Is my toothbrush really smart? Axelle Apvrille Troopers, March - PowerPoint PPT Presentation

Is my toothbrush really smart? Axelle Apvrille Troopers, March 2018

Introduction How it works Virtual toothbrush Smart Toothbrush Cloud Conclusion Troopers March 2018 - A. Apvrille 2/34

Who am I? Anti-virus researcher with Fortinet smart phone, smart things Troopers March 2018 - A. Apvrille 3/34

Why hack a smart toothbrush? 1 Because it’s fun . You’re going to brush your teeth with a Bluetooth dongle , you’re warned :) Troopers March 2018 - A. Apvrille 4/34

Why hack a smart toothbrush? 1 Because it’s fun . You’re going to brush your teeth with a Bluetooth dongle , you’re warned :) 2 Because it’s difficult . Yes, it’s harder than hacking an IP camera . Everybody knows how to telnet on a Linux, huh ;P Troopers March 2018 - A. Apvrille 4/34

Why hack a smart toothbrush? 1 Because it’s fun . You’re going to brush your teeth with a Bluetooth dongle , you’re warned :) 2 Because it’s difficult . Yes, it’s harder than hacking an IP camera . Everybody knows how to telnet on a Linux, huh ;P 3 I want to turn down the myth “nobody cares, there’s nothing to secure in a toothbrush” . All connected devices need some level of security . Troopers March 2018 - A. Apvrille 4/34

Smart toothbrushes? Braun Oral B, Grush Smart toothbrush, Shenzhen Tita, Ningbo Seago SG 976, Kolibree Magik, Ara... Oral B Pro 5000 Kolibree Magik Photo credits: Oral B Photo credits: Kolibree Troopers March 2018 - A. Apvrille 5/34

Smart toothbrushes? Braun Oral B, Grush Smart toothbrush, Shenzhen Tita, Ningbo Seago SG 976, Kolibree Magik, Ara... Oral B Pro 5000 Kolibree Magik For this talk Photo credits: Oral B Photo credits: Kolibree Troopers March 2018 - A. Apvrille 5/34

What for? 1 Motivate and educate kids Troopers March 2018 - A. Apvrille 6/34

What for? 1 Motivate and educate kids 2 And adults Health improvements? Average for brushing teeth is once for 45 to 70 seconds Vendor say their users’ average is twice for 110 seconds Troopers March 2018 - A. Apvrille 6/34

What for? 1 Motivate and educate kids 2 And adults 3 Do business, make money ;P Health improvements? Average for brushing teeth is once for 45 to 70 seconds Vendor say their users’ average is twice for 110 seconds Troopers March 2018 - A. Apvrille 6/34

Dental insurance Commercialized in the USA Employer-based dental insurance You subscribe to a dental plan and receive a smart toothbrush, replacement heads, toothpaste & floss. Impossible to purchase the toothbrush alone . Troopers March 2018 - A. Apvrille 7/34

Introduction How it works Virtual toothbrush Smart Toothbrush Cloud Conclusion Troopers March 2018 - A. Apvrille 8/34

Connecting the toothbrush Smart Mobile app Dental insurance toothbrush Bob Alice BLE HTTP @ Brushing duration, frequency Name, email, dentist, Plan, photo... In-game score Troopers March 2018 - A. Apvrille 9/34

A B luetooth L ow E nergy device An attribute consists of: Toothbrush Service UUID: it is a type e.g. 04234f8e-75b0-4525-9a32- 193d9c899d30 Device Name type Motor Speed . UUID: Value e.g “My smart 833da694-51c5-4418-..., Value: toothbrush” 0xd0, Read, Write Battery Level . UUID: Permissions to access the 6dac0185-e4b7-4a..., Value: attribute 584c, Read. ... Accessed by a handle We can search for attributes, read, 3D Service write, get notifications. ... Troopers March 2018 - A. Apvrille 10/34

How to Speak BLE Read Motor Speed UUID = 833da694-51c... pygattlib read_by_handle( 0x002b ) gatt_read_char( ..., 0x002b, ...) 0x0a 0x002b ATT bluez bluez Handle Read Opcode 0x05 0x04 0a 00 2b L2CAP Length Channel Id Access Data LL CRC 05 04 0a 00 2b Address Header Troopers March 2018 - A. Apvrille 11/34

How to capture BLE Troopers March 2018 - A. Apvrille 12/34

BLE Tools Adafruit Bluefruit sniffer https://www.adafruit.com/product/2269 (25$), Ubertooth https://github.com/greatscottgadgets/ubertooth Adafruit Python BLE Sniffer https: //github.com/adafruit/Adafruit_BLESniffer_Python Bluez http://www.bluez.org/ : Linux Bluetooth protocol stack (see hcitool, gatttool) Python interface to BLE: Bluepy https://github.com/IanHarvey/bluepy , Python interface to GATT: pygattlib https://bitbucket.org/OscarAcena/pygattlib Bleah https://github.com/evilsocket/bleah : BLE scan/read/write Mobile apps: BLE Scanner (BluePixel), nRF Connect (Nordic Semi.) ... Troopers March 2018 - A. Apvrille 13/34

