BLE-Security-Attack-Defence

KO | EN

gitlite — search

#javascript #hacktoberfest #react #ai #typescript #go #rust #deep-learning #docker #java #windows #vue #pytorch #ios

BLE-Security-Attack-Defence

(★ 349)

✨ Purpose only! The dangers of Bluetooth Low Energy（BLE）implementations: Unveiling zero day vulnerabilities and security flaws in modern Bluetooth LE stacks.

파일 탐색기

최종 버전 다운로드 (.zip)

- FUNDING.yml
- config.toml
- - bluedroid.py
  - btsock.py
  - connectback.py
  - doit.py
  - README.md
  - sdp.py
  - utils.py
- - __init__.py
  - l2cap_infra.py
  - pcap_file.py
  - README.md
  - traced_bt_user_sock.py
- - __init__.py
  - README.md
- - nrf.py
  - nrf_readme.txt
- .gitignore
- LICENSE
- README.md
- Armis-BLEEDINGBIT-Technical-White-Paper-WP.pdf
- README.md
- - deployment.xml
  - misc.xml
  - modules.xml
  - saveactions_settings.xml
  - sweyntooth_bluetooth_low_energy_attacks.iml
  - vcs.xml
  - workspace.xml
- - settings.json
- - anomaly_nxp_unexpected_encryption_start.pcapng
  - capture_cc2640_dhcheck_skip.pcap
  - capture_cypress_psoc6_crash_llid.pcapng
  - capture_dialog_DA14680_truncated_l2cap_crash.pcap
  - capture_esp32_hci_desync.pcap
  - capture_microchip_ATSAMB11_invalid_fragment.pcap
  - capture_microchip_ATSAMB11_invalid_fragment_2.pcap
  - capture_nxp_ll_length_crash_capture.pcap
  - capture_nxp_llid_deadlock_attack_capture.pcap
  - capture_stmicroelectronics_sequential_att_deadlock.pcap
  - capture_telink_key_overflow.pcap
  - capture_telink_zero_ltk_installation.pcap
  - capture_ti_cc2640_crash_public_key.pcap
  - capture_zephyr_invalid_channel_map.pcap
  - capture_zephyr_invalid_sequence.pcap
  - noncompliance_cc2540_truncated_conn_request.pcap
  - noncompliance_DA14680_respond_to_oversized_mtu_request.pcap
  - noncompliance_DA14680_respond_to_truncated_mtu_request.pcap
  - noncompliance_microchip_and_others_invalid_hop_interval.pcap
  - noncompliance_nxp_invalid_hop_interval_sniffer.pcapng
  - noncompliance_stmicoelectronics_wb55_non_zero_ediv_rand_SC.pcapng
  - noncompliance_telink_respond_data_during_encryption_procedure.pcapng
  - noncomplicance_cc2540_malformed_connection_success.pcapng
  - noncomplicance_cc2640_invalid_hop.pcapng
  - noncomplicance_telink_respond_invalid_control_pdu.pcapng
  - noncomplicance_telink_respond_invalid_control_pdu2.pcapng
  - noncomplicance_telink_respond_invalid_control_pdu2_sniffer.pcapng
  - noncomplicance_telink_respond_version_more_than_once.pcapng
  - noncomplicance_telink_respond_version_more_than_once2.pcapng
  - noncomplicance_telink_version_ping_pong.pcapng
- - ble_knob_tester.png
  - demo_output.png
  - llid_deadlock_output1.png
  - setup.png
  - sweintooth_logo.svg
  - zero_ltk.png
- - __init__.py
  - NRF52_dongle.py
- - anomaly_unexpected_encryption_start.py
  - CC2540_connection_req_crash_truncated.py
  - CC2540_truncated_connection_success.py
  - DA14680_att_mtu_length_114_silent_overflow_accepted.py
  - DA14680_att_mtu_length_5_malformed_accepted.py
  - DA14680_att_read_100_silent_overflow_crash.py
  - DA14680_truncated_l2cap_crash.py
  - knob_tester_ble.py
  - Microchip_and_others_non_compliant_connection.py
  - non_compliance_data_during_encryption_setup.py
  - non_compliance_dhcheck_skip.py
  - non_compliance_multiple_version.py
  - non_compliance_nonzero_ediv_rand.py
  - README.md
- - __init__.py
  - timeout_lib.py
- - .gitignore
- .gitignore
- CC2640R2_public_key_crash.py
- CC_connection_req_crash.py
- DA14580_exploit_att_crash.py
- DA14680_exploit_silent_overflow.py
- docker.sh
- Dockerfile
- esp32_hci_desync.py
- flash_nRF52_driver_firmware.sh
- install_sweyntooth.sh
- invalid_channel_map.py
- link_layer_length_overflow.py
- llid_dealock.py
- Microchip_invalid_lcap_fragment.py
- nRF52_driver_firmware.hex
- nRF52_driver_firmware.zip
- README.md
- requirements.txt
- s140_nrf52_6.1.1_softdevice.hex
- sequential_att_deadlock.py
- sweyntooth.pdf
- Telink_key_size_overflow.py
- Telink_zero_ltk_installation.py
- trigger_exploit_August_Smartlock.bat
- trigger_exploit_CubiTag.bat
- trigger_exploit_eGeeLock.bat
- trigger_exploit_Eve_Energy.bat
- trigger_exploit_Fitbit_inspire.bat
- zephyr_invalid_sequence.py
- - cmd_btlejuice.js
  - cmd_btlejuice_proxy.js
- - index.ejs
- .gitignore
- CHANGELOG.md
- core.js
- fake.js
- logging.js
- package.json
- proxy.js
- README.md
- - BLE Workshop.pdf
  - setup.md
  - workshop_setup.md
- - component.mk
  - gatts_table_creat_demo.c
  - gatts_table_creat_demo.h
- - twitter_hackgnar.png
- .gitignore
- Makefile
- README.md
- vagrant_bluetooth_dev_setup.sh
- Vagrantfile
- README.md
- - blefuzzV21.sh
- - bluetooth_scanner.py
  - LICENSE
  - obd_generator.py
  - README.md
- - .gitignore
  - .travis.yml
  - aes-ccm.c
  - aes-enc.c
  - aes.c
  - aes.h
  - aes_i.h
  - AUTHORS
  - crackle.c
  - crackle.h
  - FAQ.md
  - LICENSE
  - Makefile
  - README.md
  - test.c
- - fitbit-smartrf.psd
  - LICENSE
  - pcapdump.py
  - README.md
  - tibtle2pcap.py
- Fuzzing Bluetooth：Crash-testing bluetooth-enabled devices_20110919.pdf
- 使用Ubertooth-one扫描嗅探低功耗蓝牙.html
- armis.jpg
- BlackHat.jpg
- BleedingBit.png
- BLESec.png
- blueborn-attack.png
- BlueBoy.png
- Damiel Cauquil.png
- DEFCON.jpg
- RSA_Conference.png
- sweyntooth-cyber.jpg
- USENIX.jpg
- - .gitignore
  - LICENSE
  - README.md
  - setup.py
- - .clang-format
  - .gitignore
  - .gitmodules
  - CHANGELOG
  - CMakeLists.txt
  - CONTRIBUTORS
  - COPYING
  - README.md
- - README.md
- - .gitattributes
  - .gitignore
  - .gitmodules
  - .travis.yml
  - appveyor.yml
  - COPYING
  - issue_template.md
  - Readme.md
  - TRADEMARK
- - .gitignore
  - .travis.yml
  - changelog
  - COPYING
  - issue_template.md
  - README.md
  - TRADEMARK
- README.md
.gitattributes
BlueBoy.png
Code-of-Conduct.md
LICENSE
logo.jpg
profile.jpg
README.md
Security Vulnerabilities in Bluetooth Technology as Used in IoT.pdf
sweyntooth.pdf

