, 00:00:04:00 ,I'm here to talk about Blucat.
, 00:00:06:03 ,Who's heard about Blucat so far?
, 00:00:06:14
, 00:00:07:15 ,Awesome.
, 00:00:08:23
, 00:00:11:13 ,I'm Joseph Paul Cohen.
, 00:00:12:13 ,I'm a Ph.D.
, 00:00:13:21 ,student at U Mass Boston.
, 00:00:14:14 ,I do a side thing basically
, 00:00:17:29 ,a Cybersecurity computer science education.
, 00:00:21:23 ,Do a lot of machine learning and computer vision stuff so it's kind
, 00:00:24:11 ,of dual tracks, right?
, 00:00:26:00 ,So this is the fun stuff.
, 00:00:28:08
, 00:00:29:18 ,So I want to just have some questions
, 00:00:31:20 ,to gauge the audience, right?
, 00:00:33:22 ,So how many of you guys have used Bluetooth API
, 00:00:37:24 ,whether it's blues, OSX or Windows or whatever?
, 00:00:38:01
, 00:00:39:02 ,Okay.
, 00:00:40:01
, 00:00:42:23 ,Who's used netcat to talk to a web server?
, 00:00:42:29
, 00:00:44:07 ,All right.
, 00:00:45:07 ,So that's half.
, 00:00:46:09 ,Okay.
, 00:00:48:24 ,Who's created an outrageously complex script
, 00:00:50:29 ,to do some task?
, 00:00:52:06 ,Okay.
, 00:00:55:24 ,So these are kind of all going to come together in this talk.
, 00:00:56:03
, 00:00:58:01 ,It seems like everyone is well versed.
, 00:00:58:07
, 00:01:00:25 ,The overview of sessions of this we're going to talk
, 00:01:03:27 ,about streams and how they're awesome and fundamental
, 00:01:06:23 ,and how Blucat how you can replace Blucat in line
, 00:01:09:15 ,with wherever you use netcat.
, 00:01:09:26
, 00:01:13:14 ,Any situation you can think about using netcat over an IP address,
, 00:01:16:15 ,with Blucat you replace the IP addresses with Macs
, 00:01:19:27 ,and then you just have to be in range.
, 00:01:20:02
, 00:01:25:03 ,And we also have Blucat as Bluetooth and map so we do
, 00:01:30:17 ,scanning and service discovery functions.
, 00:01:35:06 ,And then basically, I wanted to talk about RF com and zoom cat.
, 00:01:38:02 ,Those are understood by Blucat because they make sense.
, 00:01:41:00 ,You have port numbers and you can talk to them directly.
, 00:01:41:10
, 00:01:44:06 ,And then we're going to look at some devices like Blucat
, 00:01:47:24 ,and see how you examine other devices with Blucat.
, 00:01:49:24
, 00:01:55:07 ,How to prototype and stats and then if we have time, the architecture
, 00:02:00:11 ,of how Blucat works on tons of architectures, right?
, 00:02:01:28 ,So first, streams are awesome.
, 00:02:03:09 ,So I hope everyone agrees.
, 00:02:03:22
, 00:02:06:26 ,You can take something like a file and you can turn it into stream
, 00:02:09:22 ,and you can pipe it into VLC and abstract everything that has
, 00:02:12:16 ,to do with a computer to a stream.
, 00:02:17:21 ,So once it becomes a stream, really don't care where it goes.
, 00:02:17:29
, 00:02:19:25 ,But you know, we use streams every day when we talk
, 00:02:21:12 ,to pal talk.
, 00:02:23:09 ,So every time you go on.
, 00:02:25:15
, 00:02:26:24 ,Okay.
, 00:02:32:10
, 00:02:35:07 ,Well, Blucat was supposed to be on.
, 00:02:38:24 ,But I was I didn't want to broadcast my Mac to everyone.
, 00:02:40:06 ,But I did when I was pairing.
, 00:02:42:21 ,Anyway, you have a computer.
, 00:02:44:23 ,And it turns into a stream and you can turn it into pal talk
, 00:02:46:18 ,and back, right?
, 00:02:48:07 ,So that's how that kind of communication works
, 00:02:50:26 ,like most things are based there.
, 00:02:53:17 ,So you can put some kind of block in the middle and then you don't care
, 00:02:56:01 ,what happens on the other side.
, 00:02:56:07
, 00:02:58:11 ,Inside this block, right?
, 00:02:58:21
, 00:03:00:13 ,The computer just talks to this thing and
, 00:03:04:05 ,at the other side it's going to come out to pal talk and from that side,
, 00:03:06:23 ,the responses go into this you know, blob and come
, 00:03:09:04 ,out the other side to you.
, 00:03:11:27 ,And you don't really have to care what's inside there.
, 00:03:13:26 ,It gets abstracted with all the layers.
, 00:03:16:03 ,So the Internet would work.
, 00:03:17:08 ,Send some stream.
, 00:03:19:09 ,It goes through a series of tubes and comes out the other side
, 00:03:21:15 ,and you don't really care.
, 00:03:21:21
, 00:03:25:12 ,So you take a complicated process like routing all the way
, 00:03:29:19 ,across the Internet and just forget about it.
, 00:03:30:19 ,Right?
, 00:03:31:29 ,Have someone else kind of take that initiative and you just deal
, 00:03:34:12 ,with high level application stuff.
, 00:03:34:17
, 00:03:38:17 ,So you can abstract really complicated things and just kind of ignore that
, 00:03:42:15 ,they exist no matter how dysfunctional they are.
, 00:03:48:13 ,So it to really appreciate the usage of just talking to these services, right,
, 00:03:51:24 ,we can take a look at HTTP.
, 00:03:51:29
, 00:03:54:14 ,So just want to go over this simple, make sure everyone's
, 00:03:56:08 ,on the same page.
, 00:03:56:21
, 00:03:58:03 ,HTTP is awesome.
, 00:03:59:11 ,Simple, human readable.
, 00:04:02:23 ,You can know what's going on by reading traces.
