Bluetooth: With Low Energy Comes Low Security Mike Ryan iSEC - - PowerPoint PPT Presentation

▶
bluetooth with low energy comes low security
SMART_READER_LITE
LIVE PREVIEW

Bluetooth: With Low Energy Comes Low Security Mike Ryan iSEC - - PowerPoint PPT Presentation

Apr 25, 2023 10 likes •571 views

Bluetooth: With Low Energy Comes Low Security Mike Ryan iSEC Partners USENIX Security / WOOT Aug 13, 2013 1 Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013 Outline What is Bluetooth Low Energy? Protocol overview

slide-1
SLIDE 1

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

1

Bluetooth: Mike Ryan

iSEC Partners

USENIX Security / WOOT

Aug 13, 2013

With Low Energy Comes Low Security

slide-2
SLIDE 2

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

2

Outline

⇀What is Bluetooth Low Energy? ⇀Protocol overview ⇀Sniffing Techniques ⇀[In]security ⇀Injection

slide-3
SLIDE 3

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

3

Outline

⇀What is Bluetooth Low Energy? ⇀Protocol overview ⇀Sniffing Techniques ⇀[In]security ⇀Injection

slide-4
SLIDE 4

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

4

What is Bluetooth Low Energy?

slide-5
SLIDE 5

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

5

What is Bluetooth Low Energy Smart?

⇀ New modulation and link layer for low-power devices ⇀ vs classic Bluetooth ⇁ Incompatible with classic Bluetooth devices ⇁ PHY and link layer almost completely different ⇁ High-level protocols reused (L2CAP, ATT) ⇀ Introduced in Bluetooth 4.0 (2010) ⇀ AKA BTLE

slide-6
SLIDE 6

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

6

Where is BTLE?

⇀ High end smartphones ⇀ Sports / fitness devices ⇀ Door locks ⇀ Upcoming medical devices

slide-7
SLIDE 7

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

7

By The Numbers

⇀ 186% YoY Growth for H1 2013

1

⇀ “over 7 million Bluetooth Smart ICs were estimated to

have shipped for use in sports and fitness devices in the first half of 2013 alone”

⇀ “Analysts Forecast Bluetooth Smart to Lead Market

Share in Wireless Medical and Fitness Devices”

2

1http://www.bluetooth.com/Pages/Press-Releases-Detail.aspx?ItemID=170 2http://www.bluetooth.com/Pages/Press-Releases-Detail.aspx?ItemID=165

slide-8
SLIDE 8

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

8

Outline

⇀What is Bluetooth Low Energy? ⇀Protocol overview ⇀Sniffing Techniques ⇀[In]security ⇀Injection

slide-9
SLIDE 9

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

9

Protocol Stack

GATT ATT L2CAP Link Layer PHY

slide-10
SLIDE 10

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

10

PHY Layer

⇀ GFSK, +/- 250 kHz, 1 Mbit/sec ⇀ 40 channels in 2.4 GHz ⇀ Hopping

slide-11
SLIDE 11

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

11

Physical Channels

⇀ Advertising:

3 channels

⇀ Data:

37 channels

slide-12
SLIDE 12

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

12

Hopping

⇀ Hop along 37 data channels ⇀ One data packet per channel ⇀ Next channel

channel + hop increment (mod 37) ≡

⇀ Time between hops: hop interval

3 → 10 → 17 → 24 → 31 → 1 → 8 → 15 → …

hop increment = 7

slide-13
SLIDE 13

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

13

Link Layer

  • PDU min of 2 bytes due to 2 byte header
  • LLID: Control vs Data
  • Length
slide-14
SLIDE 14

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

14

L2CAP and Beyond

⇀ Use existing decoders for this ⇀ Not a Hard Problem

TM

slide-15
SLIDE 15

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

15

Recap

GATT ATT L2CAP Link Layer PHY

slide-16
SLIDE 16

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

16

Outline

⇀What is Bluetooth Low Energy? ⇀Protocol overview ⇀Sniffing Techniques ⇀[In]security ⇀Injection

slide-17
SLIDE 17

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

17

slide-18
SLIDE 18

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

18

slide-19
SLIDE 19

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

19

How do we sniff it?