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

<div align="center">
	 
	<img border=0 src="logo.jpg" width="360">
</div>
<h3 align="center">Bluetooth-LE Security: Method, Tools and Stack</h3>

 <a href="https://github.com/Charmve/BLE-Security-Attack-Defence"><img src="https://img.shields.io/badge/👓-B1ueB0y-blue" alt="B1ueB0y"></a>
 <a href="https://github.com/Charmve"><img src="https://img.shields.io/badge/Github-Charmve-lightblue" alt="github"></a>
 <a href="./Code-of-Conduct.md"><img src="https://img.shields.io/badge/Licence-BSD2-green" alt="Code-of-Conduct"></a>

## ✨ News! ✨

- <img width="30" height="30" src="image/BlackHat.jpg">&nbsp;&nbsp;2020.10.13: A heap-based type confusion affecting Linux kernel 4.8 and higher was discovered in ``net/bluetooth/l2cap_core.c.`` by <a href="https://github.com/google/security-research" target="_blank">Google Security Research</a> ! 
- <img width="30" height="30" src="https://static.leiphone.com/uploads/new/images/20200326/5e7c5dc11daa1.png?imageView2/2/w/740">&nbsp;&nbsp;2020.03.26: A memory corruption issue was addressed with improved input validation by <a href="https://www.leiphone.com/news/202003/gENc7OITqoxKchYo.html" target="_blank">Qihoo 360 Alpha Lab</a> !

<table class="table table-striped table-bordered table-vcenter">
 <tbody class=ai-notebooks-table-content>
 <tr>
 <td colspan="1" rowspan="10" class="ai-notebooks-table-points ai-orange-link">
			 
