BLE-Berry Project - Revision history

Ikramer at 17:32, 12 March 2024

2024-03-12T17:32:14Z

← Older revision		Revision as of 17:32, 12 March 2024
Line 83:		Line 83:
	Sadly, the source code as well as the thesis can not made public		Sadly, the source code as well as the thesis can not made public
	the due to legal reasons until I finish my studies by passing my final exam, but you can contact this email dessyboy@tutanota.com address to get informed when the project gets accessible.		the due to legal reasons until I finish my studies by passing my final exam, but you can contact this email dessyboy@tutanota.com address to get informed when the project gets accessible.

			[[Category:Documentation]]
			[[Category:Pentesting]]

Cskallak: /* BLE Berry */

2023-10-02T21:02:22Z

BLE Berry

← Older revision		Revision as of 21:02, 2 October 2023
Line 66:		Line 66:

	=== BLE Berry ===		=== BLE Berry ===
	The BLE Berry takes a distributed three layer approach. At the lowest ~~lay~~ are the BLE Nodes. BLE Nodes raspberry ~~pies~~ (3, 4 or Zero) that run a script to perform BLE ~~operation~~ like interacting with a device, deploying a BLE server. The nodes can have a Sniffing USB accessory attached to perform sniffing operations. The Nodes interact with the frontend via MQTT messages. The frontend is a QT application that displays the collected data and lets the users command the BLE Nodes. Multiple frontend session can run at the same time and they are only restricted by the amount of available BL Nodes.		The BLE Berry takes a distributed three layer multi-user approach. At the lowest layer are the BLE Nodes. BLE Nodes are raspberry pis (3, 4 or Zero) that run a script to perform BLE operations, like interacting with a device, deploying a BLE server. The nodes can have a Sniffing USB accessory attached to perform sniffing operations (The current version only supports the Ubertooth One other ones are WIP). The Nodes interact with the frontend via MQTT messages. The frontend is a QT application that displays the collected data and lets the users command the BLE Nodes. Multiple frontend session can run at the same time, and they are only restricted by the amount of available BLE Nodes. The backend consists of three Docker containers. The database and MQTT Broker use the official Mosquitto and MySQL images, and the database agent is a python script running in an alpine container. The agent stores all gathered information in the database and provides the stored data to the front end when a session is reopened.


Line 77:		Line 77:
	The MySQL database is shown in the figure below.		The MySQL database is shown in the figure below.
	[[File:BLE Berry Project Database.png\|800px]]		[[File:BLE Berry Project Database.png\|800px]]


	== Source Code and Thesis ==		== Source Code and Thesis ==

Cskallak at 20:56, 2 October 2023

2023-10-02T20:56:06Z

← Older revision		Revision as of 20:56, 2 October 2023
Line 66:		Line 66:

	=== BLE Berry ===		=== BLE Berry ===
			The BLE Berry takes a distributed three layer approach. At the lowest lay are the BLE Nodes. BLE Nodes raspberry pies (3, 4 or Zero) that run a script to perform BLE operation like interacting with a device, deploying a BLE server. The nodes can have a Sniffing USB accessory attached to perform sniffing operations. The Nodes interact with the frontend via MQTT messages. The frontend is a QT application that displays the collected data and lets the users command the BLE Nodes. Multiple frontend session can run at the same time and they are only restricted by the amount of available BL Nodes.


			[[File:BLE Berry Project Architecture.png\|800px]]

			The following figure the how the MQTT topics look like for the BLE Berry Tool.
			[[File:BLE Berry Project MQTT.png\|800px]]


			The MySQL database is shown in the figure below.
			[[File:BLE Berry Project Database.png\|800px]]


	== Source Code and Thesis ==		== Source Code and Thesis ==

Cskallak: /* BLE Berry */

2023-10-02T20:39:19Z

BLE Berry

← Older revision		Revision as of 20:39, 2 October 2023
Line 66:		Line 66:

	=== BLE Berry ===		=== BLE Berry ===


	== Source Code and Thesis ==		== Source Code and Thesis ==

Cskallak at 20:37, 2 October 2023

2023-10-02T20:37:50Z

@@ Line 68: / Line 68: @@
-=== GitLab ===
+== Source Code and Thesis ==
 https://git.fh-campuswien.ac.at/ble-berry-ma-thesis
 Sadly, the source code as well as the thesis can not made public
 the due to legal reasons  until I finish my studies by passing my final exam, but you can contact this email dessyboy@tutanota.com address to get informed when the project gets accessible.

