second presentation of this morning
welcome to the stage Mr yanosh capich
thank you
are you awake for a second to get the
people in
so
um hi everyone my name is Janus capich I
study electrical engineering at bayama
and I work at Bosch with a scholarship
for which my
project is Bluetooth energy security and
in this talk I will
give a presentation about this topic
wow
just so as you may know Bluetooth is
every look we have smart watches smart
locks smartphone surveillance cameras
and but also it's not just things in the
consumer industry
it is also in the automotive sector and
also in the medical industry too
therefore the second English total
should be very important for us
um a quiet current attack was done
on the Tesla
well this was a ble key application
um many intermediate attack so the
attacker could perform this attack by
exporting get messages
sent to the Tesla
key
this just shows that uh stability should
be very important for us also working in
the automotive field
but actually when we talk about
Bluetooth this protocol includes two
protocols the Bluetooth classic and
Bluetooth slow energy
Bluetooth slow energy has a maestro
World slower data rate but it consumes
much less power therefore the most iot
devices use this protocol
um I will give a short overview of on
the Bluetooth device
so application programmers so you can
separate the stack into three sections
the application layer the host layers
and the controller ideas
most Bluetooth low energy application
programmers interact with the
application layer and some host layers
these are mostly the Gap the get and the
SMP layers
Gap generic access profile and as a
discoverability and connectability to a
device
get the genetic attribute protocol
this defines services and
characteristics for an application so
for example that is the heart rate
service the HRS with the characteristics
for the monitoring your BPM so these are
this characteristic and service mean is
mainly used in
SmartWatches for example
so that is the SMP the security manager
layer which secures your connection
but as you may know that that are the
controller layers the link layer and the
physical layer too this gets developed
by the IC manufacturer and vendor
supplier therefore not much attention is
added to this these protocols by the
application developers so that's one
reason we should focus on this
um it is how the link layer message
exchange diagram looks like it's been a
center and a peripheral device
so first the peripheral device sends out
an advertisement message
and then the center device can respond
to this with the scan request message
therefore the
and then the peripheral device responds
to this with the scan response that for
the both devices know of each other
and if the center would like to initiate
a connection it sends out a connection
request message
after that the two devices are connected
and the center becomes the master and
the peripheral becomes the slave
after this the center device can change
parameter
instead of the connection with the
parameter requests then the connection
is secured with SMP messages this is
quite batting and then get service this
uh and get collected messages can be
exchanged
and we'd also like to mention that there
are these type of attacks for the
wireless protocols
um if stopping man in the middle really
they play attack and the OS so denial of
service in this talk I won't go into
much detail about it but I think it's
needed to mention that there are these
type of attacks
for which
um
we should do security testing one of the
most efficient testing methods is
fuzzing so fast testing
we send out random data and check for
failures in the device
with this test we check for the devices
that was Nest so can you tender
unexpected data without a crash
and its Equity is it secured against
buffer the workflow crashing or
deadlocking
passing structure looks like this
firstly that is the message generated
part where
the
random data is generated
we use that on a fuzzing engine which I
developed on top of a Bluetooth
terminology framework
and then the message the random message
is passed the message publisher which
sends out the data to the device under
test
then we monitor this device with Target
monitor which can involve lockers keep
live scripts or have checks
so why would we like to First Link layer
you are this so this link layer exchange
diagram
and you may have noticed that after and
before the pairing there isn't really
any security measure has implemented
therefore this should be focused on by
the by our side
and these messages were linked to your
messages
also most faster tools don't go down to
this layout because as I already
mentioned this layer is developed by the
manufacturer and not the application
developer
and the other research projects with
successful in corrupting the link layer
messages message exchanges
so these are the messages I advanced
and there is a scan request message
connection request and other parameter
request messages
um this test Suite has been designed to
act as a malicious link layer Central
device that sends out invalid requests
to the tested link layer particular
device and we monitor the
boot with Target methods
it is so I already said that we use our
own fuzzing tool the fuzzing engine
which has a smart and on data generation
this means that it has weights added to
the different fields and it uses seating
so we can reproduce the
random data
and on top of this I developed the
skeppy framework which wraps the random
data into a generic link layer message
you can see it there so first it is a
Tempo then the access address then a pdu
and the CSC
in the first paid you because the other
three fields are the necessary to be
correct to keep up the connection
so firstly we choose what message we
would like to fast then we choose that
field to files and then that method then
we can apply collection methods to this