			<div align="center">
				<img class="ai-header-badge-img" src="https://github.com/Charmve/BLE-Security-Attack-Defence/assets/29084184/dca27e6b-4625-4efd-9c24-eaaaff157318">
				</a>&nbsp;
				Figure 1: BLE messages exchange diagram 🔥Among the <a href="https://github.com/topics/deep-learning" target="_blank">top 10</a> BLE repos on GitHub
			</div>
 </td>
 </tr>
	<tr>
		<td>Fuzzing</td>
	</tr>
	<tr>
		<td><a href="https://www.usenix.org/system/files/sec20-ruge.pdf">Frankenstein: Advanced Wireless Fuzzing to Exploit New Bluetooth Escalation Targets</a></td>
	</tr>
	<tr>
		<td><a href="https://git.ist.tugraz.at/apferscher/ble-fuzzing">Stateful Black-Box Fuzzing of BLE Devices Using Automata Learning</a></td>
	</tr>
	<tr>
		<td><a href="https://asset-group.github.io/papers/BrakTooth.pdf">BRAKTOOTH: Causing Havoc on Bluetooth Link Manager via Directed Fuzzing</a></td>
	</tr>
	<tr>
		<td><a href="https://arxiv.org/pdf/2208.00110.pdf">L2Fuzz: Discovering Bluetooth L2CAP Vulnerabilities Using Stateful Fuzz Testing</a></td>
	</tr>
	<tr>
		<td><a href="https://asset-group.github.io/papers/AutoFuzz4G5G.pdf">Towards Automated Fuzzing of 4G/5G Protocol Implementations Over the Air.</a></td>
	</tr>
	<tr>
		<td>more ...</td>
	</tr>
	</tbody>
</table>
	
## BLE Vulnerability TOP5
- <a href="./01_BlueBorne" target="_blank">BlueBorne</a>
- <a href="./02_BLEEDINGBIT" target="_blank">BleedingBit</a>
- <a href="./03_SweynTooth" target="_blank">SweynTooth</a>
- <a href="./04_BtleJuice" target="_blank">BtleJuice</a>
- <a href="./05_BLE-CTF" target="_blank">BLE-CTF</a>

## Bluetooth LE Vulnerabilities

<table>
	<tr>
		<td>1.</td>
		<td><center><a href="https://www.youtube.com/watch?v=WWQTlogqF1I" target="_blank"><img src="https://res.cloudinary.com/marcomontalbano/image/upload/v1601457791/video_to_markdown/images/youtube--WWQTlogqF1I-c05b58ac6eb4c4700831b2b3070cd403.jpg" alt="BlueBorne: A New Class of Airborne Attacks that can Remotely Compromise Any Linux/IoT Device" height="280" width="6000" /></a></center></td>
		<td>
			BlueBorne: A New Class of Airborne Attacks that can Remotely Compromise Any Linux/IoT Device
			 
			Ben Seri & Gregory Vishnepolsky 
			In this talk we will present the ramifications of airborne attacks, which bypass all current security measures and provide hackers with a contagious attack, capable of jumping over "air-gapped" networks...
			<img width="30" height="30" src="image/BlackHat.jpg"> Black Hat 2017
			 
			[<a href="https://www.armis.com/blueborne/" target="_blank">PDF</a> | <a href="https://github.com/Charmve/BLE-Security-Attack-Defence/tree/master/01_BlueBorne" target="_blank">Project Page</a> | <a href="https://www.youtube.com/watch?v=WWQTlogqF1I" target="_blank">Video</a> | <a href="https://github.com/marsyy/littl_tools/tree/master/bluetooth" target="_blank">PoC</a>]
			
		</td>
	</tr>
	<tr>
		<td>2.</td>
		<td>
			<center>
				<a href="https://www.youtube.com/watch?v=G08fh5Sa7TU" target="_blank">
					<img src="https://img-blog.csdnimg.cn/img_convert/127a037eb210b12e714618610e1b9697.png" alt="BtleJuice: the Bluetooth Smart Man In The Middle Framework by Damiel Cauquil" height="280" width="6000" />
				</a>
			</center>
		</td>
		<td>
			
				BtleJuice: the Bluetooth Smart Man In The Middle Framework 
				 Damiel Cauquil
			
			
				A lot of Bluetooth Low Energy capable devices are spread since the last few years, offering a brand new way to compromise many “smart” objects: fitness wristbands, smart locks and padlocks and even healthcare devices. But this protocol poses some new challenges...
			
			
				<img width="30" height="30" src="image/DEFCON.jpg"> DefConference 2016 (DEFCOON) 
			 [<a href="https://www.youtube.com/watch?v=G08fh5Sa7TU" target="_blank">Video</a> | <a href="https://speakerdeck.com/virtualabs/btlejuice-the-bluetooth-smart-mitm-framework?slide=40" target="_blank">PDF</a> | <a href="https://github.com/Charmve/BLE-Security-Attack-Defence/tree/master/04_BtleJuice" target="_blank">Project Page</a>]
		 
		</td>
	</tr>
	<tr>
		<td>3.</td>
		<td><center><a href="https://www.youtube.com/watch?v=VHJfd9h6G2s" target="_blank"><img src="https://res.cloudinary.com/marcomontalbano/image/upload/v1601457995/video_to_markdown/images/youtube--VHJfd9h6G2s-c05b58ac6eb4c4700831b2b3070cd403.jpg" alt="Damien virtualabs Cauquil - You had better secure your BLE devices" height="280" width="6000" /></a></center></td>
		<td>
			
				You had better secure your BLE devices 
				 Damiel Cauquil 
			
			
				Sniffing and attacking Bluetooth Low Energy devices has always been a real pain. Proprietary tools do the job but cannot be tuned to fit our offensive needs, while opensource tools work sometimes, ... 
			