, 00:04:03:04
, 00:04:05:09 ,Debugging is easy, you can look right at it in any kind
, 00:04:08:06 ,of debugger and you don't have to read the spec, you can see
, 00:04:09:28 ,all this stuff.
, 00:04:12:19
, 00:04:17:22 ,You can add custom stuff so it's not really so picky.
, 00:04:17:29
, 00:04:21:20 ,You know, with what inputs and outputs it does.
, 00:04:22:04
, 00:04:23:26 ,So it's very forgiving.
, 00:04:27:20 ,Here's a diagram I didn't make from a browser.
, 00:04:30:24 ,You can send an HTTP request to a server and you get a response
, 00:04:34:13 ,and you can think of it as a tiny text file.
, 00:04:34:26
, 00:04:36:00 ,Bunch of strings.
, 00:04:36:15
, 00:04:39:00 ,And then you get back the same thing.
, 00:04:40:00 ,Right?
, 00:04:42:03 ,And that's the basic interaction, right?
, 00:04:43:15 ,So you can experiment, you just type string get
, 00:04:46:19 ,and you get back whatever response.
, 00:04:48:00
, 00:04:52:00 ,So here's one for DEF CON so we do get/HTTP tell it
, 00:04:56:00 ,we want the DEF CON host and it's going to say okay
, 00:05:01:07 ,with all the other headers and send us back the HTML.
, 00:05:03:13 ,We can look at the underlying protocol but look
, 00:05:07:16 ,at the ports it goes under based on the port on the server that
, 00:05:09:24 ,is for HTTP, right?
, 00:05:10:10
, 00:05:13:02 ,So that's nice to inspect.
, 00:05:17:10 ,And then if you think about it, the image of the matrix is true.
, 00:05:17:22
, 00:05:21:01 ,Everything is just streams flowing back and forth all the time.
, 00:05:21:23
, 00:05:25:02 ,So at some point maybe this will be how everything looks when you
, 00:05:27:14 ,start looking at everything.
, 00:05:30:18 ,So maybe everyone is right there, most likely.
, 00:05:32:24 ,So what is Blucat?
, 00:05:32:29
, 00:05:35:02 ,So what is the point of this?
, 00:05:38:21 ,So there are three main things I've been able to come up with reasons why.
, 00:05:41:02 ,Debugging tool for Bluetooth applications.
, 00:05:42:29 ,So, if you're writing a Bluetooth app, you can use it
, 00:05:47:10 ,to debug your own application, you can see what's going on.
, 00:05:50:04 ,Like did you modify the service record properly so that
, 00:05:53:29 ,other devices can see that record, right?
, 00:05:55:29 ,And then whatever process is handling the socket
, 00:06:00:15 ,on the other side, you don't want to have a full blown client ready.
, 00:06:03:12 ,You might just want to have a makeshift client to see what
, 00:06:07:02 ,is going on or if you want to do some sort of emulation
, 00:06:10:17 ,or testing with inputs that you wouldn't normally put
, 00:06:14:03 ,into your client application, so, if you kind of want
, 00:06:16:14 ,to fuzz your own app, you can do that
, 00:06:20:01 ,with this and it's not a big overhead.
, 00:06:20:06
, 00:06:22:29 ,You can use it as a device exploration tool.
, 00:06:26:17 ,So other people's devices, other people's services that are written.
, 00:06:28:00 ,So your phone's services.
, 00:06:29:17 ,Because there are tons of them.
, 00:06:32:00 ,And they vary on different types of phones, you have old phones
, 00:06:33:23 ,with insecure services, new phones
, 00:06:36:29 ,with sophisticated services and different manufacturers have
, 00:06:39:00 ,different services.
, 00:06:39:22
, 00:06:42:17 ,You can look at how those work and send random data and try
, 00:06:44:19 ,to debug the protocol.
, 00:06:47:26
, 00:06:52:23 ,You can just scan and kind of do it in n map fashion.
, 00:06:57:12 ,So kind of I have a format I'll put this to a CSV file so you can aggregate tons
, 00:07:00:14 ,of information about Bluetooth devices which
, 00:07:04:28 ,is interesting and I have cool graphs later So you can also use it
, 00:07:09:03 ,as a component in building other applications.
, 00:07:09:19
, 00:07:13:01 ,So you can use the just like you'd use netcat to prototype
, 00:07:15:14 ,an application, you can actually use Blucat
, 00:07:18:02 ,to prototype an application and you don't have
, 00:07:20:13 ,to care so much about the Bluetooth layer
, 00:07:24:14 ,because you're handling that while it's deployed and your service runs
, 00:07:29:00 ,as its own thing and runs in as standard in and standard out.
, 00:07:31:01 ,Doesn't know that it's talking about RF.
, 00:07:36:22 ,So simple in line replacement for a netcat example.
, 00:07:37:29 ,So we have netcat.
, 00:07:39:15 ,Machine name and a port and that's going to connect
, 00:07:41:04 ,to some server.
, 00:07:43:04 ,List in with netcat on part 123 and you can have
, 00:07:47:04 ,a pipe going this way and it comes out that side.
, 00:07:51:12 ,So that's like the main kind of demo of netcat.
, 00:07:52:12 ,Right?
, 00:07:54:11 ,So we can do the same thing with Blucat.
, 00:07:57:04 ,We listen on RF channel 4 and then we connect
, 00:08:02:16 ,to this Mac address on RF channel 4 and it establishes that
, 00:08:07:20 ,same connection and you can do the same thing.
, 00:08:10:06 ,You can send music or movies.
, 00:08:13:27 ,Throughput is like 100k so it's not too good.
, 00:08:14:05
, 00:08:16:00 ,But it doesn't work with music, right?
, 00:08:17:04 ,Maybe not flak.
, 00:08:17:15
, 00:08:20:11 ,So we can compare with nmap.
, 00:08:24:15 ,So nmap is going to scan a bunch of stuff which is very useful.
, 00:08:25:29 ,Everyone knows about that.
, 00:08:29:16 ,So what's the equivalent for Blucat, right?
, 00:08:30:16 ,We have two things.
, 00:08:32:00 ,We can scan for device names which is what I was doing earlier,
, 00:08:35:00 ,scanning everybody's advice names and have output.
