- Bluetooth as a protocol has been around for quite a while.
Originally created, the specification created in 1994
through a conglomeration of companies.
We had Ericsson, IBM, Intel, Toshiba, and Nokia.
They all came together looking for a way
to transmit data wirelessly between devices,
maybe a phone, maybe a laptop, maybe computer,
whatever, they wanted to do wireless transfer of data.
So they came up with Bluetooth.
Specification 1994.
The Bluetooth SIG or special interest group
was formed in 1998.
As of now, in the 2020s,
we are over 35,000 member companies
as part of the Bluetooth special interest group.
Any company can go and join the Bluetooth SIG.
And with that, you receive a unique identifier
for products that you create
and you get to contribute to the Bluetooth specification
if you so choose.
Now, there's kind of two classes of attacks
when it comes to Bluetooth.
There's the old school stuff
and now, there's the Bluetooth 4 and 5 stuff.
So, in the old school category,
this is when we had, you know, the early 2000s,
we had the cell phones that could like,
transmit a contact card via Bluetooth.
And that's where these old school attacks come into play.
You could send messages with Bluetooth.
We have four we're looking at here,
Bluejacking, BlueSniffing,
BlueSnarfing and Bluesmacking.
Bluejacking, as we can see here,
is sending messages over Bluetooth through contact sharing.
So you could create a new contact, put a message in there,
like, you know, I see what you're doing online
and you're sitting in the coffee shop,
you send it to someone, you know.
BlueSniffing is,
it's like war driving for wifi, except you are,
you know, seeing which Bluetooth devices
exist in certain places,
tying that to a physical location on the earth.
And now you know that a Bluetooth device exists there.
However, most of the time Bluetooth devices are moving.
BlueSnarfing, stealing data via Bluetooth.
And Bluesmacking, denial of service affecting availability
of the target device.
So I mentioned Bluejacking,
creating a contact, sharing it via Bluetooth
in order to, as we see here,
elicit a response from your target or gorilla marketing.
So, as you're walking around downtown San Francisco,
you are constantly sending out this contact
saying, hey, go eat at Joe's sandwich shop as an example.
Some tools used for these old school attacks.
I have all the URLs listed here,
from Bluetooth browser down to Bluediving.
Take a look at these tools,
given the current state of Bluetooth
versus what it was 20 years ago,
the tools have changed a little bit.
So we talked about a lot of vulnerabilities
that existed, you know, 20 years ago.
But is Bluetooth still relevant in the 2020s?
Absolutely. And it's a lot more fun.
'Cause back then, it was just audio and contact sharing
and you know, you got your headset on
and everyone's walking around with their,
you know, big microphone and looking cool.
But now in the 2020s, we have Bluetooth Smart,
came around with Bluetooth version 4.
And with Bluetooth Smart or Bluetooth Low Energy,
we have the ability
to very easily interact with Bluetooth devices,
change settings, receive data, all without pairing.
So, it becomes a very interesting avenue
of investigation of smart devices.
And when we get into the IoT section of this course,
you'll see a lot more about Bluetooth.
But, we do need to talk about the fact,
particularly 'cause we're in this wireless section,
some tools you can use to interact with Bluetooth devices.
So, we have nRFConnect and Gattacker.
G attacker.
I'm not exactly sure the correct pronunciation of the tool
but let's take a look at nRFConnect first.
So, nRFConnect comes in mobile version
as well as a desktop version.
The screenshot here is from the mobile version.
And what I did was with this screenshot,
I installed the application and I started it.
And what it does is it scans the local area,
looking for Bluetooth devices
and then I'll show them to you.
So I found one, I clicked on it
and we can see here that the self-identified name
of this device is battery monitor.
I don't know what this is,
but it's in my house, which is really interesting.
I hit connect and I can then enumerate the GAT database.
GAT is generic attribute database.
And I can see what characteristics this device offers
that I might be able to read.
Now this one right here,
if I could circle that real quick,
it has the property of notify.
And what this means is that
you can subscribe to this characteristic
and receive, provided you're connected,
receive updates whenever it changes.
And it was every second, this data was changing.
Now, this is an unknown characteristic.
So, it's proprietary
to whoever made this particular battery monitor.
But,
and I don't know what this data is, of course.
Now,
I start with the whole reverse engineering process, right?
See if I can figure out what that device is.
And then, also, look for characteristics
that I can write to.
So this little up arrow right here
will allow me to send data to a characteristic.
This is a lot of fun to play with.
If you're sitting in the passenger seat of a car sometime,
fire up nRFConnect desktop
and see what you can connect to and play with.
And the next application G attacker or Gattacker,
again, I'm guessing it's Gattacker
because generic attribute attacker
is how it might be pronounced,
I'm not particularly sure.
But, it is essentially a proxy
for Bluetooth Low Energy connections.
Very interesting.
So you can see here, it creates copy of the attacked device
in the Bluetooth layer.
Then the phone would connect to the desktop
which is emulating the device that you are attacking
then proxying the data through.
So, you get a machine in the middle situation
wherein your computer becomes that device,
you're proxying the data back and forth.
And what can you do with that?
You can sniff it, modify it, intercept
and you know, take control,
what sort of authentication is included
in that exchange of information.
A lot of fun.