			
				<img width="30" height="30" src="image/DEFCON.jpg"> DefConference 2018 (DEFCOON26) 
				 [<a href="https://github.com/Charmve/BLE-Security-Attack-Defence/tree/master/04_BtleJuice" target="_blank">PDF</a> | <a href="https://github.com/Charmve/BLE-Security-Attack-Defence/tree/master/04_BtleJuice" target="_blank">Project Page</a> | <a href="https://www.youtube.com/watch?v=VHJfd9h6G2s" target="_blank">Video</a>]
			
		</td>
	</tr>
	<tr>
		<td>4.</td>
		<td><center><a href="https://www.youtube.com/embed/D5FIIqLWtYw?list=PLKV_4pHyTj0GUtdyOZotJJFwsjHbBT83l" target="_blank"><img src="https://res.cloudinary.com/marcomontalbano/image/upload/v1601458076/video_to_markdown/images/youtube--D5FIIqLWtYw-c05b58ac6eb4c4700831b2b3070cd403.jpg" alt="BLEEDINGBIT - Takeover of Aruba Access Point Access Point 325" height="280" width="6000" /></a></center></td>
		<td>
			BLEEDINGBIT - Takeover of Aruba Access Point Access Point 325 
			 
			Armis
			In this demo, Armis will demonstrate the takeover of an Aruba Access Point Access Point 325 using a TI cc2540 BLE chip. For more information, please visit https://armis.com/bleedingbit.
			<img width="30" height="30" src="image/armis.jpg"> BLEEDINGBIT RCE vulnerability (CVE-2018-16986) 
			 
			[<a href="https://www.armis.com/bleedingbit/" target="_blank">PDF</a> | <a href="https://github.com/Charmve/BLE-Security-Attack-Defence/tree/master/02_BLEEDINGBIT" target="_blank">Project Page</a> | <a href="https://www.youtube.com/watch?v=D5FIIqLWtYw&list=PLKV_4pHyTj0GUtdyOZotJJFwsjHbBT83l&index=2" target="_blank">Video</a>]
		</td>
	</tr>
	<tr>
		<td>5.</td>
		<td><center><a href="https://www.youtube.com/embed/oty1yTdsEXs" target="_blank"><img src="https://res.cloudinary.com/marcomontalbano/image/upload/v1601458144/video_to_markdown/images/youtube--oty1yTdsEXs-c05b58ac6eb4c4700831b2b3070cd403.jpg" alt="SweynTooth: Unleashing Mayhem over Bluetooth Low Energy" height="280" width="6000" /></a></center></td>
		<td>
			SweynTooth: Unleashing Mayhem over Bluetooth Low Energy 
			 
			Matheus E. Garbelini
			The Bluetooth Low Energy (BLE) is a promising short-range communication technology for Internet-of-Things (IoT) with reduced energy consumption. Vendors implement BLE protocols in their manufactured devices compliant to Bluetooth Core Specification. Recently, several vulnerabilities were discovered in the BLE protocol ...
			
			<img width="30" height="30" src="image/USENIX.jpg"> USENIX Security 20
			 
			[<a href="https://www.usenix.org/conference/atc20/presentation/garbelini" target="_blank">PDF</a> | <a href="https://github.com/Charmve/BLE-Security-Attack-Defence/tree/master/03_SweynTooth" target="_blank">Code</a> | <a href="https://asset-group.github.io/disclosures/sweyntooth/" target="_blank">Project Page</a> | <a href="https://www.youtube.com/watch?v=oty1yTdsEXs" target="_blank">Video</a> | <a href="https://www.usenix.org/system/files/atc20-paper43-slides-garbelini.pdf" target="_blank">Slides</a>]
		</td>
	</tr>
	<tr>
		<td>6.</td>
		<td><center><a href="https://www.youtube.com/embed/wIWZaSZsRc8" target="_blank"><img src="https://res.cloudinary.com/marcomontalbano/image/upload/v1601458197/video_to_markdown/images/youtube--wIWZaSZsRc8-c05b58ac6eb4c4700831b2b3070cd403.jpg" alt="BLESA: Spoofing Attacks against Reconnections in Bluetooth Low Energy" height="280" width="6000" /></a></center></td>
		<td>
			BLESA: Spoofing Attacks against Reconnections in Bluetooth Low Energy 			
		 
			Jianliang Wu, Yuhong Nan ..., Purdue University
			In this paper, we analyze the security of the BLE link-layer, focusing on the scenario in which two previously-connected devices reconnect. Based on a formal analysis of the reconnection procedure defined by the BLE specification, we highlight two critical security weaknesses in the specification. As a result, even a device implementing the BLE protocol correctly may be vulnerable to spoofing attacks...
			