to illustrate this here is an example so
here the first stage is choosing the
message
you can see that each message message
has an added weight to it and
it shows the connection request because
it was I guess it was more likely to be
chosen because the weight was 0.2 of
this message the rank request for
example had a 0.1 weight added to it
in the second stage we the fasting tool
chooses what field it would like to fast
it shows the video type and then it
chooses the method it shows the change
value to maximum method
and then this random data created by the
engine is passed to the message
publisher which was a Nordic device the
NLF 52 dongle
this dongle was also used by the swain2
project
which have the much success and they
created a special firmware for it which
can send out linkedly messages created
by python code
um then we pass this so we send this
message to the Target and we monitor it
I implemented the file logger and the
terminal logo
and in the first step of the phasing we
initialize the doot which means tell me
terminating connections from previous
tests and connect to the device
after that we create the random seed and
start the the fuzzing process and a
message
then during the fasting process health
checks and keep live scripts done a hash
check uses the fact that in the
specification it says that in a
connection phase the device in the
sleeve has to exchange empty PD wood
data type messages periodically so we
can monitor this message to see if the
connection is still there
um for the keeper like the script we
also firstly done a half check and if
it's the health check is passed then we
don't have to do any Keeper Live script
but if it is failed then we should
reconnect to the device if it is
reconnectable and it is it and it hasn't
crashed yet
um here is a demo
I think it should be playable
yeah so here is
how
okay so see it this is how the Tanya
looks during the passing process
with the pink you can see
um the keeper knife scripts and with
yellow you could see the health checks I
think this is quite muggy but you you
can see the main part that it is sending
out random messages the device
and what were the lessons during this
phasing process we tested this fuzzing
tool and see devices Smart Lock smart
light bulb and itag
two of them crashed which meant that you
had to take out the battery and the
insert it to be able to connect to the
device or even advertise send
advertisement message
producer from the peripheral device
and one of them that looked which meant
that the device
stayed in a connection state after the
10 meeting the connection from our
website so it couldn't recognize that
the connection should have been
um that at that point
we can contact the other devices by
adding further implemented further
security this could mean adding a random
Bluetooth address or circling the
pairing process but actually these
findings should be reported to the
Bluetooth seek and you should talk to a
vendor supplier because as I have said
it is this link this link layer is
implemented by the
manufacturer the IC manufacturer and
this problem is actually on their side
mainly
um further developments we'll be making
a device stateful because uh due to slow
energy is the stateful protocol and
having more specific feedback added to
the system will be was priority and also
making it AI based would be cool too
and a bonus topic is
that in the previous my previous Topic
at Bosch was it was a pink on Bluetooth
low energy
data with an SD ad which is a software
defined radio
this means that everything in the
video after the receiver is implemented
by the software
I use the general purpose
software defined video which you could
get like for I think 80 dollars on the
market it was a total SDR and I used
upped on the advertising data on the 2.4
gigahertz and you can see in the right
that I could capture the packets
distinguishable from the noise
which I think is really interesting
because this is a cheap device and you
can implement the software for it in
Google radio which is Block Base so you
don't even have to know programming
languages for it
if you have any questions please ask
them and thank you for listening
any questions from the audience
we have a taker
first of all thanks for the presentation
and my question is that you said that
you crashed two devices and did you find
anything that can be used to break for
example the firmware of the device or
something like that can you repeat it
the last part of the question did you
find anything uh when those device
crashed that can be found that can be
used to break for example the firmware
of these devices
um as I mentioned the feedback tool so
this is an embodied system so making the
feedback part of
the fuzzing tool is not as simple as for
example in other it general purpose
professing tools so this is also a
working topic to have to add more
knowledge after we actually know that
the
it something is crashed we should also
analyze the white clashed so actually we
are now working on this and so for now
the only thing we know that is that the
link layer was corrupted and we are
currently working on analyzing this
okay thank you
so
anybody else
one here
it was the Smart Lock you mentioned
crashed or deadlocked both both yes and
if such a device gets crashed or
deadlocked
um is it possible to open it anyway
without breaking the lock physically
um the deadlock so the lock had a
mechanism that if you try to so it has a
battery and if you try to charge the
battery the connection gets lost in that
instantly so that was its reset
mechanism it's a reset so we could reset
the Smart Lock like that but otherwise
it couldn't be uh
unlocked
so you had to make a hard reset to
unlock it thank you
time for one more
I think that's it you're not thank you
for your excellent presentation this
morning if you can give him a round of
applause
[Applause]