29:28,720 --> 00:29:31,039 software stack for linux 888 00:29:31,039 --> 00:29:33,120 its main feature is the ability to 889 00:29:33,120 --> 00:29:35,440 connect to an rfcom channel on a remote 890 00:29:35,440 --> 00:29:38,000 device and basically flood it with a 891 00:29:38,000 --> 00:29:39,520 user defined payload you set up a 892 00:29:39,520 --> 00:29:41,279 payload you say hey 893 00:29:41,279 --> 00:29:43,679 i want to target that rfcom channel on 894 00:29:43,679 --> 00:29:45,520 that bluetooth device i just want to 895 00:29:45,520 --> 00:29:46,960 hammer it with as much data as possible 896 00:29:46,960 --> 00:29:49,600 it's very very simple it's not it's it's 897 00:29:49,600 --> 00:29:51,520 nothing like uh like a guided fuzzer or 898 00:29:51,520 --> 00:29:54,240 anything i'm hoping to to improve it in 899 00:29:54,240 --> 00:29:56,559 the future but what i started with was 900 00:29:56,559 --> 00:29:58,799 just a basic flooding attack 901 00:29:58,799 --> 00:30:00,240 excuse me 902 00:30:00,240 --> 00:30:02,480 um but you know it can essentially work 903 00:30:02,480 --> 00:30:05,039 as a dos attack or a denial of service 904 00:30:05,039 --> 00:30:07,120 on devices that don't have fail safes in 905 00:30:07,120 --> 00:30:10,159 place to deal with volumes of large data 906 00:30:10,159 --> 00:30:12,000 large volumes of data 907 00:30:12,000 --> 00:30:13,120 than they're then they're prepared to 908 00:30:13,120 --> 00:30:15,520 expect right if the rfcom channels in 909 00:30:15,520 --> 00:30:17,520 use on the target are not known there's 910 00:30:17,520 --> 00:30:19,520 also a basic service discovery feature i 911 00:30:19,520 --> 00:30:21,440 added to the tool that will actually you 912 00:30:21,440 --> 00:30:22,720 can say okay i know the bluetooth 913 00:30:22,720 --> 00:30:24,880 address but i didn't run stp tool i 914 00:30:24,880 --> 00:30:26,799 didn't feel like browsing it 915 00:30:26,799 --> 00:30:28,159 if you just run it with a bluetooth 916 00:30:28,159 --> 00:30:30,399 address and no rfcom ports specified 917 00:30:30,399 --> 00:30:32,320 it'll actually return to you which rf 918 00:30:32,320 --> 00:30:34,720 com ports are you know up on the machine 919 00:30:34,720 --> 00:30:36,799 that you're targeting and some 920 00:30:36,799 --> 00:30:39,039 information on what applications are 921 00:30:39,039 --> 00:30:41,360 tied to them 922 00:30:41,360 --> 00:30:44,320 so the why would i make this dual so the 923 00:30:44,320 --> 00:30:46,000 motivation for putting this tool 924 00:30:46,000 --> 00:30:48,640 together is as often as it is is because 925 00:30:48,640 --> 00:30:50,240 i couldn't find another way to do the 926 00:30:50,240 --> 00:30:52,080 same thing with someone else's tool i'm 927 00:30:52,080 --> 00:30:54,240 not a very good programmer i i'm not a 928 00:30:54,240 --> 00:30:56,159 developer i don't particularly like the 929 00:30:56,159 --> 00:30:58,720 program so i try to avoid it when i can 930 00:30:58,720 --> 00:31:00,640 but sometimes you know 931 00:31:00,640 --> 00:31:03,200 you you force your hand right so during 932 00:31:03,200 --> 00:31:05,039 a penetration test of an automotive 933 00:31:05,039 --> 00:31:07,440 navigation unit we wanted to test the 934 00:31:07,440 --> 00:31:09,200 device's bluetooth implementation and 935 00:31:09,200 --> 00:31:11,120 its resilience against receiving large 936 00:31:11,120 --> 00:31:13,360 amounts of unexpected data this isn't 937 00:31:13,360 --> 00:31:15,039 the only test we performed retarding the 938 00:31:15,039 --> 00:31:16,159 bluetooth 939 00:31:16,159 --> 00:31:18,159 technology on the device but we wanted 940 00:31:18,159 --> 00:31:19,360 to test it from a bunch of different 941 00:31:19,360 --> 00:31:21,039 