, 00:08:36:23
, 00:08:39:12 ,So we have time stamp.
, 00:08:39:18
, 00:08:42:16 ,Device name and whether we're paired with it
, 00:08:45:06 ,and whether the session is encrypted and
, 00:08:50:13 ,whether what's fallen out is the RSSI of the connection, right?
, 00:08:50:29
, 00:08:52:06 ,All right.
, 00:08:53:18
, 00:08:56:14 ,So you can go farther in depth.
, 00:09:00:19 ,You can list the services of each of those devices, right?
, 00:09:04:17 ,Let you actually expect the stuff that's run on that device.
, 00:09:06:25 ,You can think about these the same way you think
, 00:09:09:18 ,about an IP address and ports.
, 00:09:10:18 ,Same thing.
, 00:09:14:23 ,You have a MAC address, IP, and then you have these channel
, 00:09:19:15 ,numbers or PSMs for the L2 cat protocol.
, 00:09:20:07
, 00:09:23:19 ,And those are outlaid on the right.
, 00:09:27:21 ,This thing returns the entire URL which says we're going
, 00:09:32:29 ,to talk over the B2L2 cat protocol on PSM19 on nmap.
, 00:09:34:29 ,You can paste that and go right to it.
, 00:09:38:11 ,I'll go to that in detail.
, 00:09:39:23 ,You can brute force scan.
, 00:09:42:24 ,This takes a long time the way I've done it.
, 00:09:45:06 ,So maybe it's faster with a little other implementations
, 00:09:47:24 ,but this is a cross platform version.
, 00:09:49:29 ,So we scan this thing, we scan RFcom channels first,
, 00:09:52:03 ,we have bunch of open channels even
, 00:09:55:28 ,if they're not advertised in service discovery we can find them
, 00:09:57:16 ,this way.
, 00:10:02:14 ,If we scan L works cat channels you can look at all the channels open
, 00:10:08:08 ,from every possible L2 cap channel so even if they're not valid it will still try
, 00:10:11:21 ,to see if the stack will allow it.
, 00:10:17:00 ,This goes up to a high number and I've never really seen anything
, 00:10:20:23 ,over I don't know, like 100.
, 00:10:21:18
, 00:10:24:08 ,So for the past three days I've been walking
, 00:10:27:16 ,around with my bag scanning all the Bluetooth devices,
, 00:10:29:22 ,these are all names.
, 00:10:32:11 ,I put a nice word name bubble.
, 00:10:32:29
, 00:10:36:01 ,All this specific stuff is tiny but they're all iPhones,
, 00:10:38:24 ,Mac Book Pros and BlackBerries.
, 00:10:39:29
, 00:10:42:21 ,Did you guys all see who sees their machine
, 00:10:44:18 ,on this thing?
, 00:10:44:24
, 00:10:47:08 ,Who got invited to this talk during the week?
, 00:10:50:08
, 00:10:53:01 ,(Laughter) Everybody's afraid to raise their hand?
, 00:10:56:14
, 00:10:57:24 ,Scoreboard.
, 00:10:58:24 ,That was fun.
, 00:11:00:03 ,Left your Bluetooth on.
, 00:11:00:09
, 00:11:03:15 ,Who saw the scoreboard advertised for the Bluetooth talk?
, 00:11:04:16 ,One?
, 00:11:05:26
, 00:11:08:03 ,Short amount of time.
, 00:11:08:10
, 00:11:10:05 ,I got statistics on this.
, 00:11:13:09 ,So there are 92 unique names I found.
, 00:11:13:16
, 00:11:16:12 ,And sometimes devices won't send names.
, 00:11:20:09 ,They kind of lag and then they disappear.
, 00:11:22:14 ,But you definitely get their MAC address.
, 00:11:23:21 ,I found 126 unique MACs.
, 00:11:24:16
, 00:11:28:22 ,There are ways to find device MACs.
, 00:11:28:29
, 00:11:30:00 ,This is blatant.
, 00:11:32:19
, 00:11:35:12 ,No one would leave their Bluetooth on, these are discoverable
, 00:11:37:06 ,Bluetooth devices.
, 00:11:42:06 ,I thought I'd find two and they'd be at the hotel, just staying, not knowing.
, 00:11:46:26 ,So I sent these 126MACs, 13,000 pairing requests with an invite
, 00:11:48:20 ,to my talk.
, 00:11:50:14 ,So that was funny.
, 00:11:54:10 ,People clapping were the ones invited?
, 00:11:55:11 ,Okay.
, 00:11:58:14
, 00:12:01:20 ,So the reason I could do that is you can script Blucat.
, 00:12:02:20 ,This is the point.
, 00:12:06:25 ,I can write a program and that's a pain in the ass.
, 00:12:08:19 ,Bash script makes everything easy.
, 00:12:10:04 ,You don't have to care so much.
, 00:12:12:23 ,If your name is on here, I think these are the coolest names
, 00:12:15:04 ,out of all the names.
, 00:12:18:04 ,Just to prove to myself these are not hotel guests so
, 00:12:20:03 ,maybe the DoD.
, 00:12:21:17
, 00:12:24:02 ,So let's talk about URI molecules.
, 00:12:28:07 ,This little URL I said before, it tells you about what you know
, 00:12:30:18 ,about the service.
, 00:12:33:22 ,HTTP and HTTPS is equivalent design.
, 00:12:35:09
, 00:12:38:06 ,We have three I care about in this program
, 00:12:42:06 ,to use that kind of make sense and then the object is kind
, 00:12:46:15 ,of pushing it to what this program kind of does.
, 00:12:51:15 ,So the BTP, Bluetooth serial port profile which is also called RFcom makes
, 00:12:55:19 ,the most sense for this Ncat replacement.
, 00:12:59:07
, 00:13:01:02 ,Serial port protocol, take stuff that used to work
, 00:13:03:16 ,over serial ports and make them wireless.
, 00:13:04:13
, 00:13:06:12 ,That is easy.
, 00:13:09:07 ,L2 cap is different.
, 00:13:13:17 ,You have fixed width buffers that you send over, you negotiate like a size.