			<img width="30" height="30" src="image/USENIX.jpg"> WOOT '20
			 
			[<a href="https://www.usenix.org/conference/woot20/presentation/wu" target="_blank">PDF</a> | <a href="https://github.com/Charmve/mhaiyang.github.io/blob/master/ICME2020_MCERN/index.html" target="_blank">Project Page</a> | <a href="https://www.youtube.com/watch?v=wIWZaSZsRc8" target="_blank">Video</a>]
		</td>
	</tr>
</table>
<table>
	<tr>
		<td>7.</td>
		<td><center><a href="https://www.youtube.com/embed/uKqdb4lF0XU" target="_blank"><img src="https://res.cloudinary.com/marcomontalbano/image/upload/v1601458318/video_to_markdown/images/youtube--uKqdb4lF0XU-c05b58ac6eb4c4700831b2b3070cd403.jpg" alt="Gattacking Bluetooth Smart Devices - Introducing a New BLE Proxy Tool" height="100%" width="3200" /></a></center></td>
		<td>
			Gattacking Bluetooth Smart Devices - Introducing a New BLE Proxy Tool 
				 Slawomir Jasek
			
			Using a few simple tricks, we can assure the victim will connect to our impersonator device instead of the original one, and then just proxy the traffic - without consent of the mobile app or device. And here it finally becomes interesting - just imagine how many attacks you might be able to perform with the possibility to actively intercept the BLE communication....
			
				<img width="30" height="30" src="image/BlackHat.jpg"> Black Hat 2016 (Black Hat) 
			 [<a href="https://www.blackhat.com/docs/us-16/materials/us-16-Jasek-GATTacking-Bluetooth-Smart-Devices-Introducing-a-New-BLE-Proxy-Tool.pdf" target="_blank">Slides</a>]
			
		</td>
	</tr>
	<tr>
		<td>8.</td>
		<td><center><a href="https://www.youtube.com/embed/fASGU7Og5_4" target="_blank"><img src="https://res.cloudinary.com/marcomontalbano/image/upload/v1603432192/video_to_markdown/images/youtube--fASGU7Og5_4-c05b58ac6eb4c4700831b2b3070cd403.jpg" alt="BIAS: Bluetooth Impersonation AttackS" height="100%" width="3200" /></a></center></td>
		<td>
			BIAS: Bluetooth Impersonation AttackS
			 
			 Daniele Antonioli, Nils Ole Tippenhauer & Kasper Rasmussen
			The Bluetooth standard provides authentication mechanisms based on a long term pairing key, which are designed to protect against impersonation attacks. The BIAS attacks from <a href="https://francozappa.github.io/publication/bias/paper.pdf" target="_blank">our new paper</a> demonstrate that those mechanisms are broken, and that an attacker can exploit them to impersonate any Bluetooth master or slave device. Our attacks are standard-compliant, and can be combined with other attacks, including the <a href="https://knobattack.com/" target="_blank">KNOB attack</a>. In the paper, we also describe a low cost implementation of the attacks and our evaluation results on 30 unique Bluetooth devices using 28 unique Bluetooth chips.
			
			📑 IEEE Symposium on Security and Privacy
			 
			[<a href="https://francozappa.github.io/publication/bias/paper.pdf" target="_blank">PDF</a> | <a href="https://francozappa.github.io/publication/bias/" target="_blank">Project Page</a> | <a href="https://www.youtube.com/watch?v=fASGU7Og5_4&feature=emb_logo" target="_blank">Video</a> | <a href="https://francozappa.github.io/publication/bias/slides.pdf" target="_blank">Slides</a> | <a href="https://github.com/francozappa/bias" target="_blank">PoC</a>]
		</td>
	</tr>
	<tr>
		<td>9.</td>
		<td><center><a href="https://www.youtube.com/embed/iH7VPUNz-dU" target="_blank"><img src="https://res.cloudinary.com/marcomontalbano/image/upload/v1601458374/video_to_markdown/images/youtube--iH7VPUNz-dU-c05b58ac6eb4c4700831b2b3070cd403.jpg" alt="BLEKey: Breaking Access Controls With BLEKey" height="100%" width="3200" /></a></center></td>
		<td>
			BLEKey: Breaking Access Controls With BLEKey 
			 
			 Eric Evenchick & Mark Baseggio
			RFID access controls are broken. In this talk, we will demonstrate how to break into buildings using open-source hardware we are releasing.Over the years, we have seen research pointing to deficiencies in every aspect of access control systems: the cards...
			
			<img width="30" height="30" src="image/BlackHat.jpg"> Black Hat 2016 (Black Hat) 
			 
			[<a href="" target="_blank">PDF</a> | <a href=" " target="_blank">Project Page</a> | <a href="https://www.youtube.com/embed/iH7VPUNz-dU" target="_blank">Video</a>]
		</td>
	</tr>
</table>
<table>
	<tr>
		<td>10.</td>
		<td><center><a href="https://www.youtube.com/embed/s79CG2Os0Nc" target="_blank"><img src="https://res.cloudinary.com/marcomontalbano/image/upload/v1601458432/video_to_markdown/images/youtube--s79CG2Os0Nc-c05b58ac6eb4c4700831b2b3070cd403.jpg" alt="MASHaBLE: Mobile Applications of Secret Handshakes Over Bluetooth LE" height="280" width="6000" /></a></center></td>
		<td>
			MASHaBLE: Mobile Applications of Secret Handshakes Over Bluetooth LE 
			 
			Yan Michalevsky
			In this talk, we present new applications for cryptographic secret handshakes between mobile devices on top of Bluetooth Low-Energy (LE). Secret handshakes enable mutual authentication between parties that did not meet before (and therefore don't trust each other) but are both associated with a virtual secret group or community...
			