Start at the bottom and work our way up:

GATT ATT L2CAP Link Layer PHY → → Ubertooth → PC → →

slide-20
SLIDE 20

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

20

Ubertooth Block Diagram

CC2591 RF Amp CC2400 Radio LPC175x ARM MCU

RF Bits USB PHY layer RF↔Bits Link layer Bits↔Packets Packets

slide-21
SLIDE 21

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

21

Capturing: PHY Layer

⇀ Configure CC2400 ⇁ Set modulation parameters to match Bluetooth Smart ⇁ Tune to proper channel ⇀ Follow connections according to hop pattern ⇁ Hop increment and hop interval, sniffed from connect

packet or recovered in promiscuous mode

⇀ Hand off bits to ARM MCU

slide-22
SLIDE 22

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

22

What Info Do We Need?

⇀ Access Address ⇁ Advertising: Fixed 0x8E89BED6 ⇁ Connection: Varies ⇀ Channel number ⇁ Hop interval ⇁ Hop increment ⇀ Nice to have: CRCInit

Where? Easy mode: Connect packet!

slide-23
SLIDE 23

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

23

Link Layer

What we know: Access Address What we have: Sea of bits What we want: Start of PDU

10001110111101010101 10011100000100011001 11100100110100011101

CC2400 does this

FO FREE

slide-24
SLIDE 24

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

24

PHY Layer.. Link Layer..

We converted RF to packets Now what?

slide-25
SLIDE 25

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

25

Capturing Packets... To PCAP!

⇀ ubertooth-btle speaks packets ⇀ libpcap → dump raw packet data ⇀ PPI header (similar airodump-ng and kismet) ⇀ We have a DLT for Bluetooth Smart ⇁ Unique identifier for the protocol ⇁ Public release of Wireshark plugin Coming Soon

TM

slide-26
SLIDE 26

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

26

Wireshark Awesomeness

slide-27
SLIDE 27

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

27

Promiscuous Mode

⇀ Techniques for recovering ⇁ Access Address ⇁ CRCInit ⇁ Hop Interval ⇁ Hop Increment

slide-28
SLIDE 28

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

28

Recovering Access Address

⇀ Sit on data channel waiting for empty data

packets

⇀ Collect candidate AA's and pick one when it's

been observed enough

10001110111101010101 10011100000100011001 10000000000000001101 10100011000110000101

Not depicted: whitening!

slide-29
SLIDE 29

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

29

Recovering CRCInit

⇀ Filter packets by Access Address ⇀ Plug CRC into LFSR and run it backward

See also “Bluesniff: Eve meets Alice and Bluetooth”, USENIX WOOT '07

slide-30
SLIDE 30

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

30

Recovering Hop Interval

⇀ Observation: 37 is prime ⇀ Sit on data channel and wait for two

consecutive packets

Δt 37 =hopinterval

slide-31
SLIDE 31

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

31

Recovering Hop Increment

⇀ Start on data channel 0, jump to data channel 1 when a

packet arrives

⇀ We know hop interval, so we can calculate how many

channels were hopped between 0 and 1

slide-32
SLIDE 32

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

32

Recovering Hop Increment (math)

0 + hopIncrement × channelsHopped 1 (mod 37) ≡ hopIncrement channelsHopped ≡

  • 1 (mod 37)

channelsHoppped

  • 1

channelsHopped ≡

37-2 (mod 37)

We use a LUT to convert that to hop increment

slide-33
SLIDE 33

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

33

Sniffing Summary

⇀ Connection following ⇀ Promiscuous: Recovering the four values ⇁ Access address ⇁ CRCInit ⇁ Hop interval ⇁ Hop Increment

slide-34
SLIDE 34

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

34

Outline

⇀What is Bluetooth Low Energy? ⇀Protocol overview ⇀Sniffing Techniques ⇀[In]security ⇀Injection

slide-35
SLIDE 35

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

35

Encryption

⇀ Provided by link layer ⇀ Encrypts and MACs PDU ⇀ AES-CCM

↓↓↓↓↓↓

slide-36
SLIDE 36

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

36

Custom Key Exchange Protocol

⇀ Three stage process ⇀ 3 pairing methods ⇁ Just Works

TM

⇁ 6-digit PIN ⇁ OOB ⇀ “None of the pairing methods provide protection

against a passive eavesdropper” -Bluetooth Core Spec

slide-37
SLIDE 37

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

37

Cracking the TK

confirm = AES(TK, AES(TK, rand XOR p1) XOR p2) GREEN = we have it RED = we want it

