Attacking and Crashing IoT devices via Bluetooth LE Protocol Ajay Pratap Singh & Pratap Chandra

Agenda BLE in IoT devices Bluetooth Low Energy Protocol Stack Functionality of Protocol Layers in BLE BLE Pairing Mechanisms Attacking IoT Devices – Case Studies

Internet of Things What The internet of things (IoT) is the network of physical devices, vehicles, buildings and other items—embedded with electronics, software, sensors, actuators, and network connectivity that enable these objects to collect and exchange data. Source : Wikipedia

IOT Devices Smart Homes Connected Camera Wearable devices Tooth brush Automobile Industry More devices can be found at: http://iotlist.co

Bluetooth Low Energy Broadcaster Wireless protocol operating in 2.4 GHz band with GFSK modulation. Observer Device Observer Device Bluetooth Low Energy Broadcaster Observer Device Observer Device

BLE Packet Preamble Access Address PDU CRC Preamble – 1 byte Access Address – 4 bytes PDU – 0-20 bytes CRC – 3 bytes Add color to the images

Bluetooth Device Address 48 bit unique number, which identifies the device among its peers. Device Address = Manufacture ID + Device ID Manufacture ID= NAP (2 bytes) + UAP (1 byte) DEVICE ID= LAP NAP – non-significant address part UAP – Upper Address part http://standards-oui.ieee.org/oui/oui.txt LAP – Lower Address part

Bluetooth Core Specification Applications Logical Link control & Adaption Protocol(L2CAP) Attribute Protocol Security manager Generic Attribute Profile (GATT) Generic Access Profile (GATT) Host control Interface Key generation in LE is done by host (key generation can be upgraded without the need to change the controller) & in classic by controller. PHY - Contains the analog communications circuitry, capable of modulating and demodulating analog signals and transform them into digital symbols. Link layer Physical layer Direct test mode Source: https://www.bluetooth.com/specifications/bluetooth-core-specification

Generic Attribute Profile - GATT GATT is the backbone of the BLE data transfer as it defines how data is organized and exchanged GATT server Service characteristic Characteristics are defined attribute types that contain a single logical value. characteristic Services are collections of characteristics and relationships to other services that encapsulate the behavior of part of a device. Service characteristic

Example Handle UUID Permission Value Service 0x0021 Service READ HRS Characteristic CHAR READ 0x0026 0x0024 Characteristic 0x0027 CHAR READ bpm

Bluetooth LE Pairing Process Phase-1  Information required for generating the temporary key is exchanged between the master and the slave. Phase-2  The short term key is generated independently on both the ends and the process of encryption is started. Phase-3 Once the connection is secured by encryption and only if bonding is performed, the permanent keys can be distributed for storage and reuse at a later time.

CASE STUDIES

Case Study 1 – Sniffing traffic BLE Device Mobile Device

Case Study 2 – GATT Misconfiguration BLE Device GATTTOOL Initial value - 0a 18 Changed Value – 0b 17

Real-Time Example

Case Study 3 - MiTM 0A:0B:0C:0D:0E:0F Cloning Mac address BLE Device Mobile Device 0A:0B:0C:0D:0E:0F

Case Study 4 – Denial of Service attack l2cap Packets BLE Device Connection request Mobile Device

Thank you Michael Mcneil Ben Kokx Minatee Mishra Maheshan Neelesh swami Anirudh Duggal Pardhiv Reddy Sanjog Panda Archita Sagar Popat Jiggyasu Sharma Narendra Makkena Swaroop Yermalkar Kartik Lalan Abhishikt Chandrakant Nial Audience

QUESTIONS