Mipow Playbulb: Bluetooth Connection Sniffing - Revision history

Bnagl: /* Prerequisites */ removed unnecessary blank

2020-12-22T19:06:54Z

Prerequisites: removed unnecessary blank

← Older revision		Revision as of 19:06, 22 December 2020
Line 19:		Line 19:

	sudo service bluetooth status		sudo service bluetooth status

	If the output shows (dead) use the following command.		If the output shows (dead) use the following command.

2020-12-22T18:48:44Z

Prerequisites: added a note regarding a problem with LE I encountered

← Older revision		Revision as of 18:48, 22 December 2020
Line 29:		Line 29:
	hciconfig -a		hciconfig -a

			Note: On some bluetooth dongles you need to enable the LE mode if you encounter problems while scanning.

			btmgmt le on

	=== Retrieve the Bluetooth Address of the victim device via the hcitool ===		=== Retrieve the Bluetooth Address of the victim device via the hcitool ===

2020-12-22T18:44:57Z

Error correction

← Older revision		Revision as of 18:44, 22 December 2020
Line 279:		Line 279:
	char-write-cmd 17 WWRRGGBBEE00SS00		char-write-cmd 17 WWRRGGBBEE00SS00

	==== [10] Write for reset ====		==== [11] Write for reset ====

	The app is providing a reset button.		The app is providing a reset button.

2020-12-22T18:43:12Z

Added the reset handle

← Older revision		Revision as of 18:43, 22 December 2020
Line 227:		Line 227:
	Now we connect the Victim device to a Smartphone. The Ubertooth may not be able to follow the jump pattern of the connection, so disconnect and reconnect your smartphone until the data stream doesn’t stop.		Now we connect the Victim device to a Smartphone. The Ubertooth may not be able to follow the jump pattern of the connection, so disconnect and reconnect your smartphone until the data stream doesn’t stop.

	It was possible to figure out what the handles 0x17 and ~~0x19~~ were used for:		It was possible to figure out what the handles 0x17, 0x19 and 0x1b were used for:

	==== [10] Read and write the RGB Values ====		==== [10] Read and write the RGB Values ====
Line 278:		Line 278:

	char-write-cmd 17 WWRRGGBBEE00SS00		char-write-cmd 17 WWRRGGBBEE00SS00

			==== [10] Write for reset ====

			The app is providing a reset button.
			It is possible to write to the handle 0x1b to reset the device via GATT Tool by using this command:

			char-write-req 1b 03

	=== Sniffing the connection establishment with wireshark ===		=== Sniffing the connection establishment with wireshark ===

2020-12-22T18:32:59Z

[1] Read and Write the Device Name

← Older revision		Revision as of 18:32, 22 December 2020
Line 129:		Line 129:
	char-write-req 1f 504c415942554c422043414e444c45		char-write-req 1f 504c415942554c422043414e444c45
	Characteristic value was written successfully		Characteristic value was written successfully

	char-read-hnd 1f		char-read-hnd 1f
	Characteristic value/descriptor: 50 4c 41 59 42 55 4c 42 20 43 41 4e 44 4c 45		Characteristic value/descriptor: 50 4c 41 59 42 55 4c 42 20 43 41 4e 44 4c 45

2020-12-22T18:31:11Z

[1] Read and Write the Device Name: Adding the handle 1f for device name

← Older revision		Revision as of 18:31, 22 December 2020
Line 109:		Line 109:

	char-read-hnd 3		char-read-hnd 3
			Characteristic value/descriptor: 50 4c 41 59 42 55 4c 42

			char-read-hnd 1f
	Characteristic value/descriptor: 50 4c 41 59 42 55 4c 42		Characteristic value/descriptor: 50 4c 41 59 42 55 4c 42

Line 123:		Line 126:
	char-read-hnd 3		char-read-hnd 3
	Characteristic value/descriptor: 48 61 63 6b 65 64 0a		Characteristic value/descriptor: 48 61 63 6b 65 64 0a

			char-write-req 1f 504c415942554c422043414e444c45
			Characteristic value was written successfully

			char-read-hnd 1f
			Characteristic value/descriptor: 50 4c 41 59 42 55 4c 42 20 43 41 4e 44 4c 45

			Convert Hex to ASCII:

			50 4c 41 59 42 55 4c 42 20 43 41 4e 44 4c 45 -> PLAYBULB CANDLE

	==== [2] Read the Device Appearance ====		==== [2] Read the Device Appearance ====

2020-03-03T18:32:35Z

← Older revision		Revision as of 18:32, 3 March 2020
(No difference)

2020-03-03T11:46:15Z

Connect to the victim device and reading its characteristics

← Older revision		Revision as of 11:46, 3 March 2020
Line 44:		Line 44:
	DC:48:4B:0F:AC:E6 PLAYBULB		DC:48:4B:0F:AC:E6 PLAYBULB

	=== Connect to the victim device and reading its characteristics ===		=== Connect to the victim device and reading its characteristics with the GATT Toll===
	~~Starting~~ the GATT Tool ~~in Interacive~~ mode and connect to the ~~retrieved Bluetooth Address~~		Before you can start using the GATT Tool you need to know the Bluetooth Address of the victim device. For gathering this information you can use the hcitool, which is described above.

			The GATT Tool has an powerful interactive mode. During this mode the devices stay connected and you can use more than one handle sequentially.

			sudo gatttool -I <Bluetooth interface> -b <BD_ADDR>
			connect

			To get the name of your Bluetooth interfaces use hciconfig, which is described above.

			The Interactive mode also allows to list the characteristics of the connected device and control them.



			Connecting the Device in Interactive mode

	sudo gatttool -I hci1 -b <BD_ADDR>		sudo gatttool -I hci1 -b <BD_ADDR>
	connect		connect

	“hci1” is the Bluetooth sender name and can differ on your device		“hci1” is the Bluetooth sender name and can differ on your device.

	Reading the Characteristic which the victim devices have.		Reading the Characteristic which the victim devices have.

2020-02-24T14:43:56Z

Analyzing the Characteristics with the Ubertooth One

← Older revision		Revision as of 14:43, 24 February 2020
Line 211:		Line 211:

	The hex values reach from 0 to 255 (ff) which allows 16 Million colour combinations. The brightness is also adjusted by lowering the colour values.		The hex values reach from 0 to 255 (ff) which allows 16 Million colour combinations. The brightness is also adjusted by lowering the colour values.

	It is also possible to write the colour with the GATT Tool by using this command:		It is also possible to write the colour with the GATT Tool by using this command:

Line 246:		Line 247:
	05 Candle Flickering Off		05 Candle Flickering Off
	ff No Effect		ff No Effect


			It is also possible to write the colour with the GATT Tool by using this command:

			char-write-cmd 17 WWRRGGBBEE00SS00

	=== Sniffing the connection establishment with wireshark ===		=== Sniffing the connection establishment with wireshark ===

2020-02-24T14:42:49Z

Used Hardware