Welcome to the Bluetooth device database.
Ryan Holeman.
Take it away.
(Applause.) RYAN HOLEMAN: Thank you for coming.
Last talk of the day.
Everyone having fun so far?
So this project is a little more high level than some
of my previous projects.
If you're getting into Bluetooth, it's really fun to see it
at this type of view.
I don't think it's ever been looked at in this way and I believe that you
need to look at devices in the wild in order to understand the technology.
So basically, in short, this project was to be
the largest scale Bluetooth device survey I've seen out there.
And I gave a lot of support to the community.
I have a lot of clients.
Install this stuff and send me your data, it's for everyone, not just for me.
So a little about myself before I get started.
That's a great picture of me.
I'm a senior I used to be a server developer,
security researcher at Ziften Technologies where we do
a lot of management solutions.
If you haven't heard about us, check us out.
We do tool stuff.
In my spare time I spend a lot of time tinkering with Bluetooth.
I have Python uber tooth projects I have up on GitHub.
Fun stuff.
I have fun doing this stuff in spare time.
Follow me on Twitter to follow any projects I'm doing and
all this research today is just kind of on my own.
It has nothing to do with existence, they just allow me to come
out and present to you guys.
So as I mentioned before, at its core the Bluetooth device survey was one
of the widest scale surveys I'm aware of.
I did it because I had a lot of questions about devices
in the wild and there weren't any data sets big enough and broad enough
to answer a lot of my questions so I just kinds
of took this on.
And as I kinds went through this and started doing analysis on the data,
I became aware of a lot of things I wasn't aware of before.
A lot of questions got risen and I was able to come up with a lot
of answers for them and learn new things.
And so all of this project was done only on discoverable devices.
And a lot of people say hey, why did you only do
discoverable devices?
You do a lot of passive stuff in your spare time.
Well, the number one reason was
convenience, right?
I could write a simple iPhone app and put it in my pocket and walk
around and scan things.
People don't really like it when you walk
around with big antennas in crowds and computers.
So that was the main reason was for convenience.
That and secondly, there wasn't anything done
at this wide a scale before.
And when we look at stuff with passive monitoring we miss
a lot of stuff I was interested in such as upper halves
of Bluetooth addresses.
So what was I interested in.
Mostly Bluetooth addresses.
But along with this comes device information along with device name.
Since I was doing all this for mobile devices,
geo location was easy to add in there and any other metadata I get
with a simple scan so this would be device class information, et cetera.
I did nothing that was actually probing you know, Bluetooth ports
or anything like that because that typically takes time and
by the time Bluetooth object moves on, you wouldn't actually be able
to complete the scan.
So what were the tools that I used for this project?
Everything about this project is open source.
The clients and I have a simple server too you can implement
if you don't want to send all your data up to my managed server.
But the main client that I created was an iOS client.
It will not be in the app store.
I had to leverage a lot of private libraries and APIs that Apple
does not allow to go through making applications run
in the background 24/7.
They don't allow you to put that stuff there.
But it's up on GitHub repo an you can compile it and throw it
on your phone.
For cross platform support if you saw Joseph Paul Cohen's talk
about an hour ago, in order to support cross platform, I hacked
up one of his Blucat clients.
I have a fork of it on my repo and basically the data it collects
will ship off to the remote server too.
The server if you want to participate in this project
but you don't want your data to go out to the public, I have
a simple server implementation on my GitHub repo too so you can
change the URL and have it report to your server.
Any data I collect or any data that I collect is open to people.
I do a database dump once a week, you can't use
the information track someone.
I'm giving them a week headstart.
So there are similar projects.
There was nothing that kind of hit this broad
of a scale app was a project similar run
by Josh Wright where he was trying to correlate the upper half
of an address vendor specific to an actual device it correlates to.
So this was a little different.
It didn't really follow what I wanted to look at.
JP dunning did a couple years ago did
the Bluetooth profiling project.
And it was similar to mine.
It didn't have the capability for shipping to remote server
like these clients do.
Didn't have geo server location.
It was looking at unique devices whereas,
repeated sightings in my data is really important.
Things like this.
And you know, Bluetooth changes from year to year.
His last scan was from, like, two years ago and so you know you
wouldn't see things that came out in the last year or two.
This stuff kind of changed really quickly.