			<img width="30" height="30" src="image/BlackHat.jpg"> Black Hat 2016 (Black Hat) 
			 
			[<a href="https://www.blackhat.com/docs/asia-17/materials/asia-17-Michalevsky-MASHABLE-Mobile-Applications-Of-Secret-Handshakes-Over-Bluetooth-LE-wp.pdf" target="_blank">PDF</a> | <a href="https://www.blackhat.com/asia-17/briefings.html#mashable-mobile-applications-of-secret-handshakes-over-bluetooth-le" target="_blank">Project Page</a> | <a href="https://www.youtube.com/watch?v=s79CG2Os0Nc" target="_blank">Video</a>]
		</td>
	</tr>
	<tr>
		<td>11.</td>
		<td><center><a href="https://www.youtube.com/embed/X2ARyfjzxhY" target="_blank"><img src="https://res.cloudinary.com/marcomontalbano/image/upload/v1601458478/video_to_markdown/images/youtube--X2ARyfjzxhY-c05b58ac6eb4c4700831b2b3070cd403.jpg" alt="Safe Mode Wireless Village - The Basics Of Breaking BLE v3" height="280" width="6000" /></a></center></td>
		<td>
			Safe Mode Wireless Village - The Basics Of Breaking BLE v3 
			 
			 FreqyXin
			Evolving over the past twenty-two years, Bluetooth, especially Bluetooth Low Energy (BLE), has become the ubiquitous backbone ...
			
			<img width="30" height="30" src="image/DEFCON.jpg"> DefConference 2020 (DEFCOON) 
			 
			[<a href=" " target="_blank">PDF</a> | <a href=" " target="_blank">Project Page</a> | <a href="https://www.youtube.com/watch?v=X2ARyfjzxhY" target="_blank">Video</a>]
		</td>
	</tr>
	<tr>
		<td>12.</td>
		<td><center><a href="https://www.youtube.com/watch?v=v9Xg9XcnNh0" target="_blank"><img src="https://res.cloudinary.com/marcomontalbano/image/upload/v1605671088/video_to_markdown/images/youtube--v9Xg9XcnNh0-c05b58ac6eb4c4700831b2b3070cd403.jpg" alt="USENIX Security '19 - The KNOB is Broken: Exploiting Low Entropy in the Encryption Key" height="280" width="6000" /></a></center></td>
		<td>
			Key Negotiation Of Bluetooth (KNOB): Breaking Bluetooth Security
				 
				Daniele Antonioli, SUTD
			
			We present an attack on the encryption key negotiation protocol of Bluetooth BR/EDR. The attack allows a third party, without knowledge of any secret material (such as link and encryption keys), to make two (or more) victims agree on an encryption key with only 1 byte (8 bits) of entropy. Such low entropy enables the attacker to easily brute force the negotiated encryption keys, decrypt the eavesdropped ciphertext, and inject valid encrypted messages (in real-time)....
			
			<img width="30" height="30" src="image/USENIX.jpg"> USENIX Security 19
			 
			[<a href="https://www.usenix.org/system/files/sec19-antonioli.pdf" target="_blank">PDF</a> | <a href="https://knobattack.com/" target="_blank">Project Page</a> | <a href="https://www.youtube.com/watch?v=v9Xg9XcnNh0" target="_blank">Video</a> | <a href="https://github.com/francozappa/knob/tree/master/poc-internalblue" target="_blank">PoC</a>]
		</td>
	</tr>
</table>
<table>
	<tr>
		<td>13.</td>
		<td><center><a href="https://www.youtube.com/embed/gCQ3iSy6R-U" target="_blank"><img src="https://res.cloudinary.com/marcomontalbano/image/upload/v1601458589/video_to_markdown/images/youtube--gCQ3iSy6R-U-c05b58ac6eb4c4700831b2b3070cd403.jpg" alt="Bluetooth Reverse Engineering: Tools and Techniques" height="320" width="540" /></a></center></td>
		<td>
			Bluetooth Reverse Engineering: Tools and Techniques
				 
				Mike Ryan, Founder, ICE9 Consulting
			
			
				With the continuing growth of IoT, more and more devices are entering the market with Bluetooth. This talk will shed some light on how these devices use Bluetooth and will cover reverse engineering techniques that in many cases can be accomplished with hardware you already have! Whether you're a Bluetooth newbie or a seasoned pro, you’ll learn something from this talk....
			
