April 2007

There were some pretty interesting things developments during the last few weeks:

Happy hacking. 🙂

The last weeks there where some rumors about “Bluetooth Sniffing for everyone”. Max Moser released a paper in which he is describes how to modify a regular Bluetooth dongle into a full featured Bluetooth Sniffer using Frontline’s FTS4BT software.
The Software is available for free, the firmware you need to convert a Bluetooth dongle into a sniffer comes with the Software. All you need is a serial number to run the Software. The media give the impression that now everybody can easily sniff Bluetooth.

But in fact, Bluetooth Sniffing is not that easy. To successfully sniff Bluetooth connection you always have to know at least one of the Bluetooth addresses used in a piconet. And not only that, you also have to know whether the device is master or slave of the piconet and if it’s inquiry or page scanning.
If the connection is encrypted you even need more information. You need to know the other devices Bluetooth address, too and you have to know the Link Key the two devices are using for their connection. You could obtain the Link Key by sniffing the Pairing Process and then use btcrack to brute force the Link Key. When the two devices are already have been paired you first have to deauthenticate them.

Of course all the information you need would be possible to get, but in fact sniffing Bluetooth is not that easy as sniffing Wi-Fi.
Another point is, that the sniffers used right know don’t seem to work pretty good at distances, therefore you have to be very close to your devices. All in all, even I am not sure if it would help using antennas or not. In my opinion, with state-of-the-art hard- and software it is nearly impossible to successfully implement an eavesdropping attack in field on an encrypted connection.

But let’s see what the future brings. If somebody finds out how the RAW-Packets of the Frontline firmware are passed through HCI it would be possible to use the sniffer hardware with custom software which features scripting making everything easier. Another possible scenario, described earlier in another post might become possible: build a device which can sniff all 79 channels simultaneously. Just take 79 dongles – one dongle for one channel. This way you wouldn’t have to manually synchronize one dongle to the piconet’s hopping sequence.

These are some Bluetooth dongle, which support changing firmware with dfutool and tuning with bccmd. There is no guarantee that they still support flashing and tuning when you buy them, because vendors often tend to change the hardware without further notice.

Fujitsu Siemens

Cellink BTA-6030 Bluetooth Adapter

Other Dongle which seem to work (see comments on this article. not verified.):

Toshiba PA3455U-1BTM
Linksys USBBT100 (newer ones have Broadcom chipset, older ones CSR but only Bluetooth 1.1)
Aircable Host XR

Slides of the Bluetooth Hacking lecture on the Easterhegg 2007 as odp and pdf. I was together with Bastian Ballmann, author of the Bluetooth penetration suite bluediving at the easterhegg workshop weekend in Hamburg. Together we gave an overview on usual and advanced Bluetooth tools, explained how it is possible to crack a Bluetooth Pairing and where the limits of Bluetooth sniffing are. Finally we did some Bluetooth dongle firmware tuning and replaced the firmware on a Bluetooth dongle.

The new Bluetooth specification has been released. Major improvements in power consumption, simplicity of pairing process and security.