Bluetooth Low Energy Swiss-Army Knife | Hacker News Reader

Bluetooth Low Energy Swiss-Army Knife

github.com

107 pointsokket25 comments

Using Hacker News as a mechanical engineer with not much interest in software sometimes leads to cases where I misinterpret article titles.

I was very excited to find out how and why anybody would put BLE into a literal multi tool!

> Person 1: BLE in a Swiss-Army Knife.. what can you do with that?

> Person 2: Take a look.

"Your Swiss-Army Knife is now connected"

> Person 1: Nice.

> Person 2: Nice.

Oh look, it's downloading a software update!

Imagine it connects to your phone and reports temperature, tilt, humidity, its location, works as a compass (Why not use the phone directly? Well maybe I need to monitor the trailer I am trying to get level as I adjust the front wheel?)

Haha, looks like Victorinox did actually propose a "Presentation Pro" which was to include a bluetooth remote for powerpoint presentations. Doesn't seem to be for sale on the Victorinox website though.

https://www.engadget.com/2009/01/09/victorinox-presentation-...

Electrical engineer here: and I also read the title, wondering who would 'put BLE into a literal multi tool!' :-)

I thought "someone must already have done that", and sure enough: http://www.dailymail.co.uk/sciencetech/article-1111407/Cutti...

(like all the larger Swiss Army knives, it's a gimmick.)

I’ve only used Ubertooth [0] to sniff BLE. I was not very impressed with its ability to follow connections (it would frequently miss the connection exchange due to channel hopping).

Can using multiple micro:bits at once with BTLEJack increase the success rate?

Most BLE diagnostic equipment that guarantees capture of all traffic costs over $10k.

[0] - https://github.com/greatscottgadgets/ubertooth

Same here. We've been using Ubertooth One and it was not a pleasant experience. Certainly cheap and easy to set up, but with very mixed results. Not only does it miss connections due to the channel hopping, it also frequently loses connections, which is even more frustrating.

We've had the privilege to know someone with a professional wide-band solution (Ellisys Bluetooth Explorer), and it was miles ahead, including the analysis software.

Disclaimer: I am not in any way affiliated with Ellisys.

I've used a professional wideband BLE analyser before (I can't remember which one unfortunately) and while it was a few thousand pounds, I don't think it cost as much as $10k.

Also I've used Nordic's sniffer program before and it worked well and is free (plus a very small amount for the hardware). Windows only though.

Are ble connections neither encrypted nor authenticated? How on Earth does the connection hijacking work so simplistically?

My understanding is the initial handshake is not terribly secure, and sniffers watching that can obtain the long term key used by the pair forever.

But I gather a third party can force a handshake refresh at will, which may be what they're doing here. Code's available. : )

False, basically on every count.

This attack has zero effect on connections established using mitm-protected paring method. This attack is a non-event to any device that follows proper security design as per BT spec

There are vulnerabilities in the "standard" LE pairing, even with MITM, that make these things possible.

Fixed with the BT LE Secure Connections key exchange, but many devices don't implement that

Please cite

https://www.digikey.com/eewiki/display/Wireless/A+Basic+Intr...

(Heading: Pairing Methods for LE Secure Connections (4.2 devices only))

That talks about 4.2 pairing methods. I'm looking for a citation claiming that 4.1 pairing method is in any way insecure

> BLE 4.2 adds 'Secure Connections'. This is apparently also broken and what's more it was broken in 2008 when the same pairing method was used in Bluetooth 2.1!! It doesn't totally break pairing - only the passkey entry method - and you only learn the passkey, not the LTK. But it does allow an attacker to perform a MitM attack if the passkey isn't changed for every pairing attempt.

https://devzone.nordicsemi.com/f/nordic-q-a/14481/secure-ble...

Are you talking about the pairing protection that came in with 4.2 - released as a standard 2014-12?

I'd have to check versions of my LE BT gear, but I'd expect most of it is more than 4 years old. Earlier versions had some security on the handshake, but AFAIK just how secure that was depends on how cautious/competent the vendor was.

Happy to get more insightful information from you.

Hehe.

Not even looking at the code:

1. See a BLE connection in place.

2. Get address information.

3. Jam connection.

4. Watch re-authentication.

5. Use observed authentication.

They are both, if either side requests it. If you do not, you deserve what you get.

Ok that makes sense. I'm resisting to urge to hack my Vivosmart.

Would this work on Tesla Model 3's phone key system?

https://www.tesla.com/support/model-3#phone-key

Cool! I have been using a Nordic BLE sniffer for reverse engineering fitness bands, which is awful because it's only half duplex. Can't wait to try this out.

Reply on news.ycombinator.com