perspectives so it made sense to do just 942 00:31:21,039 --> 00:31:23,440 some you know brute forcing of the data 943 00:31:23,440 --> 00:31:24,480 flooding 944 00:31:24,480 --> 00:31:26,080 and after doing some research we found 945 00:31:26,080 --> 00:31:27,760 that this kind of remote flooding test 946 00:31:27,760 --> 00:31:29,840 has been done in the past but the only 947 00:31:29,840 --> 00:31:32,240 publicly available tools i could find 948 00:31:32,240 --> 00:31:33,279 weren't 949 00:31:33,279 --> 00:31:35,519 exactly what i was hoping to find some 950 00:31:35,519 --> 00:31:38,000 older tools like l2 ping for example 951 00:31:38,000 --> 00:31:39,519 which is usually installed with blue z 952 00:31:39,519 --> 00:31:40,640 by default 953 00:31:40,640 --> 00:31:42,799 only works with the l2 cap layer and it 954 00:31:42,799 --> 00:31:44,880 doesn't provide a lot of flexibility 955 00:31:44,880 --> 00:31:47,120 on the content of the data that you send 956 00:31:47,120 --> 00:31:48,720 it's just it'll send pings and you can 957 00:31:48,720 --> 00:31:50,960 you know enable it to flood the opponent 958 00:31:50,960 --> 00:31:52,159 opponent 959 00:31:52,159 --> 00:31:54,960 excuse me remote target device uh with 960 00:31:54,960 --> 00:31:56,000 data 961 00:31:56,000 --> 00:31:57,440 but you can't exactly control the 962 00:31:57,440 --> 00:31:59,279 contents of the payload you really can't 963 00:31:59,279 --> 00:32:00,399 do much 964 00:32:00,399 --> 00:32:02,320 about that and because it is only you 965 00:32:02,320 --> 00:32:04,480 know targeted at the l2 cap protocol i 966 00:32:04,480 --> 00:32:06,399 felt there might be some benefit in in 967 00:32:06,399 --> 00:32:08,720 targeting other protocols on the device 968 00:32:08,720 --> 00:32:10,720 and then there are other tools such as a 969 00:32:10,720 --> 00:32:13,360 tool called a bluetooth stack smasher 970 00:32:13,360 --> 00:32:14,720 that allows you to fuzz a remote 971 00:32:14,720 --> 00:32:17,279 bluetooth device with random data 972 00:32:17,279 --> 00:32:19,200 but again this one also only targets the 973 00:32:19,200 --> 00:32:21,600 l2 cap protocol and it doesn't have the 974 00:32:21,600 --> 00:32:23,039 features you would like in a modern 975 00:32:23,039 --> 00:32:24,720 protocol fuzzer so 976 00:32:24,720 --> 00:32:27,200 it wasn't quite what i was hoping to 977 00:32:27,200 --> 00:32:28,559 find 978 00:32:28,559 --> 00:32:30,080 you're welcome to give it a shot if you 979 00:32:30,080 --> 00:32:31,760 like though it's freely available on the 980 00:32:31,760 --> 00:32:34,000 internet um there isn't much control 981 00:32:34,000 --> 00:32:36,080 over what data gets sent and when and 982 00:32:36,080 --> 00:32:38,399 sometimes recreating crashes or other 983 00:32:38,399 --> 00:32:41,200 issues can be difficult i found 984 00:32:41,200 --> 00:32:43,200 so we wanted a tool that could interact 985 00:32:43,200 --> 00:32:45,039 more directly with the rfcom channels 986 00:32:45,039 --> 00:32:46,640 themselves and the applications 987 00:32:46,640 --> 00:32:49,760 operating behind them so uh i used the 988 00:32:49,760 --> 00:32:51,919 pi blue z library to cook up a simple 989 00:32:51,919 --> 00:32:53,279 script that would let us connect for 990 00:32:53,279 --> 00:32:55,600 remote targets rfcom channels and just 991 00:32:55,600 --> 00:32:57,279 toss a bunch of data at it right just 992 00:32:57,279 --> 00:32:58,720 like i explained 993 00:32:58,720 --> 00:33:00,720 the idea was we could identify any 994 00:33:00,720 --> 00:33:02,480 applications that were tied to rfcom 995 00:33:02,480 --> 00:33:04,559 channels that weren't set up to handle 996 00:33:04,559 --> 00:33:06,799 large volumes of random data and might 997 