There are some closed source projects that kind of do this it detection stuff.
So wireless works as a company.
If you've been paying attention to the media lately, there's been
a big stink about malls and department stores
tracking you based on your cell phone's wireless
probing, right?
Wireless works is kind of the Bluetooth version of this.
They track you going into a store based
on Bluetooth information.
There's not a lot of information about them online, so, if anyone
is familiar with them, I wouldn't mind talking to you
after the talk.
Houston's Transstar system use Bluetooth to even though I'm
from Texas, I have nothing to do with this project.
But they use Bluetooth to detect traffic patterns
in Texas highways.
So obviously these projects don't open the data sets
up to the public so it wasn't much use to me.
But it's interesting to know they're out there.
So the database right now has over 12,000 sightings and 5,000 actual
unique devices.
This is kind of like my collection over time for the last couple months.
As you can see, Vegas was pretty lucrative.
It would be the last couple days on the end of the time series here.
One of the first questions I what is the most discoverable device.
If you saw Joseph Paul Cohen's talk an hour ago you might have a hint.
Anyone here want to take a guess?
It was blackberries, they win by a landslide.
This is broken out based on device name.
There is error here but I had to munch some of the data.
A lot of the devices we get back in have generic names.
You don't get the name on the first scan so they'd be bucketed
into mobile phone so for this data set I truncated that
information off.
But for the most part if you take the top 10 in this list,
it's pretty accurate as far as what's really out there.
You know, Apple products, Mac books, iPhone, Roku, just going
down the list of the top 5.
IPads.
I'll get into the information a little bit.
I kind of truncated a lot of this material.
I thought this was a 20 minute talk but they gave me more so I get
to take my time on this.
But some of the things we can do with geo location on this,
the way I was collecting data is a lot different than a lot
of other techniques where most techniques as far as wireless works
or the Texas Department of Transportation they're basically
a stationary sell and you can assume that anything passing them
is a mobile device, so it's moving.
With my survey it was a little different.
I was the moving device so it's really hard for me
to determine am I seeing a moving device on the other side?
So in order to do this, I would take I would have
to see a device more than once, I need two or more sightings,
I would take the two farthest geo location points
in order to correlate it and bucket it into how much this device moves So
for this I'm getting about over 70% of the devices I actually saw
were moving.
And you can bucket them out into how much distance I actually
saw them moving.
Because I'm one person, it was hard for me to see things at a hard chain.
I had less than 5% that saw them.
Cool way to look at the data.
I liked it.
Another thing you can do that's cool with geo location information.
You can look at the reoccurrence of it in your data set.
In the top picture here this is a local Costco I go to time
after time and always have my phone on scanning the devices in there.
So in this map you can see the blue dots and these are devices that
are stationary and local to this particular Costco I go to and
all the red dots are devices which are not local to this.
So these would be most likely people traversing the store at the time.
So that's one way you can look at geo location information
with this stuff which is pretty neat.
The other way I call it solving the small world phenomena where that
would be assume you live in Cleveland and your friend lives
in L.A.
and you meet in Denver.
Small world.
This bottom picture is the route I skateboard
to work every day.
It's an access road so there's not a lot of traffic.
But the blue dots denoted in this image are cars I pass multiple
times whereas, the red dots are cars I would never
see again.
So this is something that you would never
really realize on your own.
You're not going to memorize every car that you pass
every day.
It's a cool way to look at data set.
Geo location is cool.
It was something I to tack on to see the data a different way.
I was interested in the Bluetooth address space.
I threw this in there because nobody everybody is familiar.
So Bluetooth addresses are laid out a lot like a Mac address
and you have the upper half being vendor specific
and lower half being device specific.
The device specific half is supposed to be unique across devices
and once you get into the vendor specific part,
we split it up into the NAP and the UAP.
UAP is when we do something passive monitoring
in Bluetooth we don't always get it and NAP we never get.
Even though all this date data I did research
on was for discoverable devices I wanted
to take the data set and use it in the techniques
for passive Bluetooth monitoring.
So I don't know if I mentioned but basically when we do passive
Bluetooth monitoring, the lap is the only thing we're guaranteed ever.
One of the things I wanted to determine if I were to go back
and do this whole survey again with only you know,
Bluetooth passive monitoring, I would most likely only get lap
addresses for geo location.