, 00:13:15:08 ,So you can achieve the same thing.
, 00:13:16:03
, 00:13:19:02 ,But it's you know, redundant.
, 00:13:22:10
, 00:13:25:08 ,Object exchange is when you send files back and forth.
, 00:13:25:18
, 00:13:30:01 ,So these three things, if you have these in the URL string,
, 00:13:34:00 ,then that's what they'll correspond to.
, 00:13:35:00 ,All right?
, 00:13:37:24 ,And you kind of have this weird Bluetooth stack.
, 00:13:40:17
, 00:13:44:17 ,So RFcom sits on top of L2 cap and then you have stuff that's
, 00:13:49:20 ,out of range of Blucat which is audio, so that kind of stinks.
, 00:13:50:09
, 00:13:53:16 ,And then the other I don't know what that is.
, 00:13:53:29
, 00:13:57:17 ,You have limited range on a stack of Bluetooth.
, 00:14:01:01 ,Let's go over these profiles a little bit more.
, 00:14:05:19 ,So the SPP profile is designed to emulate RS232 serial ports.
, 00:14:06:02
, 00:14:07:09 ,A serial port protocol.
, 00:14:07:25
, 00:14:11:22 ,So it has the same major attributes of TCP.
, 00:14:13:21 ,So you're expected to have in order delivery
, 00:14:17:14 ,of all your messages and if it's not delivered you would expect it
, 00:14:20:09 ,to retry or kill the connection.
, 00:14:22:04 ,So you have guarantees.
, 00:14:22:11
, 00:14:24:16 ,And it only has about 30 ports.
, 00:14:29:03 ,Depending on the stack, this varies what you can use and
, 00:14:34:00 ,if you know port map, with will old run NIS advertised
, 00:14:38:02 ,on port map, it runs the same way.
, 00:14:40:08 ,You can't be guaranteed you can have a port.
, 00:14:42:04 ,You can ask for something and if someone else is using it, it says no,
, 00:14:44:13 ,I'll put you on a higher port.
, 00:14:45:17
, 00:14:48:18 ,So it's kind of a drawback which is why you kind of need the scanning
, 00:14:51:18 ,to look at what port it actually ends up on.
, 00:14:51:29
, 00:14:54:18 ,It's the same consistently on a device.
, 00:14:59:13 ,If you run N cat and you get channel 4 it will probably always be channel 4.
, 00:15:03:11 ,Unless you reflash the device, put other services on it.
, 00:15:05:14
, 00:15:08:06 ,You can make it unreliable to UDP but that's not really in the interest
, 00:15:09:23 ,of this stuff.
, 00:15:10:28
, 00:15:13:11 ,And then it has a default maximum packet size
, 00:15:17:00 ,of 672 bytes so you can send them over in chunks.
, 00:15:17:25
, 00:15:20:05 ,RF com sits on top.
, 00:15:20:12
, 00:15:26:22 ,There's channel 3 in L2 cap which is RF com runs over all that
, 00:15:31:15 ,and it has way more port numbers.
, 00:15:34:24 ,So I scan up to 65,000 and then somewhere people advertise
, 00:15:37:29 ,40,000 and it's all, like, the odd numbers which
, 00:15:41:26 ,is weird that you just have odd port numbers.
, 00:15:44:15 ,But it's weird protocol.
, 00:15:46:02 ,So here's a list now.
, 00:15:47:02 ,So you have TCP/UDP.
, 00:15:48:04 ,We all know those.
, 00:15:49:09 ,RF com.
, 00:15:54:09
, 00:15:58:00 ,L2 chap PSM, and then the odd numbered so you have
, 00:16:00:19 ,reserved at the base.
, 00:16:02:12 ,So these are the interesting ones.
, 00:16:03:06
, 00:16:06:25 ,And that's 4,000 of them spec says it goes up to 32.
, 00:16:10:05 ,So it's kind of the lay of the land there.
, 00:16:11:24
, 00:16:15:25 ,So you can just a side note, you can look up MAC addresses
, 00:16:19:13 ,the same way you look up IP addresses.
, 00:16:20:29
, 00:16:23:26 ,So that's kind of it gives you more information.
, 00:16:26:06 ,But nothing really aligns properly.
, 00:16:27:14 ,Like it doesn't say Apple incorporated like it would
, 00:16:31:04 ,with network Mac so it doesn't tell you a lot of information.
, 00:16:31:09
, 00:16:36:01 ,All right of So getting back to Bluetooth, we can use
, 00:16:40:10 ,the e option which is from N cat.
, 00:16:41:18
, 00:16:44:22 ,So we have two actors, green and blue.
, 00:16:48:23
, 00:16:53:17 ,We're launching Blucat with dash L for listen and it's going
, 00:16:57:11 ,to choose any channel and bin bash.
, 00:16:57:18
, 00:17:02:27 ,I want to execute bin bash and set up standard in and standard out.
, 00:17:05:03 ,Going to be wired right there.
, 00:17:08:15 ,So we could then blue computer will list the services
, 00:17:11:06 ,on that first machine.
, 00:17:11:11
, 00:17:14:22 ,It outputs that there's something to listen to on channel 4.
, 00:17:15:23 ,We connect to that.
, 00:17:17:09
, 00:17:23:11 ,It's show that command to bash and bash is a program in high.
, 00:17:24:22 ,So that's kind of a cool use.
, 00:17:27:09 ,You can have a point to point remote access to some device,
, 00:17:30:07 ,which is kind of cool if you hang a Raspberry Pi
, 00:17:34:03 ,in the corner and connect to it without a wire.
, 00:17:36:14
, 00:17:39:29 ,I'm going to get more in depth with Bluetooth plumbing
, 00:17:43:01 ,and how this can be put together.
, 00:17:44:04
, 00:17:47:12 ,So we have basic Bluetooth connect at the top.
, 00:17:48:13 ,Netcat.
, 00:17:50:11
, 00:17:52:09 ,Identify a second URL and they're going to exchange a standard
, 00:17:54:22 ,in and standard out like you normally would.