00:33:06,799 --> 00:33:08,320 you know be able to invoke a crash of 998 00:33:08,320 --> 00:33:09,840 the bluetooth stack see how the target 999 00:33:09,840 --> 00:33:11,760 device responds excuse me i'm gonna take 1000 00:33:11,760 --> 00:33:12,559 a quick 1001 00:33:12,559 --> 00:33:15,120 water break 1002 00:33:18,880 --> 00:33:21,120 sorry about that all right let's go on 1003 00:33:21,120 --> 00:33:23,200 almost done 1004 00:33:23,200 --> 00:33:25,200 uh and so did it work all right that's 1005 00:33:25,200 --> 00:33:26,559 the next obvious question and to my 1006 00:33:26,559 --> 00:33:28,960 surprise yeah it kind of did 1007 00:33:28,960 --> 00:33:31,120 i was able to reliably crash the 1008 00:33:31,120 --> 00:33:33,120 bluetooth stack on a target device by 1009 00:33:33,120 --> 00:33:34,880 connecting to one of the services hosted 1010 00:33:34,880 --> 00:33:36,640 on the rfcom channel 1011 00:33:36,640 --> 00:33:38,159 and flooding it with a very simple 1012 00:33:38,159 --> 00:33:39,840 payload right just 1013 00:33:39,840 --> 00:33:41,039 i just i didn't want to do anything 1014 00:33:41,039 --> 00:33:42,960 complicated just wanted to test it out 1015 00:33:42,960 --> 00:33:44,799 uh for about five seconds 1016 00:33:44,799 --> 00:33:46,399 and i was able to confirm this because 1017 00:33:46,399 --> 00:33:48,159 the target device would actually display 1018 00:33:48,159 --> 00:33:50,000 an error message saying oh 1019 00:33:50,000 --> 00:33:51,360 bluetooth 1020 00:33:51,360 --> 00:33:52,399 stack 1021 00:33:52,399 --> 00:33:54,159 or started like the bluetooth function 1022 00:33:54,159 --> 00:33:56,559 had essentially just entirely crashed 1023 00:33:56,559 --> 00:33:57,919 and then 1024 00:33:57,919 --> 00:34:00,000 had to boot up again from zero 1025 00:34:00,000 --> 00:34:01,679 so any devices that were already 1026 00:34:01,679 --> 00:34:04,240 connected to the target over bluetooth 1027 00:34:04,240 --> 00:34:05,840 say my cell phone or another target you 1028 00:34:05,840 --> 00:34:07,600 know testing device i would be 1029 00:34:07,600 --> 00:34:09,280 disconnected and whatever bluetooth 1030 00:34:09,280 --> 00:34:10,560 operations they were carrying out at 1031 00:34:10,560 --> 00:34:12,639 that time would be interrupted 1032 00:34:12,639 --> 00:34:15,839 an analysis of the application connected 1033 00:34:15,839 --> 00:34:17,440 afterwards by 1034 00:34:17,440 --> 00:34:20,159 by us revealed that the function wasn't 1035 00:34:20,159 --> 00:34:22,320 properly handling the large volume 1036 00:34:22,320 --> 00:34:24,320 unexpected inputs and it actually 1037 00:34:24,320 --> 00:34:26,079 resulted in a buffer overflow that would 1038 00:34:26,079 --> 00:34:28,639 cause uh the the pro the application 1039 00:34:28,639 --> 00:34:31,440 running on that rfcom channel to crash 1040 00:34:31,440 --> 00:34:33,280 and it ended up you know causing the 1041 00:34:33,280 --> 00:34:36,720 bluetooth stack to have to restart 1042 00:34:36,879 --> 00:34:39,599 there's potential here for a a further 1043 00:34:39,599 --> 00:34:41,599 exploitation of the application right if 1044 00:34:41,599 --> 00:34:43,040 you have a crafted payload if you 1045 00:34:43,040 --> 00:34:44,399 actually reverse engineer the firmware 1046 00:34:44,399 --> 00:34:46,079 running on the device find out how you 1047 00:34:46,079 --> 00:34:48,639 can you know further compromise this 1048 00:34:48,639 --> 00:34:50,960 target there's a lot of potential for 1049 00:34:50,960 --> 00:34:54,239 for more uh wrong doing uh in the place 1050 00:34:54,239 --> 00:34:55,839 here so 1051 00:34:55,839 --> 00:34:57,599 we didn't really feel we need to go that 1052 00:34:57,599 --> 00:34:58,800 far but 1053 00:34:58,800 --> 00:35:00,320 