Controlling the toothbrush remotely Demo 1 For Fun 2 To gain independance - DIY Troopers March 2018 - A. Apvrille 14/34

Quadrant buzz is ... a timer 3D service 89bae1fa-2b59-4b06 -919a-8a775081771d Enable notifications: Write Command 0100 Accelerometer No Handle Value Notification (ever) Enable notifications: Write Command 0100 Gyroscope No Handle Value Notification (ever) Toothbrush service Gyroscope and accelerometer are not used in this version The toothbrush cannot know which teeth we brush Troopers March 2018 - A. Apvrille 15/34

Hardware events Toothbrush service Event index Enable notifications N R W Write Command 0100 ... Event index Event 3a N 3b Event 3D service Troopers March 2018 - A. Apvrille 16/34

Hardware events Toothbrush service Event index Use it! Enable notifications N R W Write Command 0100 ... Event index Event 3a Duration: 5s 26-01-2018 N @ 09:52:00 3b Event 3D service Troopers March 2018 - A. Apvrille 16/34

Hardware events Toothbrush service Event index Use it! Handle Notification Value Event index is 0x3a N R W Encrypt packet ... Event index Event 3a Duration: 5s 26-01-2018 N @ 09:52:00 3b Event 3D service Troopers March 2018 - A. Apvrille 16/34

Hardware events Toothbrush service Event index Use it! N R W ... Event index Enable notifications Event 3a Duration: 5s 26-01-2018 N @ 09:52:00 3b Event 3D service Troopers March 2018 - A. Apvrille 16/34

Hardware events Toothbrush service Event index Use it! Write Command N R W Give me index 0x3a! ... Event index Event 3a Duration: 5s 26-01-2018 N @ 09:52:00 3b Event 3D service Troopers March 2018 - A. Apvrille 16/34

Hardware events Toothbrush service Event index Use it! N R W ... Handle Value Notification Event index Event Encrypted event 0x3a 3a Duration: 5s 26-01-2018 N @ 09:52:00 Duration: 5s 3b 26-01-2018 Event @ 09:52:00 3D service Troopers March 2018 - A. Apvrille 16/34

Events demo DEMO 1 Enable event index notification 2 Move toothbrush 3 Decrypt event index notification 4 Enable event notification 5 Query event index 6 Decrypt event notification Troopers March 2018 - A. Apvrille 17/34

Interesting attacks for cyber-criminals? Not many at this point. (But lots of fun). Troopers March 2018 - A. Apvrille 18/34

Interesting attacks for cyber-criminals? Not many at this point. (But lots of fun). Damage victim’s teeth and gums with high motor speed ? Hmmm. Troopers March 2018 - A. Apvrille 18/34

Interesting attacks for cyber-criminals? Not many at this point. (But lots of fun). Damage victim’s teeth and gums with high motor speed ? Hmmm. Remote kill of toothbrush. Okaaaay. Troopers March 2018 - A. Apvrille 18/34

Interesting attacks for cyber-criminals? Not many at this point. (But lots of fun). Damage victim’s teeth and gums with high motor speed ? Hmmm. Remote kill of toothbrush. Okaaaay. Do you mind if we track you? Toothbrush MAC address is fixed (despite specs say how to do it) Troopers March 2018 - A. Apvrille 18/34

Interesting attacks for cyber-criminals? Not many at this point. (But lots of fun). Damage victim’s teeth and gums with high motor speed ? Hmmm. Remote kill of toothbrush. Okaaaay. Do you mind if we track you? Toothbrush MAC address is fixed (despite specs say how to do it) But we’ll see bad design leads to worse later. (Suspens). Troopers March 2018 - A. Apvrille 18/34

Introduction How it works Virtual toothbrush Smart Toothbrush Cloud Conclusion Troopers March 2018 - A. Apvrille 19/34

Summary / Achievements Service : Beam Mobile application Vtesse moteur Bluetooth Low Energy Service : 3D talk2brush Troopers March 2018 - A. Apvrille 20/34

Can we create a fake toothbrush? Bluetooth Low Energy Service : 3D Mobile app Fake toothbrush Troopers March 2018 - A. Apvrille 21/34

Yes, we can! This is a pink smart toothbrush K¨ onig Micro Bluetooth Dongle v4.0 (13 euros) Official mobile app says it is pink :) Troopers March 2018 - A. Apvrille 22/34

How do we do that? var bleno = require(’bleno’); var BlenoPrimaryService = bleno.PrimaryService; JavaScript function ToothbrushService() { ToothbrushService.super_.call(this, { Bleno uuid: ’04234f8e75b045259a32193d9c899d30’, characteristics: [ new bleno.Characteristic({ uuid: ’0971ed14e92949f9925f81f638952193’, Node JS properties: [’read’], value : colorRead, }), function colorRead(offset, callback) { // 02 = pink console.log(’reading toothbrush color’); callback(this.RESULT_SUCCESS, new Buffer(’02’,’hex’ } Troopers March 2018 - A. Apvrille 23/34

A Fake Toothbrush: Is that useful? To brush your teeth? No ;-) Troopers March 2018 - A. Apvrille 24/34