, 00:17:58:13 ,On the left we have a terminal and on the right we did dash E option so it's
, 00:18:02:02 ,going to pipe the standard out from the terminal to the standard
, 00:18:03:28 ,in in bin bash.
, 00:18:04:06
, 00:18:06:25 ,So you kind of have remote control service
, 00:18:08:25 ,over Bluetooth.
, 00:18:10:14 ,All right?
, 00:18:11:23 ,This works the over day.
, 00:18:13:18 ,I just tested it other way.
, 00:18:14:01
, 00:18:16:14 ,You can have one process connect and launch
, 00:18:19:23 ,a service immediately when it connects to the server and
, 00:18:23:22 ,on the other side it connects to a different process so you can have
, 00:18:26:29 ,two processes talk each other over a Bluetooth link and
, 00:18:30:26 ,they never have to know anything about Bluetooth.
, 00:18:32:21
, 00:18:36:29 ,I'm going to go through a bunch of devices give a brief overview
, 00:18:39:01 ,of how they work.
, 00:18:41:16 ,Bluetooth has profiles when we look at this stuff, you can see profiles
, 00:18:44:10 ,in these certain types of devices.
, 00:18:47:13 ,So we're looking at a specific angle with Blucat.
, 00:18:47:18
, 00:18:50:24 ,But that's not the way devices want to look at each other, they want
, 00:18:53:20 ,to look at each other and say you're a phone so you must have
, 00:18:55:17 ,a hands free mode.
, 00:18:56:00
, 00:19:00:17 ,You can look at device classes, it will say I'm a laptop so I'm going
, 00:19:03:25 ,to have laptop like services that you can see
, 00:19:07:21 ,if I have and then go forward with that.
, 00:19:10:26 ,So it's really crazy the way that they look up each other.
, 00:19:14:05 ,But underneath, if you look at it from the raw implementation point
, 00:19:17:29 ,of view, we have RF com and L2 channels or PSMs that you can
, 00:19:20:26 ,connect to for these services.
, 00:19:21:16
, 00:19:24:24 ,In the case of an audio gateway, it will go
, 00:19:28:12 ,to another service that has voice.
, 00:19:29:12
, 00:19:36:12 ,It's kind of a collection of services on Bluetooth that can pose a profile so,
, 00:19:42:11 ,if we start looking at a printer, it's a Mac Office 3200 and it has
, 00:19:46:29 ,a microlink nick in it on the Bluetooth.
, 00:19:50:21 ,That doesn't tell us anything unless you know that micro link sells the HP
, 00:19:55:23 ,and you can tell us it's HP but they probably don't exclusively.
, 00:19:56:11
, 00:19:58:26 ,So it's hard to gain information that way.
, 00:20:01:11 ,But we can look at the services listed here.
, 00:20:03:05 ,We know it's a printer because we can just read the name
, 00:20:06:09 ,and device class will be will say I'm a printer.
, 00:20:06:17
, 00:20:10:17 ,And we can see that it has a serial port listed here, right?
, 00:20:12:12 ,So it's on channel one.
, 00:20:12:22
, 00:20:16:06 ,So we can just try to connect with that with Blucat and type stuff
, 00:20:20:12 ,and see what type of error it gives us, Bluetooth isn't good forgiving errors,
, 00:20:22:24 ,but when people implement Bluetooth services,
, 00:20:25:26 ,they just don't respond instead of give an error message,
, 00:20:27:23 ,so it's tougher.
, 00:20:29:04
, 00:20:31:25 ,Blucat URL and put that URL in there with the Mac
, 00:20:33:29 ,and channel number.
, 00:20:38:11 ,And connect directly to this thing.
, 00:20:42:12 ,It turns out this printer Blucat launches, it doesn't ask for authentication.
, 00:20:43:26 ,It's usually the other side.
, 00:20:44:03
, 00:20:47:17 ,So you'd connect to the printer and the printer would be like yeah,
, 00:20:49:17 ,that's all right.
, 00:20:50:17 ,It's fine.
, 00:20:52:00 ,I don't need to pair with you.
, 00:20:54:10 ,Let you connect to the socket and print out.
, 00:20:56:00 ,That's not the case with a lot of devices but printer
, 00:20:58:26 ,is completely anonymous access, right?
, 00:21:08:06 ,(Applause) JOSEPH PAUL COHEN: I messed with people with this.
, 00:21:14:03 ,I found out stationary was used and people were mad.
, 00:21:14:08
, 00:21:17:04 ,This is Alkatel.
, 00:21:19:22
, 00:21:23:17 ,Gives us device name, dial up networking so we can use it
, 00:21:27:12 ,as a modem and we just have a serial port.
, 00:21:28:07
, 00:21:33:22 ,So, if we just connect to the serial port, this wasn't as easy as this.
, 00:21:35:17 ,But you can connect to and it let's say so I had to pair
, 00:21:37:21 ,with this phone, right?
, 00:21:39:12 ,We're pretty safe unless we pair.
, 00:21:43:03 ,There are pairing flaws people have been telling me the last couple days.
, 00:21:46:26 ,So we type the AT Hayes commands to these things,
, 00:21:50:04 ,get device manager, model.
, 00:21:53:12 ,Those are all easy.
, 00:21:55:11 ,Or you can just look at it from the name and we get
, 00:21:59:15 ,the third one is because there's a date that it's talking to me.
, 00:22:00:17 ,And at this point, I could have put more
, 00:22:03:01 ,in but the guy I was playing with his phone, he shut
, 00:22:06:01 ,off his phone once he started I'm like these commands are working,
, 00:22:07:23 ,this is awesome.
, 00:22:11:16 ,It's hard to find phones you can do this to because it's a really old phone.
, 00:22:14:04 ,New phones aren't friendly for people who want to poke
, 00:22:15:29 ,around on them.
, 00:22:17:18 ,Probably for good reason.
, 00:22:17:24
, 00:22:20:00 ,We can look at anything that's Bluetooth.
, 00:22:23:06
, 00:22:26:18 ,If we look at WIImote, service records are empty,
, 00:22:29:25 ,maybe it's trying to hide things but we can see
, 00:22:34:00 ,up there that we have three services listed.
