Professional Information Security Association

MAR-2020

PISA Journal

Bluetooth Low Energy Security
Is My Car Hackable?

www.pisa.org.hk

Issue 31

Special Topics
06 Bluetooth Low Energy Security
12 Is My Car Hackable

Page 2

An Organisation for Information Security Professionals

Editor: editor@pisa.org.hk

Copyright

 2020Professional Information Security Association

Intranet
04
05
20
22

Page 3Message from the Chair
The Editorial Board
Event Snapshot
Joining PISA

A Publication of Professional Information Security Association

Professional Information Security Association

Message from theChair
To adopt the new requirements of communication, virtual conference become a popular means
to conduct presentations and meetings. PISA had
embraced the virtual conferencing technology to
conduct webinars in the period to deliver ourmember services. In April and May, we had respectively run two successful Webinars in the“Survival during epidemic, live version of an IT
Professional (IT 人疫景求生 真人版)” series.
We are planning more PISA/(ISC)2 HK Chapter
webinar and are inviting interested members tobe speakers. If you have an information security
related topics you are eager to share with fellow
members, please email to the EXCO to arrange.

Adopt the Changes
The CONVID-19 outbreak has changed the lifestyle of citizens of Hong Kong and the world.
We suddenly missed the smiling faces of ourfriends and relatives, and could only see others’eyes and hear the voices obscured by the mask.
We are forced to maintain social distancing fromothers, minimise gatherings and stop travelling.
Many governments had put up “Prohibition on
Group Gathering Regulation” to restrict the number of people in an assembly. Although thesecountermeasures contradicted to our normal human behaviour, we have no choice but adhere.

The PISA EXCO also likes to announce that totackle the challenge of COVID-19 with our fellow members, we have decided to waive themembership fee for the year July 2020 to June2021.

We wish the impact of COVID-19 to our life
could be relieved towards 3rd quarter of thisyear. At that time we can meet and greet eachother in person during our annual general meeting and election of new Executive Committee.

Ando Ho
Chair

Page 4

An Organisation for Information Security Professionals

MAR-2020

PISA Journal
The Editorial Board

SC Leung
CISSP CCSP CISA CBCP

Joyce FanCISSP CRISC CISA

Ian Christofis
CISSP

Alan Ho
CISSP CISA CISM CGEIT

You can contribute to PISA Journal by:●●

Joining the Editorial Board
Submitting articles to the Journal

SC Leung,
Chief Editor
editor@pisa.org.hk
Next Issue:
Issue 32 (Sep-2020)

Page 5

A Publication of Professional Information Security Association

Professional Information Security Association

IoT Security: A Study on
Bluetooth Low Energy
Device Attack

Chris Chan
OSWP, OSCP, OSCE, OSEE, OSWE and CEH
Chris is the Head of Cyber Security Research of UDomain. His expertise is on web application security, penetration test and malware
analysis. He has been a professional Bug Hunter for over 10 years.
He is owner of 2 CVEs and has reported vulnerabilities to companies including ASUS, Yahoo, eBay and Apple. He also contributed
to malware analysis for a Hong Kong Threat Intelligence Sharing
Platform and the first VXCON CTF (Capture-the-Flag) competitionin Hong Kong.

Page 6

An Organisation for Information Security Professionals

MAR-2020
IoT Security: A study on Bluetooth Low Energy device attack

Issue

31

Overview
Internet of Things (IoT) connect physical devices together. With the demand on data exchange and communication between devices, Bluetooth plays a key role to provide shortrange communications protocol. Developers can use Bluetooth to establish connectivity between devices. After Bluetooth 4.0, Bluetooth Low Energy (BLE), one of the branches ofBluetooth 4.0, consumes less energy which extends the battery life of devices. Although
BLE provide security features for devices communication, the majority of BLE devices do
not enable such features, resulting in vulnerabilities.
What is Bluetooth?
Started from 1994, a new wireless technology called Bluetooth was used for exchanging data
between devices over short distances and building personal area networks (PANs). After
Bluetooth 4.0, Dual mode was released to take care of classic Bluetooth communication anda new technology called Bluetooth Low Energy (BLE). Applications can be connected
through Bluetooth Classic mode, or Bluetooth Low Energy which can reduce power consumption but support shorter connection distance.

