BlueTooth attack
Preparing for Bluetooth Reconnaissance: A Quick Guide¶
Embarking on Bluetooth surveillance requires a well-equipped setup. Ensure you have an up-to-date installation of Kali Linux, as we'll leverage its built-in Bluetooth tools for this endeavor. Keeping it streamlined, we won't be adding any extra tools; the default Bluetooth toolkit in Kali Linux will suffice.
Key tools included in BlueZ, the default Bluetooth protocol stack in most Linux versions, form the foundation of our exploration. Among these, we'll delve into hciconfig, hcitool, sdptool, l2ping, and btscanner. Additionally, specialized tools tailored for Bluetooth reconnaissance in Kali Linux will be introduced.
Proximity is a critical factor in Bluetooth hacking. Armed with a reliable Bluetooth adapter, you can target devices in various settings—be it a coffee shop, school classroom, office, or even within close proximity of a neighbor's house. Ensure your Bluetooth adapter is of high quality to maximize the reach of your Bluetooth reconnaissance.
Important
首先要保证有一个可接收信号的无线蓝牙
BlueZ Attack¶
- show Bluetooth devices
# example
hci0 Type: Primary Bus: USB
BD Address: ██:██:██:██:██:██ ACL MTU: 1022:8 SCO MTU: 183.5
DOWN
RX bytes:574 acl:0 sco:0 events:30 errors:0
TX bytes:368 acl:0 sco:0 commands:30 errors:0
可以使用man hciconfig查看更多信息
HCICONFIG(1) Linux System Administration HCICONFIG(1)
NAME
hciconfig - configure Bluetooth devices
SYNOPSIS
hciconfig -h
hciconfig [-a]
hciconfig [-a] hciX [command [command parameters]]
DESCRIPTION
hciconfig is used to configure Bluetooth devices. hciX is the name of
a Bluetooth device installed in the system. If hciX is not given, hci‐
config prints name and basic information about all the Bluetooth de‐
vices installed in the system. If hciX is given but no command is
given, it prints basic information on device hciX only. Basic informa‐
tion is interface type, BD address, ACL MTU, SCO MTU, flags (up, init,
running, raw, page scan enabled, inquiry scan enabled, inquiry, authen‐
tication enabled, encryption enabled).
OPTIONS
-h, --help
Gives a list of possible commands.
-a, --all
Other than the basic info, print features, packet type, link
policy, link mode, name, class, version.
COMMANDS
up Open and initialize HCI device.
down Close HCI device.
reset Reset HCI device.
rstat Reset statistic counters.
auth Enable authentication (sets device to security mode 3).
noauth Disable authentication.
encrypt Enable encryption (sets device to security mode 3).
noencrypt Disable encryption.
secmgr Enable security manager (current kernel support is limited).
nosecmgr Disable security manager.
piscan Enable page and inquiry scan.
noscan Disable page and inquiry scan.
iscan Enable inquiry scan, disable page scan.
pscan Enable page scan, disable inquiry scan.
ptype [type] With no type , displays the current packet types. Otherwise, all the packet types specified by type are set. type is a comma-separated list of packet types, where the possible packet types are DM1, DM3, DM5, DH1, DH3, DH5, HV1, HV2, HV3.
name [name] With no name, prints local name. Otherwise, sets local name to name.
class [class] With no class, prints class of device. Otherwise, sets class of device to class. class is a 24-bit hex number describing the class of device, as specified in section 1.2 of the Bluetooth Assigned Numers document.
voice [voice] With no voice, prints voice setting. Otherwise, sets voice setting to voice. voice is a 16-bit hex number describing the voice setting.
iac [iac] With no iac, prints the current IAC setting. Otherwise, sets the IAC to iac.
inqtpl [level] With no level, prints out the current inquiry transmit power level. Otherwise, sets inquiry transmit power level to level.
inqmode [mode] With no mode, prints out the current inquiry mode. Otherwise, sets inquiry mode to mode.
inqdata [data] With no name, prints out the current inquiry data. Otherwise, sets inquiry data to data.
inqtype [type] With no type, prints out the current inquiry scan type. Otherwise, sets inquiry scan type to type.
inqparams [win:int] With no win:int, prints inquiry scan window and interval. Otherwise, sets inquiry scan window to win slots and inquiry scan interval to int slots.
pageparms [win:int] With no win:int, prints page scan window and interval. Otherwise, sets page scan window to win slots and page scan interval to int slots.
pageto [to] With no to, prints page timeout. Otherwise, sets page timeout to .I to slots.
afhmode [mode] With no mode, prints out the current AFH mode. Otherwise, sets AFH mode to mode.
sspmode [mode] With no mode, prints out the current Simple Pairing mode. Otherwise, sets Simple Pairing mode to mode.
aclmtu mtu:pkt Sets ACL MTU to to mtu bytes and ACL buffer size to pkt packets.
scomtu mtu:pkt Sets SCO MTU to mtu bytes and SCO buffer size to pkt packets.
delkey This command deletes the stored link key for bdaddr from the device.
oobdata Get local OOB data (invalidates previously read data).
commands Display supported commands.
features Display device features.
version Display version information.
revision Display revision information.
lm [mode] With no mode , prints link mode. MASTER or SLAVE mean, respectively, to ask to become master or to remain slave when a connection request comes in. The additional keyword ACCEPT means that baseband connections will be accepted even if there are no listening AF_BLUETOOTH sockets. mode is NONE or a comma-separated list of keywords, where possible keywords are MASTER and ACCEPT . NONE sets link policy to the default behaviour of remaining slave and not accepting baseband connections when there are no listening AF_BLUETOOTH sockets. If MASTER is present, the device will ask to become master if a connection request comes in. If ACCEPT is present, the device will accept baseband connections even when there are no listening AF_BLUETOOTH sockets.