, 00:22:35:00
, 00:22:37:18 ,I think it's PSM11.
, 00:22:40:29
, 00:22:45:17 ,When we scan it, we actually find it's 1, 11, and 13.
, 00:22:47:16 ,So 1 is a default one.
, 00:22:47:24
, 00:22:53:09 ,So 11 and 13 are the ones we can talk to this thing on.
, 00:22:56:17 ,People have completely reverse engineered the WIImote stuff.
, 00:23:01:21
, 00:23:03:29 ,So we look at the nexus 4.
, 00:23:04:18
, 00:23:09:13 ,So we list the services on this and we see we have a headset gateway.
, 00:23:10:20 ,No serial port protocol.
, 00:23:11:28 ,So can't have fun with it.
, 00:23:13:01 ,No dial up modem so we can't mess
, 00:23:15:07 ,with that either.
, 00:23:20:13 ,Fund ones to look at are BTPSPs, they're usually ASCII based
, 00:23:25:21 ,except for an example I'll show in a minute.
, 00:23:26:18
, 00:23:29:05 ,So we can try to connect to one of those.
, 00:23:30:24 ,Let's do the hands free one.
, 00:23:34:24 ,The only one I can find a way to look at.
, 00:23:35:17
, 00:23:38:15 ,If you Google that in, you can find profiles and profiles
, 00:23:43:06 ,will tell you kind of what some sort of established protocol for it is.
, 00:23:44:20 ,Documentation is pretty bad and not uniform
, 00:23:46:26 ,across all manufacturers.
, 00:23:50:23 ,So I got this thing, I connected to it and the first thing I type now when
, 00:23:54:21 ,I connect to the serial port protocol is type AT or AT+ and have it give me
, 00:23:56:05 ,an error.
, 00:23:59:18 ,If you say something weird AT star, it will kick you off.
, 00:24:01:10
, 00:24:03:16 ,To get an error is the first side there's somebody
, 00:24:06:20 ,on the other side listening that we can there's some commands that must
, 00:24:08:08 ,do something.
, 00:24:08:22
, 00:24:13:27 ,If they're reading all the profile stuff, you can see it has a lot
, 00:24:19:09 ,of AT commands like the one that's the coolest ones is dials a number,
, 00:24:22:09 ,you this works on Nexus4.
, 00:24:25:26
, 00:24:33:25 ,Maybe on an expensive phone, and it will call it, right?
, 00:24:37:02 ,You can also list a number and list the services that are there.
, 00:24:38:29 ,There's a way to talk to these things.
, 00:24:42:15 ,They're just obscure and don't really advertise all the stuff.
, 00:24:46:16 ,So it's difficult to kind of get information from these things.
, 00:24:51:29 ,A thing that I did with Alex Whitmore an hour or two ago was look at the YAP,
, 00:24:55:12 ,I thought it was access point.
, 00:24:57:22 ,That's how I intuitively thought it was.
, 00:25:00:02 ,It's the iPhone accessory protocol.
, 00:25:07:22 ,I don't like iPhones but so the goal is how can you play stop, start,
, 00:25:14:07 ,control the auto tracks on the phone, right?
, 00:25:15:13 ,That would be cool if you could unplug
, 00:25:19:25 ,from your computer or write an app that would interact with us.
, 00:25:20:11
, 00:25:22:23 ,It turns out there's a chance it could be
, 00:25:25:03 ,the same interaction as the standard UR
, 00:25:29:14 ,in the Apple connector so, if you just wire up into that.
, 00:25:32:07 ,That's the hypothesis and it turns out so they're
, 00:25:36:04 ,the regular way you do this over the hard wire, this
, 00:25:40:09 ,is the same packet thing for saying I want you to play,
, 00:25:42:23 ,I want you to stop.
, 00:25:42:29
, 00:25:46:19 ,So that's like well documented for the hard line stuff.
, 00:25:47:11
, 00:25:52:18 ,Sadly, it turns out Apple has a weird authentication coprocessor
, 00:25:57:02 ,that's required to attach to this process.
, 00:25:57:09
, 00:26:02:12 ,So that makes it different than the actual wire line which makes it
, 00:26:05:09 ,undoable with Blucat unless we can kind
, 00:26:09:01 ,of process this stuff fast enough.
, 00:26:12:04 ,But more research will be needed for this stuff.
, 00:26:13:05 ,All right.
, 00:26:16:01 ,So the next section is rapid prototyping with Blucat.
, 00:26:18:10 ,So, if you want to make something really quick
, 00:26:20:13 ,with bash, right?
, 00:26:20:26
, 00:26:22:29 ,So how to prototype.
, 00:26:26:24 ,So this presentation was supposed to be given with a Bluetooth presenter.
, 00:26:28:15
, 00:26:30:11 ,That the only thing on the phone would be
, 00:26:33:15 ,an app that just sends characters over a socket.
, 00:26:36:08 ,So I press a button and it just sends a B or an F.
, 00:26:40:07 ,And then on our laptop somebody is listening and goes
, 00:26:45:01 ,into a script that's dispatching all the characters as they come
, 00:26:51:00 ,in and will respectively press back or forward to move my slides.
, 00:26:51:05
, 00:26:53:29 ,So that's the basis of it.
, 00:26:56:20 ,So we can go over how this works like a few lines.
, 00:26:58:06 ,We launch Blucat.
, 00:27:05:04 ,Do a keep alive, verbose to stay on this URL on my phone, on channel 4.
, 00:27:05:16
, 00:27:08:05 ,And then when we receive a connection,
, 00:27:12:01 ,we just throw it to dispatcher.sh.
, 00:27:15:29 ,Which simply looks like this.
, 00:27:17:21 ,So we just well read input.
, 00:27:22:00 ,If the input is an F, I go forward and press the key for forward.
, 00:27:23:09
, 00:27:25:14 ,It did work great all weekend.
, 00:27:28:02
, 00:27:29:29 ,So you can do other stuff.
, 00:27:30:26 ,You can say on any input you can filter
, 00:27:33:13 ,on different words and have it do anything.