Page 7

A Publication of Professional Information Security Association

PISA

JournalProfessional Information Security Association

Page 8What is Bluetooth Low Energy
Bluetooth Low Energy (BLE) is also
known as Bluetooth Smart. In 2001, researchers in Nokia contemporary wirelesstechnologies did not address many applications and started to develop a lower power
consumption wireless technology which
they named Wibree later. Bluetooth Special Interest Group (SIG) adopt this technology in Bluetooth 4.0. The key difference between Classic mode and BLE modeis that the former establishes continuous
connection while the latter is kept in sleep-ing mode for most of the time to reduce power consumption. When an incident occurs,
BLE devices can build a short burst of longrange radio connection, which can provide alonger battery life. The channel number ofClassic mode is also smaller when compared
to BLE. Bluetooth Classic is mainly used inaudio streaming or headset which require
device to keep a continuous wireless connection, while BLE is mostly used in wearable
devices including smart lock, smart watches,
smart finders, etc.

An Organisation for Information Security Professionals

MAR-2020
IoT Security: A study on Bluetooth Low Energy device attack

Issue

31

The communication between BLE devices
The BLE communication begins from device discovery. In device discovery state BLE device broadcast advertising packet to all devices nearby. When Client receive the packet, it
sends out scan request to the device and wait for a response. After the devices respond, client
can send Link Request to BLE device and do pairing. In final state, client and device dobounding for further connections. In Legacy pairing method, all traffics are encrypted, andattacker can sniffer packet to perform below-mentioned attacks.

Common Attack Vector
Despite Bluetooth core vulnerabilities, the common attack vector of BLE device is passive
eavesdropping, Man-In-The-Middle attack and DoS attack. Passive eavesdropping happens
when the communication between client and device is not encrypted, while Attacker stands
between client and device to perform Man-In-The-Middle attack. Fuzzing attack happens
when the malicious user sends a lot of malicious packet to target device to keep it awake,resulting in battery lost in a short period and Denial of Service. The legacy pairing method
exchanges Temporary Key and generates Short Term Key (STK) during exchange. In Legacy Connection, Just Works pairing provide no protection as it uses 0 as Temporary Key. Although Passkey pairing provides better security, attacker still can brute force the key with
captured STK. If the attacker is able to decrypt traffic between devices, unencrypted transmissions can be intercepted by attacker to replay attack like opening door lock, unlocking

Page 9A Publication of Professional Information Security Association

PISA

JournalProfessional Information Security Association

Page 10device, disarming alarm, etc.

Case Study: Hijacking Bluetooth Key
Tracker device

Starting from Bluetooth 4.2, LE Security
Connection is published to protect key exchange. All packets are encrypted by Elliptic Curve Diffie Hellman (ECDH) publickey cryptography. Only Just Works pairing
is still vulnerable to MITM attacks as it
does not provide way to verify the connection.

A Bluetooth key tracker helps users to track
their missing keys or alert them when thieves
steal their keys. It triggers alarm if tracker
has left the area the user is located. Users canalso use mobile app to track their key location and manual alarm if the key is missing.
The mobile app needs to pair the tracker in
the apps beforehand. Our attack plan is toplace a fake device between mobile andtracker, the mobile connects to the fake client and the fake client connects to tracker.
However, the pairing process failed and mobile response with no device detected error.

