Bluetooth Hacking: Tools And Techniques | Mike Ryan | hardwear.io USA 2019

Talk Abstract:
This talk by Mike Ryan described how to reverse engineer Bluetooth data on a variety of devices including a heart monitor, a padlock, a music listening device, a Bluetooth credit card, and a Bluetooth-controlled skateboard. Although the techniques depended on physical access to the device (attacks that did not have this access would require a protocol sniffer), it was an exciting demonstration of how to extract Bluetooth data from the device before it goes out to the air. And that said, the threat model for some Bluetooth devices (such as that credit card) should assume that someone will be handling those devices out of your sight.
About Presenter:
Mike Ryan is a noted expert on Bluetooth security. He has discovered several Bluetooth-related CVEs: CVE-2018-9119 (stealing credit card numbers via Bluetooth), CVE-2014-4428 (affecting OS X, iOS, and Apple TV), and along with Richo Healey discovered CVE-2015-2249 (affecting Boosted electric skateboards). In 2016 Mike founded ICE9 Consulting to address the increasing demand for security reviews of IoT devices. Mike's personal motto is "if you like it, you shoulda put Bluetooth on it."
#BluetoothHacking #Security #IoT
------------------------------------------------------------------------------------
Website: hardwear.io
Follow hardwear.io on Twitter: / hardwear_io .
Follow hardwear.io on Facebook: / hardwear.io
-------------------------------------------------------------------------------------

[@christopherpetrov2355]

Can use use Raspi bluetooth to sniff psockets??

[@DELREYGUY]

I bought a Bluetooth FM transmitter direct from China and the language prompts are only available in Chinese. Can I hack the unit to speak English?

[@abdullahnaina5225]

How does he decrypt the ble blood pressure monitor values? Is it encrypted? What encryption algorithm is this?

[@midnitekisses9559]

How close do you have to be to the target device?

[@punkpendulums]

10:33 enable HCI snoop log

[@mohammedal-shaboti7939]

Great, but you didn't mention where to find this log file, I couldn't find it. seems it need to use ADB or something else.

[@Diogo154677]

source.android.com/devices/bluetooth/verifying_debugging#debugging-with-bug-reports

[@katikati39]

You should see how easy is doing all of that with BLE:Bit lol

[@declanahern1736]

Hi, I am trying to deveop a system that captures heart rate data and forwards to a smart bulb as a warning i.e red = bad. I am unable to see my polar h7 device data, I am using rasbian on a raspberry pi 3. How have set up wireshark to capture tha data as you have above?

[@teclishighelf5787]

This method only sniffs packets going to your device. Its not promiscuous mode.

[@EricSanchez-qs3bi]

Great job 9999 % guy

[@punkpendulums]

05:08 how can you pretend it's 100% reliable if you never tried it and if apparently three people in the world only have already used it ?

[@ABlackScreenASMR]

Who is this talk for.. 2:24 bluetooth device developers *nods* penetration testers *nods* managers *nods* me *smiles* Old man that wants in on ur moms phone calls *smiles* Fake FBI service van *Smiles*

[@Parrotassassin15TechToker]

😂😂😂😂

[@conforzo]

Guy who wants to sleep at 6AM but the corridor above plays horrible EDM music *cries*

[@EricSanchez-qs3bi]

Bingo

[@EricSanchez-qs3bi]

Or cut off a person or persons payroll

[@EricSanchez-qs3bi]

Rabel

[@sophiawilson1934]

Bluetooth in 2020?

[@Parrotassassin15TechToker]

Yeah so many things use it and bluetooth is already inherently unsecure

[@EricSanchez-qs3bi]

Ring bell

[@EricSanchez-qs3bi]

Sit stat ea fee er table

[@EricSanchez-qs3bi]

Cant be a 1000 only the lord is perfect

[@bluegizmo1983]

This really should've been called "Reverse engineering Bluetooth devices", not hacking Bluetooth! Everything talked about here requires being already paired to the devices, that's not hacking. Hacking would be doing all this WITHOUT being paired to the devices and without having physical access to the devices.

[@alabamalockpicking]

Hardware hacking is having physical access to the device and still hacking it

[@cvoges12]

> I've learned everything I know about TCP/IP from wireshark We can tell

[@mistermister8]

50 minutes of your life you'll never get back.

[@Parrotassassin15TechToker]

How so