			
				<img width="30" height="30" src="image/RSA_Conference.png"> RSA Conference
				 [<a href="https://www.blackhat.com/docs/asia-17/materials/asia-17-Michalevsky-MASHABLE-Mobile-Applications-Of-Secret-Handshakes-Over-Bluetooth-LE-wp.pdf" target="_blank">PDF</a> | <a href="https://www.blackhat.com/asia-17/briefings.html#mashable-mobile-applications-of-secret-handshakes-over-bluetooth-le" target="_blank">Project Page</a> | <a href="https://www.youtube.com/watch?v=gCQ3iSy6R-U" target="_blank">Video</a>]
			
		</td>
	</tr>
	<tr>
		<td>14.</td>
		<td><center><a href="https://www.youtube.com/watch?v=QkGCP2mfbJ8" target="_blank"><img src="https://github.com/hexway/apple_bleee/raw/master/img/status_gif.gif" alt="Apple bleee" height="320" width="540" /></a></center></td>
		<td>
			Apple bleee: What happens on your iPhone, stays on your iPhone
				 
				Jeremy Martin*, Douglas Alpuche, Kristina Bodeman
			
			
				Handoff All Your Privacy – A Review of Apple’s Bluetooth Low Energy Continuity Protocol ....
			
			
				<img width="30" height="30" src="https://user-images.githubusercontent.com/29084184/128975720-f5d43ba0-9b5a-45f5-9ac8-49f507467c6b.png"> Apple bleee
				 [<a href="https://arxiv.org/pdf/1904.10600.pdf" target="_blank">PDF</a> | <a href="https://hexway.io/research/apple-bleee/" target="_blank">Project Page</a> | <a href="https://www.youtube.com/watch?v=Bi602yAIBAw" target="_blank">Video</a> | <a href="https://github.com/hexway/apple_bleee" target="_blank">PoC</a> | <a href="https://www.mac4n6.com/blog/2018/12/3/airdrop-analysis-of-the-udp-unsolicited-dick-pic" target="_blank">Analysis</a>]
			
		</td>
	</tr>
</table>

[research]: https://cdn4.iconfinder.com/data/icons/48-bubbles/48/12.File-32.png "Research"
[slides]: https://cdn3.iconfinder.com/data/icons/tango-icon-library/48/x-office-presentation-32.png "Slides"
[video]: https://cdn2.iconfinder.com/data/icons/snipicons/500/video-32.png "Video"
[web]: https://cdn3.iconfinder.com/data/icons/tango-icon-library/48/internet-web-browser-32.png "Website or blog post"
[code]: https://cdn2.iconfinder.com/data/icons/snipicons/500/application-code-32.png "Code"
[other]: https://cdn3.iconfinder.com/data/icons/tango-icon-library/48/emblem-symbolic-link-32.png "Uncategorized"

### Legend:
|Type| Icon|
|---|---|
| Research  | ![][research]|
| Slides  | ![][slides] |
| Video | ![][video]  |
| Website / Blog post  | ![][web]  |
| Code  | ![][code]|
| Other  | ![][other]|

