Gattacking Bluetooth Smart Devices - Introducing a New BLE Proxy Tool
summary
A new BLE MITM proxy clones advertisements and GATT services (exports/uses JSON) and proxies traffic over WebSockets, runs in NodeJS on minimal hardware (cheap Bluetooth 4.0 USB dongle or Raspberry Pi). It forces phones to connect by advertising at 20 ms or by keeping the real device connected so it stops advertising; author claims ~99% success in practice. Demonstrated attacks include replaying challenges to keep locks open, dumping static passwords, exposing serial consoles, and tampering POS displays; sources and a white paper are on GitHub.
AI-written summary · about
chapters (9)
- 0:00Start
- 5:42Man in the Middle?
- 5:56How to MITM: isolate the signal?
- 6:25Typical connection flow
- 9:33Car hacking challenge: authentication
- 10:16Authentication: attack?
- 22:25Some attacks
- 23:33How to fix the problem?
- 25:32New tool - architecture
related talks
48mCreating a Bluetooth Toolbox
24mAttacking Bluetooth LE Design and Implementation in Mobile + Wearables Ecosystems
25mSweynTooth: Unleashing Mayhem over Bluetooth Low Energy
50mFun with Bluetooth
30mUnfit Story of Fitness Trackers: Hacking BLE Fitness Trackers
18mBLESA: Spoofing Attacks against Reconnections in Bluetooth Low Energy
51mBluetooth Hacking: Tools And Techniques
24mProtecting Privacy of BLE Device Users