maybe someday i will take another look 1054 00:35:00,320 --> 00:35:03,040 at it but i felt that since the dual sid 1055 00:35:03,040 --> 00:35:04,960 did something kind of useful others 1056 00:35:04,960 --> 00:35:06,720 might find some benefit from having 1057 00:35:06,720 --> 00:35:08,480 access to it and that's what motivated 1058 00:35:08,480 --> 00:35:11,280 me to apply this uh this little tool of 1059 00:35:11,280 --> 00:35:13,040 mine to the call for papers here at 1060 00:35:13,040 --> 00:35:14,320 defcon 1061 00:35:14,320 --> 00:35:16,240 and just keep in mind at the end of the 1062 00:35:16,240 --> 00:35:17,680 day it is just a very simple python 1063 00:35:17,680 --> 00:35:19,839 script like i said i'm not a very i'm 1064 00:35:19,839 --> 00:35:22,160 not a very good programmer so 1065 00:35:22,160 --> 00:35:23,599 forgive me if it looks really ugly like 1066 00:35:23,599 --> 00:35:24,800 why didn't you do this why didn't you do 1067 00:35:24,800 --> 00:35:26,880 that i did my best right 1068 00:35:26,880 --> 00:35:27,839 so 1069 00:35:27,839 --> 00:35:28,720 you know 1070 00:35:28,720 --> 00:35:31,440 even my own little efforts might be uh 1071 00:35:31,440 --> 00:35:33,839 helpful to somebody somewhere out there 1072 00:35:33,839 --> 00:35:34,800 because 1073 00:35:34,800 --> 00:35:36,160 and you know even outside of the 1074 00:35:36,160 --> 00:35:37,920 automotive industry 1075 00:35:37,920 --> 00:35:39,359 because bluetooth is by no means an 1076 00:35:39,359 --> 00:35:41,359 automotive specific technology there's a 1077 00:35:41,359 --> 00:35:43,280 lot of 1078 00:35:43,280 --> 00:35:44,800 excuse me 1079 00:35:44,800 --> 00:35:46,880 a lot of other devices out there that 1080 00:35:46,880 --> 00:35:50,079 maybe could use a good rattling right so 1081 00:35:50,079 --> 00:35:52,720 uh where it's publicly available you can 1082 00:35:52,720 --> 00:35:55,359 find it here at this github link go 1083 00:35:55,359 --> 00:35:57,200 ahead and download it give it a shot see 1084 00:35:57,200 --> 00:35:58,640 if you like it if you don't like it 1085 00:35:58,640 --> 00:36:01,040 criticisms comments etc 1086 00:36:01,040 --> 00:36:03,680 always welcome uh i i do hope on making 1087 00:36:03,680 --> 00:36:05,040 improvements to it in the future 1088 00:36:05,040 --> 00:36:07,440 actually so as with any project you know 1089 00:36:07,440 --> 00:36:08,880 i want to take it somewhere higher maybe 1090 00:36:08,880 --> 00:36:10,480 improve on it 1091 00:36:10,480 --> 00:36:12,400 uh so the first step to that is 1092 00:36:12,400 --> 00:36:14,880 hopefully to add meaningful 1093 00:36:14,880 --> 00:36:15,920 fuzzing 1094 00:36:15,920 --> 00:36:18,480 um how should i say 1095 00:36:18,480 --> 00:36:20,079 fuzzing capability and i want to 1096 00:36:20,079 --> 00:36:22,720 increase the scope to other protocols 1097 00:36:22,720 --> 00:36:24,000 too obviously we can't call other 1098 00:36:24,000 --> 00:36:26,960 protocol fuzzers or flutters rf comrade 1099 00:36:26,960 --> 00:36:29,200 because they're not rf comp anymore but 1100 00:36:29,200 --> 00:36:31,359 we'll figure something out right 1101 00:36:31,359 --> 00:36:33,359 uh so when it comes to the fuzzing i've 1102 00:36:33,359 --> 00:36:34,960 been looking at scape for a little while 1103 00:36:34,960 --> 00:36:37,359 to kind of get ideas for how to 1104 00:36:37,359 --> 00:36:40,240 fuzz the bluetooth properly but in my 1105 00:36:40,240 --> 00:36:41,680 experience there's not as much 1106 00:36:41,680 --> 00:36:43,680 documentation on using the bluetooth 1107 00:36:43,680 --> 00:36:45,839 functions in scapy as i would like i 1108 00:36:45,839 --> 00:36:47,440 just haven't had enough time to kind of 1109 00:36:47,440 --> 00:36:49,680 dig