Difference between revisions of "Hacking Bluetooth Smart locks"

Revision as of 21:54, 1 July 2017

Recently it seems our home/car/bicycle locks have started to follow a new trend: to include a BLE chip inside to make them "smart".

Unlike smart toothbrushes, socks or kettles, locks guard our safety, and their security should be much more of a concern. Vendors promise "military-grade level of security", "128-bit encryption" and "cryptographic key exchange protocol" using "latest PKI technology". However, recent disclosures of multiple vulnerabilities in smart locks clearly contradict the assurances on the actual security provided, and raise the question of whether these devices have passed any independent security assessments at all!

Bring your Kali Linux installs with your own BLE dongle and/or Bluetooth sniffing hardware of choice, and we’ll go about hacking at least 7 various smart locks. You will learn how to intercept, analyze, find vulnerabilities in such devices. You will get familiar with available tools, including GATTacker Bluetooth Smart Man-in-the-Middle proxy presented at BH16 from its own creator.

Our live hacking session will cover among others: Lack of link-layer encryption and possible MITM scenarios Passive sniffing Static authentication password Spoofing Replay attacks Command injection Denial of Service Cracking "own PKI" Other flaws of custom challenge-response authentication Abusing excessive services (e.g. module’s default AT-command interface). Sharing keys weaknesses

You will also get familiar with an open-source, deliberately vulnerable BLE Hackmelock developed by author. The device can be simulated on your Raspberry Pi, Linux or Mac and along with an enclosed Android application, provides for various levels of challenges to help you to further practice BLE hacking at home.