So what I really wanted to know is are lab addresses unique
or are vendors printing and pressing them out and using
the same LAP over and over.
Lo and behold it turns out their they're not.
LAPs are evenly distributed.
So all the devices I saw which is around 5,000,
I only had one collision and that happened
at around 3,000 devices.
So which isn't too bad.
That's an acceptable loss for me if I'm scanning a bunch of devices
and I get a collusion every 3 or 4,000, that's not too bad.
This graph here doesn't mean anything, it looked cool.
It was basically from 00 to FF like the whole 256 bytes you can get
for all sections the lap, just how evenly it is distributed across.
You can see there's no hotspots and that's that led me
to believe it is unique.
UAP is something that we do get in passive monitoring sometimes.
It depends on whether or not the traffic that goes
over the wire has a pay load.
So by looking at it in active devices
across the board we can drive cool information about it.
It looks as if the whole address space is pretty much used
as UAPs and there is a hotspot for popular UAPs.
This can be used for mostly if you were to grab if you only had
an LAP and you wanted to just derive what
the most probable UAP is, you could use the top one.
I guess if you really wanted to, you could use it for brute force
in UAPs though it's not the most effective thing.
But it was just interesting.
I saw there was a hotspot with UAPs, a lot are used more than others.
And this is only the top 35UAPs.
So basically, the last, you know, 200 some
of them that you're getting down into one device sighting per UAP.
So it tails out pretty nicely.
So this is the coolest thing.
I'm a nerd.
This is my favorite part of all the research.
So in passive monitoring, we do not get NAPs.
So what I really wanted to do is see if I could derive an NAP based
on probability of the rest of its address space.
So you need an NAP if you want to correlate a device to a vendor
and since we don't get this in passive monitoring,
what I was looking for here is are there higher probabilities
of getting particular NAPs based on a UAP.
So this was pretty interesting.
Right here I have basically this graph is just the first 8 addresses,
first 8 UAP addresses based out of 208 possibilities from 00 to 207.
For every UAP I have correlating NAPs with that.
So what we can basic by do here is say if you have a UAP, what
is your most probable NAP based on devices seen out in the wild?
As it turns out this is actually pretty good for coming
up with a high probability of what it is.
Worst case scenario, I think there's 8NAPs associated
with one or two of the UAPs on the list.
But a 1 in 8 probability isn't too bad and you're able
to see which are used the most.
So you can narrow that down into the highest probability.
So that was pretty interesting.
That's your worst case scenario.
Best case scenario which happens to be for the majority
of all UAPs there's only 1, 2, 3, NAPs actually associated
with those UAPs.
So for the majority of the time you can marrow it
down to the 1 or 2 and then increase probability based
on how many times you saw it.
This is interesting, last year I touched on this subject
but he was just looking at vendor lists
to my NAP probabilities were, you know, I would have 40 60,
NAPs which is not as useful.
If I can tell you I can give you three possible vendors, that's pretty good.
So on to vendor statistics.
This stuff can be used for two different purposes, I think.
One is increasing probability even more from the last slides you talked about so,
if you had 2 NAPs that were tied you could weight it based
on actual vendor which is most popular.
Other thing to look at is what are the most popular vendors
for Bluetooth.
Apple takes the cake.
I said BlackBerry was the number one actual device
but Apple has more products so they're taking the case with this.
BlackBerry in second.
Samsung does a lot of embedded devices so they're far
up there.
Rokus was interesting.
I saw a lot during this scan and before I started doing correlations,
I thought Rokus might be the most popular device I saw out there.
But they're pretty high up on the list.
Kind of interesting to know.
And and I was getting Roku boxes driving down the road which
is crazy which means I'm probably getting 50 70 feet based on an iPhone.
So they're very loud.
Security.
So what does this mean for security?
You know, you can be tracked with Bluetooth.
It's not something everyone knows.
I think that if it is something that is important to you,
you're probably best turning Bluetooth off.
And on top of that, Bluetooth is a security protocol itself.
But there are vulnerabilities that exist out there.
It's mostly based on software implementations,
vendors who will create services that accept
connections without actual PIN authentication
or easy PIN authentication connections typically you'll see that where you can
connect 0, 0, 0, 0, 0.
It is out there and something to be aware of.
I think, too, like if you ever wanted to do research in this realm, this
is the list I never had.
