Bluetooth LE Hacking - Revision history

NKirnbauer: NKirnbauer moved page Bluetooth LE hacking to Bluetooth LE Hacking

2024-10-23T09:45:41Z

← Older revision	Revision as of 09:45, 23 October 2024
(No difference)

2021-12-06T19:43:15Z

← Older revision		Revision as of 19:43, 6 December 2021
Line 125:		Line 125:
	* [[MIPOW PLAYBULB CANDLE - Smart Light, Leuchte]]		* [[MIPOW PLAYBULB CANDLE - Smart Light, Leuchte]]
	* [[UD100-G03 BlueSoleil Bluetooth USB Adapter]]		* [[UD100-G03 BlueSoleil Bluetooth USB Adapter]]


	~~== Courses ==~~


	== References ==		== References ==

2021-12-06T19:40:24Z

← Older revision		Revision as of 19:40, 6 December 2021
Line 131:		Line 131:

	== References ==		== References ==
			* [[Bettercap]]
	* ~~https:~~/~~/wikipedia.org~~		* [[Bluetooth Pentesting Tools (HW/SW)]]
	* ~~https~~:~~//google.com~~		* [[BLE Fundamentals]]
			* [[Installing BtleJuice]]
			* [[Bluetooth Sniffing with Ubertooth: A Step-by-step guide]]

	[[Category:Documentation]]		[[Category:Documentation]]

2021-11-30T16:18:41Z

← Older revision		Revision as of 16:18, 30 November 2021
Line 7:		Line 7:
	* Operating system: Ubuntu 18.04		* Operating system: Ubuntu 18.04
	* Elvis lab IoT devices		* Elvis lab IoT devices

	~~In order to complete these steps, you must have followed before.~~

	== Description ==		== Description ==
	First install ~~ubertooth~~ one and all libraries. A full documentation is available on: https://ubertooth.readthedocs.io/en/latest/build_guide.html		First install Ubertooth one and all libraries. A full documentation is available on: https://ubertooth.readthedocs.io/en/latest/build_guide.html

	NEVER OPERATE YOUR UBERTOOTH WITHOUT ATTACHED ANTENNA!!		NEVER OPERATE YOUR UBERTOOTH WITHOUT ATTACHED ANTENNA!!
Line 123:		Line 121:
	== Used Hardware ==		== Used Hardware ==
	All hardware is used from the Elvis Lab.		All hardware is used from the Elvis Lab.
	* Ubertooth One		* [[Ubertooth One, 2.4 GHz wireless development platform]]
	*		* [[Motorola Moto G4 Play Smartphone 16 GB, Android, Dual-SIM, black]]
			* [[MIPOW PLAYBULB CANDLE - Smart Light, Leuchte]]
			* [[UD100-G03 BlueSoleil Bluetooth USB Adapter]]


	== Courses ==		== Courses ==

2021-11-30T16:10:48Z

← Older revision		Revision as of 16:10, 30 November 2021
Line 86:		Line 86:
	In this case I used the MAC address of the smart bulb.		In this case I used the MAC address of the smart bulb.
	ble.enum 6a:9b:4b:1b:ac:e6		ble.enum 6a:9b:4b:1b:ac:e6

	[[File:Bettercap enum.PNG \| 700px]]		[[File:Bettercap enum.PNG \| 700px]]

	To find out what characteristics the smartphone sends to the smart bulb to change the light colour,		To find out what characteristics the smartphone sends to the smart bulb to change the light colour,
	I used a MITM attack.		I used a MITM attack.
Line 106:		Line 108:
	sudo btlejuice -u <ip proxy> -w		sudo btlejuice -u <ip proxy> -w

			[[File:Btlejuice web.PNG \| 700px]]

			The attack shows that on the characteristics fffc there is a write command whenever I change the colour on the smartphone.
			It looks like the values represent rgb values.
	=== Gatttool ===		=== Gatttool ===
			From Bettercap we can see that characteristic fffc is on the handle 0x0019.
			This can be used with gatttool to send different commands to the smart bulb and change the colours.
			gatttool -b 6A:9B:4B:1B:AC:E6 -I
			connect
			char-write-cmd 19 ff000000
			char-write-cmd 19 00ff0000


	== Used Hardware ==		== Used Hardware ==

2021-11-30T16:03:03Z

← Older revision		Revision as of 16:03, 30 November 2021
Line 86:		Line 86:
	In this case I used the MAC address of the smart bulb.		In this case I used the MAC address of the smart bulb.
	ble.enum 6a:9b:4b:1b:ac:e6		ble.enum 6a:9b:4b:1b:ac:e6
	[[File:Bettercap enum.PNG]]		[[File:Bettercap enum.PNG \| 700px]]
	To find out what characteristics the smartphone sends to the smart bulb to change the light colour,		To find out what characteristics the smartphone sends to the smart bulb to change the light colour,
	I used a MITM attack.		I used a MITM attack.

2021-11-30T16:01:22Z

← Older revision		Revision as of 16:01, 30 November 2021
Line 64:		Line 64:

	=== Bettercap sniffing ===		=== Bettercap sniffing ===
	Installing ~~bettercap~~ on Ubuntu:		Installing Bettercap on Ubuntu:
	sudo -s		sudo -s
	wget https://golang.org/dl/go1.17.3.linux-amd64.tar.gz		wget https://golang.org/dl/go1.17.3.linux-amd64.tar.gz
Line 86:		Line 86:
	In this case I used the MAC address of the smart bulb.		In this case I used the MAC address of the smart bulb.
	ble.enum 6a:9b:4b:1b:ac:e6		ble.enum 6a:9b:4b:1b:ac:e6
			[[File:Bettercap enum.PNG]]
	To find out what characteristics the smartphone sends to the smart bulb to change the light colour,		To find out what characteristics the smartphone sends to the smart bulb to change the light colour,
	I used a MITM attack.		I used a MITM attack.

2021-11-30T15:57:28Z

@@ Line 13: / Line 13: @@
 First install ubertooth one and all libraries. A full documentation is available on: https://ubertooth.readthedocs.io/en/latest/build_guide.html
-Check if ubertooth one is recognized:
+NEVER OPERATE YOUR UBERTOOTH WITHOUT ATTACHED ANTENNA!!
   lsusb
 Bus 001 Device 003: ID 1d50:6002 OpenMoko, Inc. Ubertooth One
@@ Line 60: / Line 62: @@
   sudo wireshark -k -i /tmp/pipe &
   sudo ubertooth-btle -f -c /tmp/pipe
 === MITM attack ===
 To find out what GAT messages between a BLE device and a smartphone are being exchanged, I used a

2021-11-21T13:15:18Z

2021-11-21T13:14:48Z