, 00:27:35:08 ,It's like the sky is the limit with everything you want to control
, 00:27:37:00 ,on they device.
, 00:27:37:22
, 00:27:43:16 ,So that's kind of the basic way of prototyping so anyway you can think
, 00:27:47:29 ,in the future to use that stream in the same concept,
, 00:27:50:25 ,it's pretty easy to do.
, 00:27:53:16 ,So I scanned for over the course of three months
, 00:27:57:24 ,from the same desktop next to a computer lab.
, 00:28:03:16 ,Every 5 minutes and every single Bluetooth device that was visible.
, 00:28:08:27 ,I captured and stored and then wanted to run data analysis on it later.
, 00:28:09:10
, 00:28:11:09 ,I happened to write Blucat so it opens
, 00:28:15:07 ,in the CSV format and we have tons of files and import those
, 00:28:19:23 ,into a database or in R which I did and analyzed stuff.
, 00:28:23:04 ,So kind of a shout out to R, it's awesome.
, 00:28:24:12 ,Read this file.
, 00:28:24:26
, 00:28:30:06 ,And then filter based on the date convert them to dates
, 00:28:37:16 ,and make a histogram based on dates and break them into 100 bins.
, 00:28:38:09
, 00:28:40:13 ,So we get this thing February to April.
, 00:28:40:26
, 00:28:46:11 ,And we can see this should be numbers but I didn't go back and regenerate
, 00:28:48:09 ,this thing.
, 00:28:50:15 ,So this is in the in the upwards this is high.
, 00:28:54:05 ,2,000 scans that the magnitude of the stuff.
, 00:28:54:12
, 00:28:55:26 ,So you can see this dip.
, 00:28:56:04
, 00:28:58:14 ,So why is there a dip around March 23rd?
, 00:29:03:06 ,So you can say why are people not walking around here.
, 00:29:06:22 ,So we can teak a look filter more, just in between those date ranges
, 00:29:09:22 ,for the month of March, right?
, 00:29:10:01
, 00:29:14:11 ,You can see it's really close around the 21st to the 25th.
, 00:29:16:22
, 00:29:19:05 ,So I was like why?
, 00:29:21:26 ,Why did my script fail or something that was running?
, 00:29:24:04 ,And then I looked and it's spring vacation, it's towards the end
, 00:29:26:04 ,of spring vacation.
, 00:29:27:03
, 00:29:29:19 ,Made sense you can align the data collection
, 00:29:33:07 ,with the fact students were coming to school.
, 00:29:33:16
, 00:29:36:00 ,This was at a university.
, 00:29:36:06
, 00:29:38:14 ,More scary I can look at just me.
, 00:29:40:11 ,This is when I was in my office.
, 00:29:41:11 ,Right?
, 00:29:41:29 ,So you can do that for anybody and you kind
, 00:29:44:05 ,of know their name because it's their Mac Book
, 00:29:45:27 ,or their phone.
, 00:29:46:06
, 00:29:48:16 ,So and so's iPhone, right?
, 00:29:49:21
, 00:29:53:04 ,So this I guess I'm a slacker in March especially.
, 00:29:56:26
, 00:30:00:05 ,Now we can get into the architecture
, 00:30:03:06 ,and design of Blucat.
, 00:30:07:23 ,One awesome piece is I only really tested on Mac and Linux.
, 00:30:12:01 ,But the Blucove library in which it sits runs on tons
, 00:30:14:29 ,of platforms like Symbion and Android
, 00:30:18:27 ,and Windows, if you want to use that.
, 00:30:20:02
, 00:30:21:27 ,Works on blue is great.
, 00:30:24:10
, 00:30:27:24 ,There's high blues but then you're stuck blues.
, 00:30:28:02
, 00:30:33:22 ,And you can't really use it on an Mac which or anything
, 00:30:36:10 ,in the future.
, 00:30:36:19
, 00:30:38:23 ,You're stuck in the blues libraries.
, 00:30:41:17
, 00:30:45:02 ,Perfect so it's pretty small.
, 00:30:47:20 ,I mean there are a bunch of Java files.
, 00:30:48:25 ,This is Java based.
, 00:30:50:08 ,You can view appropriately.
, 00:30:52:01 ,But I like Java.
, 00:30:52:06
, 00:30:56:15 ,And then it kind of gets offloaded to a series of files that contain native
, 00:31:00:13 ,libraries for whatever platform you're on, the business logic
, 00:31:03:24 ,is all contained in the logic stuff and we call based
, 00:31:07:24 ,on the different platforms different libraries.
, 00:31:12:09 ,And kind of arrange everything appropriately.
, 00:31:19:00 ,This is one main file and you can run on arm Linux, Mac 64 bit, Linux 32 bit,
, 00:31:23:25 ,64 bit, ubuntu, fedora, all this stuff.
, 00:31:24:17
, 00:31:29:29 ,This is a diagram of how this interacts with everything.
, 00:31:31:14 ,You run Blucat.
, 00:31:35:18 ,It sits on top of Blucove and makes all those calls and if it's Mac it sits
, 00:31:40:08 ,on Apple API or opens everything in blues if blues is available which
, 00:31:44:26 ,will hit Linux and Bluetooth D and kernel modules and whatever Linux
, 00:31:49:10 ,is running on that implemented blues, it will run fine on and that
, 00:31:53:00 ,will actually hit the actual hardware.
, 00:31:54:06
, 00:31:58:26 ,So it's very versatile by design so a lot of people can use it This
, 00:32:01:17 ,is an eye chart with the Blucove stack
, 00:32:05:05 ,the way it interacts with everything.
, 00:32:08:05 ,I don't want to go over it too much.
, 00:32:12:27 ,But I want to talk about how the J and I libraries work.
, 00:32:13:02
, 00:32:18:29 ,So Blucove specifically offloads stuff using J and I libraries.
, 00:32:20:15 ,Who's seen this before?
, 00:32:23:00
, 00:32:27:01 ,You can do business logic in Java.
, 00:32:30:05
, 00:32:31:27 ,Time oh, no.
, 00:32:35:23
, 00:32:37:25 ,(Applause.) Okay, first of all.