## [▲](#table-of-content) Adversarial examples
| Type | Title| Categories |
|---|:---|---|
|![][video] | [BlueBorne - A New Class of Airborne Attacks that can Remotely Compromise Any Linux/IoT Device](https://www.youtube.com/watch?v=WWQTlogqF1I) | <img width="30" height="30" src="image/BlackHat.jpg"> Black Hat 2017 |
|![][video] | [Hack.lu 2016 BtleJuice: the Bluetooth Smart Man In The Middle Framework by Damiel Cauquil](https://www.youtube.com/watch?v=G08fh5Sa7TU)| <img width="30" height="30" src="image/BlackHat.jpg"> Black Hat 2016 |
|![][video] | [MASHaBLE: Mobile Applications of Secret Handshakes Over Bluetooth LE](https://www.youtube.com/watch?v=s79CG2Os0Nc)| <img width="30" height="30" src="image/BlackHat.jpg"> Black Hat 2017 |
|![][video] | [Automatic Discovery of Evasion Vulnerabilities Using Targeted Protocol Fuzzing](https://www.youtube.com/watch?v=NDWGwrMk3AU)| <img width="30" height="30" src="image/BlackHat.jpg"> Black Hat 2017 |
|![][video] | [Effective File Format Fuzzing – Thoughts, Techniques and Results](https://www.youtube.com/watch?v=qTTwqFRD1H8)| <img width="30" height="30" src="image/BlackHat.jpg"> Black Hat 2016 |
|![][video] | [Hacking the Wireless World with Software Defined Radio - 2.0](https://www.youtube.com/watch?v=x3UUazj0tkg)| <img width="30" height="30" src="image/BlackHat.jpg"> Black Hat 2014 |
|![][video] | [Hacking the Wireless World with Software Defined Radio - 2.0+](https://www.youtube.com/watch?v=MKbU3HhG2vk)| <img width="30" height="30" src="image/BlackHat.jpg"> Black Hat 2015 |
|![][video] | [DEF CON 26 - Damien virtualabs Cauquil - You had better secure your BLE devices](https://www.youtube.com/watch?v=VHJfd9h6G2s&t=646s)| <img width="30" height="30" src="image/DEFCON.jpg"> DEFCON |
|![][video] | [DEF CON 24 Wireless Village - Jose Gutierrez and Ben Ramsey - How Do I BLE Hacking](https://www.youtube.com/watch?v=oP6sx2cObrY)| <img width="30" height="30" src="image/DEFCON.jpg"> DEFCON |
|![][video] | [DEF CON Safe Mode Wireless Village - FreqyXin - The Basics Of Breaking](https://www.youtube.com/watch?v=X2ARyfjzxhY)|<img width="30" height="30" src="image/DEFCON.jpg"> DEFCON |
|![][video] | [DEF CON 26 - Vincent Tan - Hacking BLE Bicycle Locks for Fun and a Small Profit](https://www.youtube.com/watch?v=O-caTVpHWoY)|<img width="30" height="30" src="image/DEFCON.jpg"> DEFCON |
|![][video] | [DEF CON 26 WIRELESS VILLAGE - ryan holeman - BLE CTF](https://www.youtube.com/watch?v=lx5MAOyu9N0)|<img width="30" height="30" src="image/DEFCON.jpg"> DEFCON |
|![][video] | [DEF CON 21 - Ryan Holeman - The Bluetooth Device Database](https://www.youtube.com/watch?v=BqiIERArnA8)|<img width="30" height="30" src="image/DEFCON.jpg"> DEFCON |
|![][video] | [DEF CON 22 - Grant Bugher - Detecting Bluetooth Surveillance Systems](https://www.youtube.com/watch?v=85uwy0ACJJw)|<img width="30" height="30" src="image/DEFCON.jpg"> DEFCON |
|![][video] | [KnighTV Episode 11: Hacking BLe Devices Part 1/6: Attacking August Smart Lock Pro](https://www.youtube.com/watch?v=3e4DBk5BKLg)| Tutorial |
|![][video] | [Gattacking Bluetooth Smart Devices - Introducing a New BLE Proxy Tool](https://www.youtube.com/watch?v=uKqdb4lF0XU&list=LLxFkZjbpt0KyhEv1d342SQQ&index=6)| <img width="30" height="30" src="image/BlackHat.jpg"> Black Hat 2016 |
|![][video] | [Bluetooth Reverse Engineering: Tools and Techniques](https://www.youtube.com/watch?v=gCQ3iSy6R-U)| <img width="30" height="30" src="image/RSA_Conference.png"> RSA Conference 2019 |
|![][video] | [Hopping into Enterprise Networks from Thin Air with BLEEDINGBIT](https://www.youtube.com/watch?v=ASod9cRtZf4)| <img width="30" height="30" src="image/RSA_Conference.png"> RSA Conference 2019 |
|![][research] | <ins>漏洞预警 \| BleedingBit蓝牙芯片远程代码执行漏洞</ins> [解读1](https://www.anquanke.com/post/id/163307) \| [解读2](https://www.secpulse.com/archives/78841.html)| Analysis |
|![][video] | [BA03 Breaking the Teeth of Bluetooth Padlocks Adrian Crenshaw](https://www.youtube.com/watch?v=k8Tp5hj6ylY)| ShowMeCon 2016 |
|![][video] | [The NSA Playset Bluetooth Smart Attack Tools](https://www.youtube.com/watch?v=_Z4gYyrKVFM)| <img width="30" height="30" src="image/DEFCON.jpg"> DEFCON |

## [▲](#table-of-content) To-Do
- 2020.10 <a href="https://github.com/google/security-research/security/advisories/GHSA-h637-c88j-47wq" target="_blank">BleedingTooth</a> CVE-2020-12351 CVE-2020-12352 CVE-2020-24490 
- 2020.04 <a href="https://francozappa.github.io/about-bias/" target="_blank">BIAS</a> CVE-2020-10135 
- 2020.03 <a href="https://github.com/google/security-research/security/advisories/GHSA-h637-c88j-47wq" target="_blank">Bluewave</a> CVE-2020-3848 CVE-2020-3849 CVE-2020-3850 
- 2020.03 <a href="https://nvd.nist.gov/vuln/detail/CVE-2020-15802" target="_blank">BLURtooth</a> CVE-2020-15802 
- 2020.03 <a href="https://nvd.nist.gov/vuln/detail/CVE-2020-9770" target="_blank">BLESA</a> CVE-2020-9770 
- 2020.03 <a href="https://knobattack.com/" target="_blank">KNOB</a> CVE-2019-9506

## Code of Conduct

[免责申明 Code of Conduct](Code-of-Conduct.md)
 
## Citation
Use this bibtex to cite this repository:
```
@misc{BLE Security,
 title={Bluetooth LE-Security: Method, Tools and Stack},
 author={Charmve},
 year={2020.09},
 publisher={Github},
 journal={GitHub repository},
 howpublished={\url{https://github.com/Charmve/BLE-Security-Attack-Defence}},
}
```
*updade on 2021/08/05 @ <a href="https://github.com/Charmve" target="_blank">Charmve</a>

BLE-Security-Attack-Defence

파일 탐색기

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

BLE-Security-Attack-Defence

파일 탐색기

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README