SEARCH
TOOLBOX
LANGUAGES
Difference between revisions of "Hacking Bluetooth Smart locks"

Difference between revisions of "Hacking Bluetooth Smart locks"

From BruCON 2017

Jump to: navigation, search
(Created page with "Recently it seems our home/car/bicycle locks have started to follow a new trend: to include a BLE chip inside to make them "smart". Unlike smart toothbrushes, socks or kettle...")
 
Line 6: Line 6:
  
 
Our live hacking session will cover among others:
 
Our live hacking session will cover among others:
Lack of link-layer encryption and possible MITM scenarios
+
Lack of link-layer encryption and possible MITM scenarios, Passive sniffing, Static authentication password, Spoofing, Replay attacks, Command injection, Denial of Service, Cracking "own PKI", Other flaws of custom challenge-response, authentication, Abusing excessive services (e.g. module’s default AT-command interface), Sharing keys weaknesses.
Passive sniffing
 
Static authentication password
 
Spoofing
 
Replay attacks
 
Command injection
 
Denial of Service
 
Cracking "own PKI"
 
Other flaws of custom challenge-response authentication
 
Abusing excessive services (e.g. module’s default AT-command interface).
 
Sharing keys weaknesses
 
  
 
You will also get familiar with an open-source, deliberately vulnerable BLE Hackmelock developed by author. The device can be simulated on your Raspberry Pi, Linux or Mac and along with an enclosed Android application, provides for various levels of challenges to help you to further practice BLE hacking at home.
 
You will also get familiar with an open-source, deliberately vulnerable BLE Hackmelock developed by author. The device can be simulated on your Raspberry Pi, Linux or Mac and along with an enclosed Android application, provides for various levels of challenges to help you to further practice BLE hacking at home.

Revision as of 22:56, 1 July 2017

Recently it seems our home/car/bicycle locks have started to follow a new trend: to include a BLE chip inside to make them "smart".

Unlike smart toothbrushes, socks or kettles, locks guard our safety, and their security should be much more of a concern. Vendors promise "military-grade level of security", "128-bit encryption" and "cryptographic key exchange protocol" using "latest PKI technology". However, recent disclosures of multiple vulnerabilities in smart locks clearly contradict the assurances on the actual security provided, and raise the question of whether these devices have passed any independent security assessments at all!

Bring your Kali Linux installs with your own BLE dongle and/or Bluetooth sniffing hardware of choice, and we’ll go about hacking at least 7 various smart locks. You will learn how to intercept, analyze, find vulnerabilities in such devices. You will get familiar with available tools, including GATTacker Bluetooth Smart Man-in-the-Middle proxy presented at BH16 from its own creator.

Our live hacking session will cover among others: Lack of link-layer encryption and possible MITM scenarios, Passive sniffing, Static authentication password, Spoofing, Replay attacks, Command injection, Denial of Service, Cracking "own PKI", Other flaws of custom challenge-response, authentication, Abusing excessive services (e.g. module’s default AT-command interface), Sharing keys weaknesses.

You will also get familiar with an open-source, deliberately vulnerable BLE Hackmelock developed by author. The device can be simulated on your Raspberry Pi, Linux or Mac and along with an enclosed Android application, provides for various levels of challenges to help you to further practice BLE hacking at home.