Hacking challenge: steal a car!

Your "local partner in crime"
Sławomir JasekAgenda• IT security expert• since 2005, and still loves this job• BLE vs security• How to hack the car• New tool
• Vulnerabilities examples• Smart lock
• Anti-theft device• Mobile PoS• Other gadgets• MITM encrypted BLE?
• What can we do better

Bluetooth Smart? (aka Low Energy, 4...)• Probably most thriving IoT technology• Wearables, sensors, home automation,
household goods, medical devices, doorlocks, alarms, banking tokens, smart
every-things...

• Completely different than previousBluetoothBLE (v4.0) security: encryption• Pairing (once, in a secure environment)• JustWorks (R) – most common, devices without display cannot implementother• 6-digit PIN – if the device has a display• Out of band – not yet spotted in the wild• "Just Works and Passkey Entry do not provide any passive
eavesdropping protection"• Establish Long Term Key, and store it to secure future communication("bonding")
Mike Ryan, https://www.lacklustre.net/bluetooth/BLE (v4.0) security in practice• 8 of 10 tested devices do not implement BLE-layer encryption• "Forget" to do it, or do not consider clear-text transmission a problem• The pairing is in OS level, mobile application does not have full control over it• It is troublesome to manage with requirements for:• Multiple users/application instances per device• Access sharing• Cloud backup• Public access devices (e.g. cash register)• Other hardware/software/UX problems with pairing

BLE (v4.0) security in practice
Host (OS)• Security in "application" layer (GATT)• Various authentication schemes• Own crypto, based usually on AES• No single standard, library, protocol

SMP

ATT
L2CAP

UNENCRYPTED• Static password/key• Challenge-response (most common)
• PKI

GATT

Host Card Interface
Link layer

Physical layer
Controller (firmware)Regular users convincedSo, how to attack the BLE car lock?
• Remote relay?

Relay Attacks on Passive Keyless Entry and Start Systems in Modern Cars
http://eprint.iacr.org/2010/332.pdf

So, how to attack the BLE car lock?
• Remote relay?
• Jamming?
• Brute force?

Relay Attacks on Passive Keyless Entry and Start Systems in Modern Cars
http://eprint.iacr.org/2010/332.pdf

http://greatscottgadgets.com/ubertoothone/So, how to attack the BLE car lock?
• Remote relay?
• Jamming?
• Brute force?
• BLE sniffing?
• Mobile app
analysis?
• ...
• MITM?
http://greatscottgadgets.com/ubertoothone/Man in the Middle?
Mallory
Alice
Bob

How to MITM: isolate the signal?

How to MITM?
Stronger signal?
• Class 1 adapter? +8dBm, 100m range"little difference in range whether the otherend of the link is a Class 1 or Class 2 device
as the lower powered device tends to set
the range limit"
https://en.wikipedia.org/wiki/BluetoothMore signals?

And how to handle them in a single system?

Typical connection flow
Start scanning for advertisements

Advertise
Specific advertisement received,
stop scanning
Connect the advertising device (MAC)

Further communication

MITM
Start scanning for advertisements
Advertise more
frequently
Specific advertisement received,
stop scanning

Connect the advertising device (MAC)

Further communication

MITM?
Keep connection tooriginal device. It
does not advertise
while connected ;)New tool - architecture
Advertise(high freq)websockets

Get serv

services

Offer exact
services

Forwardreq/resp

Datainterception
andmanipulation

Gatheradvertisement
and services
data forcloning

Keep
connection tooriginal device
forwardreq/resp

Advertise

Get serv
servicesNew BLE MITM Tool – a must have for IoT tester!
• Open source• Only $10 BT4 USB
dongle needed• Works on Raspberryor any Linux• Node.js• Websockets• Modular design• And a cool logo!

Car hacking challenge: authentication
Get "Challenge"

AES("LOGIN",

Random challenge

AES(Challenge,

AES("LOGIN",AES(Challenge,key))

key
Commands(Open,Close...)NOTENCRYPTED:Open,Close...

Authentication: attack?
Get "Challenge"

AES("LOGIN",

Random challenge

AES(Challenge,AES("LOGIN",AES(Challenge,key))

key
Close

MITM

Other cmd

Other commands (based on mobile app):• initConfigMode – initiate the configuration – overwrite the keys
• initiateDataTransfer – dump the whole configuration (including allkeys)

PRNG?
- Is there any function which allows to generate a random number?
- There is no function to do this. However, there is a reasonably goodalternative (...), which reads the module's serial number and uses the twoleast significant bytes, then triggers a channel 14 (temperature) ADC readand combines the two with some very basic math* to generate a sort of"multiplier seed" which can be used for randomness.
* (multiplication of the values by themselves)
https://bluegiga.zendesk.com/entries/59399217-Random-function

Smart lock
• Challenge-response, session key• Commands encrypted by session key• Challenge looks random• Ranging: GPS-enabled, you have to leave the area and return• What could possibly go wrong?

Smart lock - protocol
Get "Challenge"

Challenge
SESSION KEY =AES(Challenge,KEY

Commands AES-encrypted by session key

Smart lock - protocol
Get "Challenge"

Challenge
SESSION KEY =AES(Challenge,Close lock

KEY
OK, closed

MITM(intercept,record,passthrough)Smart lock – attack
The same asrecorded session
Get "Challenge"

Challenge (previously intercepted)
SESSION KEY =AES(Challenge,OK,CLOSED!
KEY

Close lockOK, closed (repeat the encrypted)

MITM(replay)Smart lock – DEMO

Smart lock – attack v2
MITM

Get "Challenge"

STALLOK,
CLOSED!

Do not forward
req to device.

Advertise status"Closed"Smart lock: AT commands• BLE module AT interface exposedAT commands

AT commands

AT commands

Fallback to analog key may be unavailable...

DEMO: AT commands

DEMO: Anti-thief

DEMO: interception – static password

DEMO: Mobile PoS

But what about BLE encryption?

Bond – encrypted communication

"Just Works"

No need forbonding

Other
MAC

MITM

Bond – encrypted
communication(for static attack
scenarios notnecessary)"Just Works"?
Bond – encryptedcommunication

ClonedMAC

MITM

Bond – encryptedcommunication(for static attack
scenarios notnecessary)Remove the pairing, now it works again!

!
Bond – encrypted
New connection
communication

Cloned
MAC

MITM

Bond – encrypted
communication

PIN entry – trick into pairing again, sniff, crack

Bond – encrypted
communication

MITM
clonedMAC

PIN entry – trick into pairing again, sniff, crack
Passiveinterception ofpairing process

Bond – encrypted communication

Crack the PIN
using crackle

Some attacks• Denial of Service• Interception• Replay• Authentication bypass• Proximity actions• Misconfiguration/excessive
services abuse• Logic flaws• Badly designed crypto• Brute force• Fuzzing• ...

How to fix the problem?
• Use the BLE security features• Encryption, bonding, MAC randomization• Do not allow to bond automatically• Detect MITM, warn the user

• Your own mechanisms• Do not implement static passwords• Design with active interception possibility in mind

• Beware excessive services, misconfiguration• Prepare fallback for Denial of Service• ...
• More details in whitepaper

Q&A?
More information, these slides, whitepaper, tool source code:slawomir.jasek@securing.pl@slawekja

Thanks:• My family – for patience andvarious favours• SecuRing – for funding largepart of this research