Cskallak: /* Summary */

2023-10-02T20:37:22Z

Summary

← Older revision		Revision as of 20:37, 2 October 2023
Line 2:		Line 2:

	This Project is the result of a master’s thesis that created a Threat Model of the Bluetooth Low Energy (BLE) Standard and developing a tool called BLE Berry to enable easier BLE Development and to perform basic pentesting operations.		This Project is the result of a master’s thesis that created a Threat Model of the Bluetooth Low Energy (BLE) Standard and developing a tool called BLE Berry to enable easier BLE Development and to perform basic pentesting operations.


	== Threat Model ==		== Threat Model ==

Cskallak: /* GitLab */

2023-10-02T20:37:08Z

GitLab

← Older revision		Revision as of 20:37, 2 October 2023
Line 73:		Line 73:

	Sadly, the source code as well as the thesis can not made public		Sadly, the source code as well as the thesis can not made public
	the due to legal reasons until I finish my studies by passing my final exam, but you can contact this email [dessyboy@tutanota.com] address to get informed when the project gets accessible.		the due to legal reasons until I finish my studies by passing my final exam, but you can contact this email dessyboy@tutanota.com address to get informed when the project gets accessible.

	== Used Hardware ==		== Used Hardware ==

Cskallak: /* GitLab */

2023-10-02T20:36:28Z

GitLab

← Older revision		Revision as of 20:36, 2 October 2023
Line 73:		Line 73:

	Sadly, the source code as well as the thesis can not made public		Sadly, the source code as well as the thesis can not made public
	the due to legal reasons until I finish my studies by passing my final exam, but you can contact this email dessyboy@tutanota.com address to get informed when the project gets accessible.		the due to legal reasons until I finish my studies by passing my final exam, but you can contact this email [dessyboy@tutanota.com] address to get informed when the project gets accessible.

	== Used Hardware ==		== Used Hardware ==

Cskallak: /* GitLab */

2023-10-02T20:36:15Z

GitLab

← Older revision		Revision as of 20:36, 2 October 2023
Line 71:		Line 71:
	=== GitLab ===		=== GitLab ===
	https://git.fh-campuswien.ac.at/ble-berry-ma-thesis		https://git.fh-campuswien.ac.at/ble-berry-ma-thesis

	Sadly, the source code as well as the thesis can not made public		Sadly, the source code as well as the thesis can not made public
	the due to legal reasons until I finish my studies by passing my final exam, but you can contact this email dessyboy@tutanota.com address to get informed when the project gets accessible.		the due to legal reasons until I finish my studies by passing my final exam, but you can contact this email dessyboy@tutanota.com address to get informed when the project gets accessible.

Cskallak: /* Threat Model */

2023-10-02T20:36:03Z

Threat Model

← Older revision		Revision as of 20:36, 2 October 2023
Line 58:		Line 58:
	==== Brute-forcing Legacy Pairing Encryption Key ====		==== Brute-forcing Legacy Pairing Encryption Key ====
	The Legacy Pairing algorithm relied on a six-digit temporal key (TK) as the only secret parameter for the derivation of the short term key and link key. The six-digit passcode only provides an entropy of 20 bits and is therefore brute-forceable. Any device that use any BLE version after 4.2 relies on a secure paring authentication algorithm and is therefore not prone to this threat anymore.		The Legacy Pairing algorithm relied on a six-digit temporal key (TK) as the only secret parameter for the derivation of the short term key and link key. The six-digit passcode only provides an entropy of 20 bits and is therefore brute-forceable. Any device that use any BLE version after 4.2 relies on a secure paring authentication algorithm and is therefore not prone to this threat anymore.

			==== Cross Transport Key Derivation ====
			Cross Transport Key Derivation (CTKD) is a protocol to cross derive a key from Bluetooth Classic and BLE used by devices that implement both communication protocols (dual-mode devices), e.g., smartphones. The problem is that dual-mode devices can only turn on both protocols in conjunction and even when one of them is in use, is the other one able to be connected to. This is abused by adversaries by connecting to the unused protocol and performing the CTKD. This results in a disconnect between the two legit device because the key is overwritten, and the connection overtaken by the adversary.

	==== Machine in the Middle ====		==== Machine in the Middle ====
Line 63:		Line 66:


	=== ~~Step 2~~ ===		=== BLE Berry ===

	~~Make sure to read~~

	* War and Peace		=== GitLab ===
	* Lord of the ~~Rings~~		https://git.fh-campuswien.ac.at/ble-berry-ma-thesis
	* The Baroque Cycle		Sadly, the source code as well as the thesis can not made public
			the due to legal reasons until I finish my studies by passing my final exam, but you can contact this email dessyboy@tutanota.com address to get informed when the project gets accessible.

	== Used Hardware ==		== Used Hardware ==