An Organisation for Information Security Professionals

MAR-2020
IoT Security: A study on Bluetooth Low Energy device attack

From our observation in our console, Console Log showed that mobile app tried toconnect fake device and fake device established connection to tracker, but the mobile
app was disconnected after few seconds.
Another finding is that mobile app showed
no connection between server and mobile
app when we had WiFi proxy between mobile and server, which indicated that the
Out-Of-Band pairing may be applied. To
confirm this hypothesis, we also decompiled the mobile app and look for some31

hints, but the mobile apps code was obfuscated and all functions’ names are randomized. A breaking point is that we spotted a
response string related to “Invalid MAC”,
which is one of the strategy to prevent a fakedevice with incorrect MAC. What is more,
the proxy history showed our mobile tried tolook up the secret key with our fake device
MAC and failed. We adjusted our attack plan
to spoof the key tracker MAC. A few second
later, the connection was established and we
can sniff traffic between mobile and tracker.

Invalid MAC in mobile app

Two commands for trigger and disarm alarm

Page 11Issue

A Publication of Professional Information Security Association

PISA

JournalProfessional Information Security Association

After a few attempts on some basic functions like triggering the alarm, stopping the alarm,
opening camera and taking a photo, we have found the specific command to trigger or disarm the alarm. We can also trigger taking photo function on mobile.

Conclusion
To conclude, BLE provides solution to reduce IoT device power consumption. Choosing asuitable pairing method can prevent attack. The LE Secure Connection which help to provide confidentiality and integrity on the fly. Therefore, it is highly recommended that itshould be applied in vendor products as it provide protection to key exchange. Hacker
cannot easily intercept the traffic or eavesdropping key. What is more, the second protocol used in OOB pairing also need to take security into consideration as the secret key
may leak out through this channel.
Although the impact on hijacking the key tracker might not be significant, it brings out animportant message that security needs to be taken into consideration in multiple layers.
With the recent release of Bluetooth 5.0, it is worth performing a further study on thosedevices.

Chris Chan ■Copyright &Disclaimer

Copyright owned by theauthor. This article is theviews of the author and does
not necessarily reflect theopinion of PISA

Page 12

An Organisation for Information Security Professionals

MAR-2020

Is My Car Hackable?
Have you even thought about yourcar being hacked?

Mike Lo
Director, Cyber Security
Wizlynx Hong Kong

Page 13

A Publication of Professional Information Security Association

Services,PISA

JournalProfessional Information Security Association

Overview
Did you know your car can be hacked because it is connected to a vulnerable application that you
use remotely? Recently reported by CBS Chicago, 100 Mercedes were hijacked in Chicago lastApril because of the app called “SHARE NOW (Formerly called Car2go)”, a car-sharing app thatallows customers to rent a car on a short-term basis.
Theoretically YES - Someone can hack your car, if a security vulnerability exists within connectivity and control applications found in most cars today. This article will give you some high-levelinsight that everyone should know to minimize the risk of being hacked.

100 car2go Mercedes-Benz CLA/GLA models were hacked in Chicago in Apr 2019
(Image Credits: Daimler)

Page 14

An Organisation for Information Security Professionals

MAR-2020

Issue

31

Is My car hackable?

Elaborating on the situation, you can consider
a car as a computer if it is connected to the internet, and it is “Hackable”! This means yourvehicle is vulnerable to weaknesses that are
known to the public (Hacker), or to someone
who knows that hacking kits are available inthe market. To understand these weaknesses inmore detail, allow me to guide you with an
overview of those vulnerable systems in yourvehicle.

If it is connected, it
is hackable

Page 15TERMS OF CAR SECURITY(FROM WIKI)
Remote Keyless System
The term remote keyless system (RKS), also called akeyless entry or remote central locking r efer s to a lockthat uses an electronic remote control as a key that is activated by a handheld device or automatically by proximity.
Widely used in automobiles, an RKS performs the functions of a standard car key without physical contact. When
within a few yards of the car, pressing a button on the remote can lock or unlock the doors and may perform otherfunctions. A remote keyless system can include botha remote keyless entry system (RKE), which unlocks thedoors and a remote keyless ignition system (RKI), whichstarts the engine.