If you wanted to get the most bang from your buck finding
the most widespread device, this is the list I could go
down and it would be interesting to go down and start doing Bluetooth
audits on these devices, awareness.
A lot of devices don't act how you think or you might have Bluetooth
in places you don't know.
A lot of people might not know it's on in your car and discoverable
all the time.
Or are not aware that when start up your car Bluetooth goes
into discoverable mode for 60 seconds or longer.
This happens in other devices besides car audios, but this
is something some people might not be aware of and it's something you can't
turn off most of the time.
And I did notice a lot of bugs.
If you notice in my device list broken
out by actual devices out there, if you're aware
of how iOS devices work, your Bluetooth actually goes
into discoverable mode only when you go to your Bluetooth settings menu.
Yet I'm seeing so many iPads and iPhones in my skins
is there a chance I'm walking by somebody when they're actually
configuring the Bluetooth?
Most likely not.
So what happens is this actually happened
to me multiple times when I was scanning this.
I never scanned 24/7 that it never occurred
to me that my phone would get stuck in discoverable mode sometimes.
It depends on how you leave the Bluetooth settings pages
in your iOS.
If you live too fast it gets stuck in discoverable mode.
That's why you see them in discoverable mode so much.
I believe the other reason why there's so many discoverable Bluetooth
devices out there is bad human computer
interface, right?
Vendors just they give you that perma discoverable
button when you don't need it.
I'm not picking on Apple here but they did it right with iOS
despite the bug I mentioned but in OSX they don't.
They could have done the same thing when you go
in the configuration page, you're in discoverable an and when you leave,
you're not.
They have that perma button.
That happens with Bluetooth too.
It does seem to be a little more personal
because it's something that happens to you
more than your home Wi Fi router.
But as far as legal issues go, there's really nothing out there and it
is just kind of based.
Closest thing would be detecting wireless devices.
If you don't want to be tracted, it is your responsibility as a consumer
to turn off your Bluetooth device, not everything can be turned
off so I don't know if that's the right answer.
So all my data sets for this stuff can be downloaded
from Bluetoothdatabase.com.
As I said, I do a dump once a week.
All the data can be downloaded from GitHub directly if you want
to get at this stuff.
If you need to contact me, hate mail, whatever, Ryan@Hackner.com.
There's no time statistics except for device sightings over time,
so I'd like to take the slides I showed you and have
the week's most popular devices which would be easy for me to add in there.
Community participation: Obviously the reason I'm here today.
If you want to participate in this, you know, feel free
to install my clients even if you don't want to submit it
to this database, fire up your own server.
I supply the code for it.
Just kind of look at what's out and around you, it's fun to see
and it will it will give you a wider idea of what's really going on out there
in the Bluetooth space.
Service enumeration: I didn't add this in originally.
And I might play around with it.
I think I didn't want it do anything too I wanted to be as evasive as I could.
I didn't want to do RF com scannings
on these things.
I didn't want to interrupt people's daily scans,
I wasn't looking to offend anyone and a passive survey, I think that
by comparing, by doing a large scale passive survey
and comparing the data sets it would lead
to interesting space like you would get a wider view
of what the actual Bluetooth deployment
is out there.
So you can kind of compare the sets.
You could see out of X amount of discoverable,
how many passive do you typically see in an area?
Things of this nature.
It would be cool to do with standard wait and Bluetooth
low energy.
I don't believe anyone's really done a large scale Bluetooth low energy scan
which would be cool to see.
So that is it (Applause.) I almost clapped
for myself.
(off mic) RYAN HOLEMAN: So in my findings,
it's you're always going to get in discoverable mode.
AUDIENCE: (off mic) RYAN HOLEMAN: In this study, OX4f.
You're talking about the top one?
Around 300.
AUDIENCE: (off mic) RYAN HOLEMAN: Oh, no.
I don't have it broken out here.
It would be broken out more in the NAP statistics that correlate
with that one.
You're asking about the NAPs that actually associated
to that?
AUDIENCE: (off mic) RYAN HOLEMAN: Because some devices
will scan with that address and it's not the actual address
of the device, so you end up seeing it more.
Is that what you're getting at?
AUDIENCE: (off mic) RYAN HOLEMAN: I don't know.
Some of this stuff is black magic to me so I don't know.
Cool.
Any other questions?
Yeah.