TK: integer between 0 and 999,999 Just WorksTM: always 0!

slide-38
SLIDE 38

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

38

Cracking the TK – With crackle

Total time to crack: < 1 second

slide-39
SLIDE 39

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

39

And That's It

⇀ TK → STK ⇀ STK → LTK ⇀ LTK → Session keys

KEY EXCHANGE = BR0KEN 100% PASSIVE

slide-40
SLIDE 40

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

40

LTK Reuse

⇀ Good for security: pair in a faraday cage ⇀ Counter-mitigation: Active attack to force re-pairing

slide-41
SLIDE 41

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

41

Decrypting

⇀ Assumption: Attacker has LTK – reused! ⇀ Procedure ⇁ Attacker passively capturing packets ⇁ Connection established ⇁ Session information captured

slide-42
SLIDE 42

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

42

Decrypting – With crackle

⇀ Yes, crackle does that too! ⇀ crackle will decrypt ⇁ a PCAP file with a pairing setup ⇁ a PCAP file with an encrypted session, given an LTK

slide-43
SLIDE 43

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

43

Am I Affected?

⇀ Probably ⇀ Exception: Some vendors implement their own

security on top of GATT

⇁ Did they talk to a cryptographer?

slide-44
SLIDE 44

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

44

Security Recap

⇀ Key exchange broken ⇀ LTK reuse means all communication is effectively

compromised

⇀ 99% passive ⇁ Worst case scenario: one active attack with off-the-shelf

hardware

slide-45
SLIDE 45

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

45

Outline

⇀What is Bluetooth Low Energy? ⇀Protocol overview ⇀Sniffing Techniques ⇀[In]security ⇀Injection

slide-46
SLIDE 46

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

46

Injection

⇀ Pretty much the same as receiving, opposite direction ⇀ Follow the spec! ⇁ Link layer header ⇁ Payload data ⇀ Hand that off to Ubertooth ⇁ Calculate CRC ⇁ Whiten ⇀ Devil is in the CC2400 details

slide-47
SLIDE 47

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

47

Demo

⇀ D ⇁ e

  • m

– o

slide-48
SLIDE 48

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

48

Capabilities

⇀ Ubertooth ⇁ Passively intercept Bluetooth Smart ⇁ Promiscuous mode ⇁ Injection ⇀ Wireshark plugins ⇀ crackle ⇁ Crack TK's sniffed with Ubertooth ⇁ Decrypt PCAP files with LTK

slide-49
SLIDE 49

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

49

Software

⇀ Ubertooth and libbtbb ⇁ http:/

/ubertooth.sourceforge.net/

⇀ crackle ⇁ http:/

/lacklustre.net/projects/crackle/

⇀ nano-ecc (8-bit ECDH and ECDSA) ⇁ https:/

/github.com/iSECPartners/nano-ecc

slide-50
SLIDE 50

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

50

Thanks

Mike Ossmann Dominic Spill Mike Kershaw (dragorn) #ubertooth on freenode bluez Bluetooth SIG USENIX iSEC Partners

slide-51
SLIDE 51

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

51

Thank You

Mike Ryan

iSEC Partners @mpeg4codec mikeryan@isecpartners.com http:/ /lacklustre.net/

slide-52
SLIDE 52

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

52

Apocrypha (extra)

0x1FFEFFFC00: remove channels 12, 27-36

slide-53
SLIDE 53

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

53

Encryption Mitigation (extra)

⇀ Every session uses a different session key ⇀ Every session uses several nonces

Solution: jam the connection to restart a session

⇀ LTK exchanged once, used many times

Solution: inject LTK_REJECT_IND message

slide-54
SLIDE 54

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

54

L2CAP (extra)

slide-55
SLIDE 55

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

55

ATT/GATT (extra)

⇀ Services: groups of characteristics ⇀ Characteristics ⇁ Operations ⇀ Everything identified by UUID ⇁ 128 bit ⇁ Sometimes shortened to 16 bits

slide-56
SLIDE 56

Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013

56

Example GATT Service: Heart Rate (extra)

⇀ Service: 0x180D ⇀ Characteristic 1: 0x2A37 – Heart Rate ⇁ Can't read or write ⇁ Notify: subscribe to updates ⇀ Characteristic 2: 0x2A38 – Sensor Location ⇁ Readable: 8 bit int, standardized list ⇀ Other characteristics: 0x2803, 0x2902, ...