through them little by little so 1110 00:36:49,680 --> 00:36:51,200 that's kind of the first step is to see 1111 00:36:51,200 --> 00:36:53,119 if that's 1112 00:36:53,119 --> 00:36:54,960 a viable 1113 00:36:54,960 --> 00:36:57,599 next step the next step is to find more 1114 00:36:57,599 --> 00:36:59,359 next steps right that's kind of how how 1115 00:36:59,359 --> 00:37:00,480 this goes when you don't really know 1116 00:37:00,480 --> 00:37:02,800 what you're doing um but i'm happy to 1117 00:37:02,800 --> 00:37:04,800 hear any suggestions or criticisms of my 1118 00:37:04,800 --> 00:37:06,400 little project you know i'm all yours 1119 00:37:06,400 --> 00:37:08,480 i'm always happy to listen so if you 1120 00:37:08,480 --> 00:37:10,160 have any feedback by all means please 1121 00:37:10,160 --> 00:37:11,440 hit me up 1122 00:37:11,440 --> 00:37:13,280 and then finally the last part of this 1123 00:37:13,280 --> 00:37:14,560 talk we're just going to talk very 1124 00:37:14,560 --> 00:37:16,320 briefly about the 1125 00:37:16,320 --> 00:37:18,240 ctf so 1126 00:37:18,240 --> 00:37:20,000 the ctf isn't meant to be incredibly 1127 00:37:20,000 --> 00:37:21,599 challenging it's a bluetooth ctf but 1128 00:37:21,599 --> 00:37:23,200 it's mostly designed to force you to 1129 00:37:23,200 --> 00:37:24,720 learn a little bit about the tools that 1130 00:37:24,720 --> 00:37:27,839 are available to you as a bluetooth 1131 00:37:27,839 --> 00:37:29,520 security researcher these are ones that 1132 00:37:29,520 --> 00:37:31,920 are it can everything can be done with 1133 00:37:31,920 --> 00:37:33,359 free tools you don't need a special 1134 00:37:33,359 --> 00:37:35,119 bluetooth adapter you don't need an 1135 00:37:35,119 --> 00:37:36,800 ubertooth one you can put that away it's 1136 00:37:36,800 --> 00:37:38,640 not going to be any help i promise it's 1137 00:37:38,640 --> 00:37:40,720 just basic bluetooth stuff but there is 1138 00:37:40,720 --> 00:37:42,400 a bit of a challenge in some of the 1139 00:37:42,400 --> 00:37:44,400 later challenges so 1140 00:37:44,400 --> 00:37:45,920 most of the challenges can be solved by 1141 00:37:45,920 --> 00:37:47,280 simply downloading a tool that's 1142 00:37:47,280 --> 00:37:49,359 available for free online and simply 1143 00:37:49,359 --> 00:37:50,960 reading the documentation to learn how 1144 00:37:50,960 --> 00:37:53,760 to use them and how to read the output 1145 00:37:53,760 --> 00:37:55,280 from the data you receive from the 1146 00:37:55,280 --> 00:37:56,720 target right 1147 00:37:56,720 --> 00:37:58,480 it's all running on one raspberry pi so 1148 00:37:58,480 --> 00:38:00,240 you just ask it for information it'll 1149 00:38:00,240 --> 00:38:01,920 give it to you and you find the right 1150 00:38:01,920 --> 00:38:03,920 information and put that into your your 1151 00:38:03,920 --> 00:38:06,000 ctf portal right 1152 00:38:06,000 --> 00:38:07,040 so 1153 00:38:07,040 --> 00:38:08,880 the only flag i would really consider a 1154 00:38:08,880 --> 00:38:10,560 challenge is the last one 1155 00:38:10,560 --> 00:38:11,920 for which you're going to need to have a 1156 00:38:11,920 --> 00:38:13,119 program 1157 00:38:13,119 --> 00:38:15,359 that can send bluetooth data to the 1158 00:38:15,359 --> 00:38:17,200 target device right 1159 00:38:17,200 --> 00:38:19,040 and then be ready to receive data 1160 00:38:19,040 --> 00:38:20,720 because you will find the first piece of 1161 00:38:20,720 --> 00:38:22,160 data you have to send as one of the 1162 00:38:22,160 --> 00:38:23,839 other challenges 1163 00:38:23,839 --> 00:38:26,560 then your task is to send that data to 1164 00:38:26,560 --> 00:38:28,480 my device successfully 1165 00:38:28,480 --> 00:38:30,560 and prepare