AUTHORS
Written by Maxim Krasnyansky and Marcel Holtmann
man page by Fabrizio Gennari
BlueZ Nov 11 2002 HCICONFIG(1)
Manual page hciconfig(1) line 147/169 (END) (press h for help or q to quit)
- up bluetooth devices
hci0 Type: Primary Bus: USB
BD Address: ██:██:██:██:██:██ ACL MTU: 1022:8 SCO MTU: 183.5
UP RUNNING
RX bytes:1148 acl:0 sco:0 events:60 errors:0
TX bytes:736 acl:0 sco:0 commands:60 errors:0
蓝牙设备已开启
Scan for Bluetooth Devices with hcitool¶
Hcitool proves invaluable in configuring and executing diverse tasks such as scans, inquiries, and name retrieval. However, certain commands necessitate the use of MAC addresses. A fundamental operation is scanning for nearby Bluetooth devices, providing MAC addresses for further inquiries or attempts to extract device names. Initiate a scan with the command hcitool scan. This employs the Bluetooth interface to identify nearby devices, revealing their MAC addresses. This information serves as a gateway for subsequent scans, inquiries, or endeavors to unveil device names.
Above, we see an OBD2 connector which is connected to a vehicle. That’s pretty interesting. With the MAC address, we can now we can do another command that required us to have a MAC address in the first place. Let’s try getting the name of the device:
That should allow us to get the name of the device, but we already knew it from that first scan. If we didn’t know it, however, it’ll allow us to be able to learn more about it. To learn more, we can use the inq command:
Note that it also displays clock offset and the class. The class indicates what type of Bluetooth device it is, and we can look up the code by going to the Bluetooth site. Or, as we will see later, some tools will do it for us.
Scan for Services with sdptool¶
Now, equipped with a foundational understanding of sdptool, let's harness its capabilities to delve into the intricacies of service discovery on Bluetooth devices. sdptool serves as a versatile tool for configuring, controlling, and interrogating SDP (Service Discovery Protocol) servers. This functionality empowers us to conduct detailed queries on Bluetooth devices, unraveling crucial information about permissions, and gaining insights into potential actions within those services. To embark on this exploration, initiate the command by typing sdptool browse followed by the MAC address we previously captured. This command serves as the gateway to a comprehensive understanding of the device's service landscape, shedding light on permissions, constraints, and possibilities that await discovery.
Browsing 00:1D:A5:00:09:1D ... Service Name: SPP Service RecHandle: 0x10001 Service Class ID List: "Serial Port" (ox1101) Protocol Descriptor List: "L2CAP" (0x0100) "RFCOMM" (0x0003) Channel: 1
In this context, the output provides additional insights into the realm of communications, unveiling the intricacies of protocols employed by the device. This newfound knowledge becomes pivotal as we navigate the landscape of potential vulnerabilities within the device. By scrutinizing the details, we might uncover vulnerabilities, ascertain the feasibility of direct communication, and even discern whether the device employs security measures such as MAC address randomization. This multifaceted exploration equips us with the information needed to make informed decisions and strategic moves in our Bluetooth reconnaissance endeavors.
Ping Bluetooth Devices with l2ping¶
We don’t need to do anything fancy here, just ping the Bluetooth device as so:
~# l2ping 00:1D:A5:00:09:1D Ping: 00:1D:A5:00:09:1D from ██:██:██:██:██:██ (data size 44) ... 44 bytes from 00:1D:A5:00:09:1D id 0 time 37.57ms 44 bytes from 00:1D:A5:00:09:1D id 1 time 27.23ms 44 bytes from 00:1D:A5:00:09:1D id 2 time 27.59ms 44 bytes from 00:1D:A5:00:09:1D id 3 time 27.31ms 44 bytes from 00:1D:A5:00:09:1D id 4 time 40.99ms 44 bytes from 00:1D:A5:00:09:1D id 5 time 48.77ms 44 bytes from 00:1D:A5:00:09:1D id 6 time 59.93ms 44 bytes from 00:1D:A5:00:09:1D id 7 time 48.84ms 44 bytes from 00:1D:A5:00:09:1D id 8 time 67.59ms
This indicates that the device is within range and reachable.
Scan for Bluetooth Devices with btscanner¶
As you can observe, there isn't much to btscanner in terms of command-line parameters. This is because btscanner is a graphical user interface (GUI) tool, and its functionality becomes evident once the tool is executed. Let's go ahead and run btscanner to unveil its capabilities.
Although many use Bluetooth daily, its workings and vulnerabilities often remain unknown. Hacking Bluetooth provides access to vast personal data stored on phones and tablets. Unlike Wi-Fi, Bluetooth devices hop frequencies, making it challenging for attackers to intercept communication. Additionally, Bluetooth negotiates a key once, enhancing security. With built-in tools on Kali Linux, Bluetooth reconnaissance becomes accessible. Tools like hciconfig, hcitool, sdptool, l2ping, and btscanner enable device discovery, service exploration, and ping tests. Bluetooth hacking demands proximity, and a compatible adapter enhances reach. Execute these steps responsibly, respecting legal and ethical boundaries.
buletooth exploit db¶
reference to : https://github.com/engn33r/awesome-bluetooth-security