, 00:32:39:29 ,What the fuck is that on the screen?
, 00:32:40:29 ,Holy shit.
, 00:32:43:17 , Lots of people want to talk about lots of things.
, 00:32:45:09 ,We're not going to let that happen.
, 00:32:47:03 , Oh, my God is that boring.
, 00:32:49:06
, 00:32:51:25 ,Oh, it is a Bluetooth controller on it.
, 00:32:53:04 ,Never mind, that's cool.
, 00:33:04:01
, 00:33:06:05 ,You all know the drill.
, 00:33:07:05 ,Holy shit.
, 00:33:08:05 ,Get up here, man.
, 00:33:09:05 ,Wait a second.
, 00:33:14:09 ,Weren't you just in the last track you were in?
, 00:33:14:26
, 00:33:18:13 , Is his name Sarah?
, 00:33:19:13 ,What's your name.
, 00:33:22:03 , Thomas waffles.
, 00:33:24:17 ,Atomic waffles.
, 00:33:25:18 ,Thank you.
, 00:33:26:02
, 00:33:28:22 ,Everybody, this is atomic waffles atomic waffles,
, 00:33:31:00 ,this is everybody.
, 00:33:36:15
, 00:33:38:12 ,I'm lonely over here.
, 00:33:40:00 , I'm sure you are.
, 00:33:40:08
, 00:33:43:02 , Where did you come from?
, 00:33:44:24 , That's atomic waffles.
, 00:33:46:13 ,Jesus, don't you pay attention.
, 00:33:48:03 , I can just take the bottle.
, 00:33:49:06
, 00:33:52:00 , Slow down, champ.
, 00:33:54:13
, 00:33:57:17 ,What you're going for a second one already.
, 00:33:59:21 ,All right, everybody, you know the drill.
, 00:33:59:26
, 00:34:01:12 ,Welcome to DEF CON!
, 00:34:06:23
, 00:34:08:12 ,We'll see you soon.
, 00:34:15:26
, 00:34:18:08 ,Waffles just got off the stage.
, 00:34:19:08 ,Okay.
, 00:34:20:08 ,We're on time.
, 00:34:25:00 , JOSEPH PAUL COHEN: All right.
, 00:34:30:05
, 00:34:35:04 ,So we offload this stuff to J and I and the way that that gets set
, 00:34:40:21 ,up to actually run on all these platforms really is a script.
, 00:34:44:01 ,So it's like a dispatching script so we just kind of weekly match
, 00:34:47:10 ,the OS type and Linux architecture.
, 00:34:47:21
, 00:34:49:07 ,And spit it out.
, 00:34:51:14 ,So, if you want to use Blucat and it's not supported on architecture,
, 00:34:54:22 ,I can just build all these libraries on your architecture and wire it
, 00:34:57:07 ,in if you want to use it, right?
, 00:34:58:08 ,Okay.
, 00:34:59:11
, 00:35:02:16 ,So send me an e mail if that is the case.
, 00:35:03:16 ,All right.
, 00:35:08:15 ,And we simply attach the libraries and run this main driver for the stuff.
, 00:35:08:21
, 00:35:11:19 ,And then one problem so, if you look at this file and you're like why
, 00:35:15:12 ,is he filtering out the extended error, it's because some stacks output tons
, 00:35:18:07 ,of debugging information and send it out and there's no way
, 00:35:20:00 ,to shut it off.
, 00:35:20:10
, 00:35:23:26 ,So I just filter it and some NS auto release
, 00:35:28:03 ,on a Mac this just fixes that Cool.
, 00:35:28:12
, 00:35:32:22 ,So how does J and I work inside the libraries.
, 00:35:32:29
, 00:35:35:16 ,So somewhere in this Blucove program when it runs
, 00:35:38:11 ,detects the OS that it's running on and loads
, 00:35:42:23 ,the specific native libraries for it, it's going to search everything
, 00:35:46:25 ,in the load library path which is in default inside the jar file
, 00:35:51:04 ,to find whatever stack that it should be running on.
, 00:35:52:04 ,All right?
, 00:35:56:04 ,So once that's loaded up, it then has these extra native functions
, 00:35:59:04 ,and they're ready to call.
, 00:36:00:21 ,So you make a call to this.
, 00:36:01:10
, 00:36:04:01 ,RF server, get channel ID.
, 00:36:06:23 ,So this is something pretty low level thing you have to get the handle
, 00:36:08:29 ,for this specific connection.
, 00:36:09:12
, 00:36:13:25 ,That gets offloaded to the C code or whatever, C++ whatever they want
, 00:36:18:13 ,to use in the native library which is the like this with a J and I header
, 00:36:22:03 ,to actually interact with that specific stack that you're
, 00:36:24:10 ,running on, right?
, 00:36:27:22 ,So you'll have to do this on every platform that it runs on.
, 00:36:28:22 ,So I didn't do this.
, 00:36:30:13 ,This is all the Blucove people which I don't have their logo
, 00:36:32:21 ,is on a different page.
, 00:36:33:00 ,They've done tons of work and it seems
, 00:36:34:04 ,like they're working for different companies anyway so
, 00:36:36:07 ,they're all getting paid and that's good.
, 00:36:37:07 ,And thanks.
, 00:36:38:20 ,(Applause.) Any questions?
, 00:36:39:23 ,I can take questions.
, 00:36:40:23 ,No?
, 00:36:41:23 ,Okay, thank you.
, 00:36:43:20 , Any I found that as long as the dongle is supported
, 00:36:43:20 ,by the OS it's supported by this stuff.
, 00:36:46:09 ,It calls the native all you need to know is their Mac.
, 00:36:49:04 ,If you get that through service discovery,
, 00:36:49:04 ,you're good or hack RF or Uber dude, that's another way.
, 00:36:51:00 , All right, everybody, questions?
, 00:36:52:15 ,He's got stickers to hand out.
, 00:36:55:29 ,He will answer questions, they're going to be in the chillout cafe'.
, 00:36:56:29 ,Hi.
, 00:36:59:15 , I have stickers, anyone want Blucat stickers?
, 00:37:04:17