your device to receive data 1166 00:38:30,560 --> 00:38:32,960 in response because the data you 1167 00:38:32,960 --> 00:38:34,640 excuse me 1168 00:38:34,640 --> 00:38:37,040 the data you receive in response will be 1169 00:38:37,040 --> 00:38:38,800 the last flag and that's the one that i 1170 00:38:38,800 --> 00:38:41,359 think is is the only really challenging 1171 00:38:41,359 --> 00:38:43,760 one you will have to write some code 1172 00:38:43,760 --> 00:38:46,400 to get this to work um but you know even 1173 00:38:46,400 --> 00:38:48,320 if you haven't coded in bluetooth before 1174 00:38:48,320 --> 00:38:50,160 with bluetooth before if you've done any 1175 00:38:50,160 --> 00:38:51,520 python work i think you'll be able to 1176 00:38:51,520 --> 00:38:52,800 figure it out 1177 00:38:52,800 --> 00:38:54,400 i would recommend to anyone you know 1178 00:38:54,400 --> 00:38:55,520 especially if you're having trouble with 1179 00:38:55,520 --> 00:38:57,200 that last one 1180 00:38:57,200 --> 00:38:59,040 take a look at the examples that pi blue 1181 00:38:59,040 --> 00:39:00,400 z provides 1182 00:39:00,400 --> 00:39:02,000 they're very useful and they were a lot 1183 00:39:02,000 --> 00:39:03,680 of help for me when i was first figuring 1184 00:39:03,680 --> 00:39:04,960 out 1185 00:39:04,960 --> 00:39:06,560 how to customize applications for 1186 00:39:06,560 --> 00:39:09,440 sending and receiving bluetooth data so 1187 00:39:09,440 --> 00:39:12,240 hopefully uh that's enough of a hint or 1188 00:39:12,240 --> 00:39:13,200 a tip 1189 00:39:13,200 --> 00:39:15,040 to have you staying here with us worth 1190 00:39:15,040 --> 00:39:17,680 your time for the ctf i know uh it gets 1191 00:39:17,680 --> 00:39:19,920 very competitive sometimes 1192 00:39:19,920 --> 00:39:21,839 um but yeah that is the end of the 1193 00:39:21,839 --> 00:39:23,440 presentation here's a quick look at some 1194 00:39:23,440 --> 00:39:25,920 of the references everything here should 1195 00:39:25,920 --> 00:39:28,640 be you know pretty easy to see i will be 1196 00:39:28,640 --> 00:39:30,480 uploading these slides to the github as 1197 00:39:30,480 --> 00:39:32,640 well so if you want to remember go back 1198 00:39:32,640 --> 00:39:35,119 to that github page there's the link 1199 00:39:35,119 --> 00:39:36,640 right the slides should be available 1200 00:39:36,640 --> 00:39:38,079 there soon 1201 00:39:38,079 --> 00:39:40,240 um but yeah i am all out of clever 1202 00:39:40,240 --> 00:39:41,440 things to say 1203 00:39:41,440 --> 00:39:44,000 so thank you so much for your time and 1204 00:39:44,000 --> 00:39:45,680 i'll be on the floor at the karaki 1205 00:39:45,680 --> 00:39:47,599 village throughout the entire event so 1206 00:39:47,599 --> 00:39:48,960 if you see me and you have any questions 1207 00:39:48,960 --> 00:39:50,800 or you want to call me some call me 1208 00:39:50,800 --> 00:39:52,480 names or something by all means come 1209 00:39:52,480 --> 00:39:54,079 through i'm always happy to answer 1210 00:39:54,079 --> 00:39:55,920 questions over email as well or if you 1211 00:39:55,920 --> 00:39:57,520 want to look me up on linkedin that's 1212 00:39:57,520 --> 00:39:59,760 fine too searching kamalgali will 1213 00:39:59,760 --> 00:40:02,720 usually uh lead you my way but 1214 00:40:02,720 --> 00:40:04,720 you know like i said my email address is 1215 00:40:04,720 --> 00:40:05,680 there 1216 00:40:05,680 --> 00:40:07,920 feel free to reach out at any time so 1217 00:40:07,920 --> 00:40:10,480 thank you so much and yeah 1218 00:40:10,480 --> 00:40:12,720 yeah i'll be easy keep on hacking hack 1219 00:40:12,720 --> 00:40:13,680 the world 1220 00:40:13,680 --> 00:40:16,680 yeah 1221 00:44:59,760 --> 00:45:01,839 you