Bluetooth Hacking, Part 1: Getting Started with Bluetooth

Welcome back, my aspiring cyberwarriors!

Today, Bluetooth is built into nearly all our devices and gadgets. These include our computers, smartphones, iPods, tablets, speakers, game controllers, keyboards, and many other devices. In this series, we will be focused on hacking mobile devices, tablets, and phones as they are the most fertile ground for hackers. The ability to hack Bluetooth can lead to the compromise of any information on the device (pictures, emails, text, etc.), control of the device, and the ability to send unwanted info to the device.

 

Before we start hacking Bluetooth, though, we need to understand the technology, the terms, and the security that is built into Bluetooth, if we want to successfully hack it. In a short article like this, I can’t convey an in-depth understanding of Bluetooth, but I do think I can give you a basic knowledge that you can use in subsequent tutorials/hacks.

 

Bluetooth Basics ​ Bluetooth is a universal protocol for low power, near field communication operating at 2.4 – 2.485 GHz using spread spectrum, frequency hopping at 1,600 hops per second (this frequency hopping is a security measure). It was developed in 1994 by Ericsson Corp. of Sweden and named after the 10th century Danish (Sweden and Denmark were a single country in the 10th century) King Harald Bluetooth.

 

The minimum specification for Bluetooth range is 10 meters, but there is no limit to the range that manufacturers may implement in their devices. Many devices have ranges as long as 100 meters. With special antennas, we can extend the range even farther.

 

When two Bluetooth devices connect, this is referred to as pairing. Nearly any two Bluetooth devices can connect to each other. Any discoverable Bluetooth device transmits the following information: ​

• Name

• Class

• List of services

• Technical information

​When the two devices pair, they exchange a pre-shared secret or link key. Each stores this link key to identify the other in future pairing. ​ Every device has a unique 48-bit identifier (a MAC-like address) and usually a manufacturer assigned name.

Below is a diagram of the Bluetooth pairing process. Although much more secure in recent years, it is still vulnerable, as we will see in future tutorials in this series. ​ ​

 

Basic Linux Bluetooth Tools

The Linux implementation of the Bluetooth protocol stack is BlueZ. Most Linux distributions have it installed by default, but if not, you can usually find it in your repository. In our Kali Linux, as you would expect, it is installed by default.

BlueZ has a number of simple tools we can use to manage and eventually hack Bluetooth. These include:

• hciconfig: This tool operates very similarly to ifconfig in Linux, except that it operates on the Bluetooth devices. As you can see in the screenshot below, I have used it first to bring up the Bluetooth interface (hci0) and second, query the device for its specs.

• hcitool: This is an inquiry tool. It can provide us with device name, device ID, device class, and device clock.

• hcidump: This tool enables us to sniff the Bluetooth communication.

 

Bluetooth devices don’t need to use all the protocols in the stack (like the TCP/IP stack). The Bluetooth stack is developed to enable use of Bluetooth by a variety of communication applications. Generally, an application will only use one vertical slice of this stack. The Bluetooth protocols layer and their associated protocols are listed below. ​

• Bluetooth Core Protocols Baseband: LMP, L2CAP, SDP

• Cable Replacement Protocol: RFCOMM

• Telephony Control Protocol: TCS Binary, AT-commands

• Adopted Protocols: PPP, UDP/TCP/IP, OBEX, WAP, vCard, vCal, IrMC, WAE

In addition to the protocol layers, the Bluetooth specification also defines a host controller interface (HCI). This provides a command interface to the baseband controller, link manager, and access to hardware status and control registers, hence the name of the tools above such as hciconfig, hcidump, and hcitool. ​ Bluetooth Security ​ Bluetooth security is based upon a few techniques. First, frequency hopping. Both the master and slave know the frequency hopping algorithm, but the outsider does not. Second, a pre-shared key exchanged at pairing that is used for authentication and encryption (128-bit). There have been three security modes for Bluetooth. These are:

1. Security Mode 1: No active security.

2. Security Mode 2: Service level security. Centralized security manager handles authentication, configuration, and authorization. May not be activated by user. No device level security.

3. Security Mode 3: Device level security. Authentication and encryption based on secret key. Always on. Enforces security for low-level connection.

​ ​

​Bluetooth Hacking Tools in Kali ​

Kali once had several Bluetooth hacking tools built-in. In Kali 2020 we are down to just one, spooftooth. This doesn’t mean there are not others. There are several in the Kali repository and on github.com. We will be using many of these in future tutorials. ​

 

Let’s take brief look at some of the other Bluetooth hacking tools. ​

• Bluelog: A bluetooth site survey tool. It scans the area to find as many discoverable devices in the area and then logs them to a file.

• Bluemaho: A GUI-based suite of tools for testing the security of Bluetooth devices.

• Blueranger: A simple Python script that uses i2cap pings to locate Bluetooth devices and determine their approximate distances.

• Btscanner: This GUI-based tool scans for discoverable devices within range.

• Redfang: This tool enables us to find hidden Bluetooth device.

• Spooftooph: This is a Bluetooth spoofing tool.

Some Bluetooth Attacks ​

• Blueprinting: The process of footprinting.

• Bluesnarfing: This attack takes data from the Bluetooth-enabled device. This can include SMS messages, calendar info, images, the phone book, and chats.

• Bluebugging: The attacker is able to take control of the target’s phone. Bloover was developed as a POC tool for this purpose.

• Bluejacking: The attacker sends a “business card” (text message) that, if the user allows to be added to their contact list, enables the attacker to continue to send additional messages.

• Bluesmack: A DoS attack against Bluetooth devices.

Now that we have a basic understanding of Bluetooth terms, technologies, and security, we can begin to explore ways to break and hack Bluetooth.