In recent years, factory-made vehicles comewith different levels of intelligence. This applies to vehicles ranging from an IoT vehicle,
such as a Tesla that is all-time connected andallows remote configuration anytime anywhere, or a car that was manufactured back inthe 90’s. In summary, any car that has Internet
connectivity becomes vulnerable to loopholes,
which a hacker WILL find.

Tire-pressure monitoring system

Poor design and vulnerable apps are normallythe root cause of an attack, even if a vehicle
does not have internet capability, there are stillvulnerable components, such as KES (Keyless
Entry System), LTE-enabled Car Camcorder,
Bluetooth or Wi-Fi enabled infotainment unit,
TPMS (Tire-pressure monitoring system), allof which a hacker may use to hack into the vehicle electronic control system(s).

Engine Control Unit

A tire-pressure monitoring system (TPMS) isan electronic system designed to monitor the air pressure inside the pneumatic tires on various types of vehicles. A TPMS reports real-time tire-pressure information to
the driver of the vehicle, either via a gauge, a pictogram
display, or a simple low-pressure warning light.

An engine control unit (ECU), also commonly called
an engine control module (ECM), is a type of electronic
control unit that controls a series of actuators on an internal
combustion engine to ensure optimal engine performance.
It does this by reading values from a multitudeof sensors within the engine bay, interpreting the data using multidimensional performance maps (called lookup
tables), and adjusting the engine actuators

A Publication of Professional Information Security Association

PISA

JournalProfessional Information Security Association

Which components of mycar are vulnerable?
There are many components in your car thatare used for normal operation; Several of themprovide different layers of security protection
for the car and some are just for your entertainment or convenience.
Generally, these components are KES, Bluetooth, Wi-Fi, LTE Car Camcorder or TPMS.
These components provide external connectivity to your car’s electronic control units or multi-media infotainment system (indirect connectivity to electronic control units).
KES, Keyless Entry System, comes with mostof the new manufactured cars, providing theconvenience to unlock your car door, or evenstart the engine. It is a smart entry system with
an electronic lock that controls access to yourvehicle without using a traditional mechanicalkey. “Keyless Entry System” originally meansa lock controlled by a keypad located at or nearto the driver's door, which required entering apredetermined (or self-programmed) numericcode. However, this kind of system is now ahidden touch-activated keypad on your vehicle’s door.
With external connectivity and technology deployed, attackers can study either the wirelesscontrols vulnerability or the weak encryptionthat can be used to tap into such weaknesses.
In the same similarity, WiFi / LTE enabledcamcorder, Bluetooth enabled infotainment
unit and RF-enabled TPMS, are all the same

Page 16

point-of-attack to a hacker.
If anyone of the above-mentioned systems are
not properly configured or protected, you canconsider them open to possible hacks. Furthermore, these components could be used to trace avehicle, trigger vulnerable events, overload theEngine Control Unit's (ECU's) limit, or spoof
the ECU to cause an unrecoverable state.

(Image Credits: CNN Business)(Image Credits: The IRISH Times)

An Organisation for Information Security Professionals

MAR-2020

Issue
Is My car hackable?

31

Would attackers be able to hack sensitive car components frominternal?
Other than external components’ vulnerabilities, there are also internal components inside
your vehicle that allow an attacker to hack into
your car and take control of critical features. If
you leave your vehicle's door unlocked, yourcar could possibly be attacked by someone
who sneaks into your car.

Potential internal point-of-attack components
are USB ports, ODB/ODBII Connector and
CAN Bus connectivity. Normally, these components are used by the engineer to run a problem diagnostic or examine an error code alerted.
Connecting to these internal components caneven perform more control than connectingfrom external ones, thus, they are more
vulnerable.
For the USB port, the attacker can install malicious software or exploit theUSB stack flaw of the infotainment
unit. On-board diagnostics (OBD) is an
automotive term referring to a vehicle's
self-diagnostic and reporting capability. OBD systems give the vehicle
owner or repair technician access to thestatus of the various vehicle subsystems. OBD-II is an improvement
over OBD-I in both capability andstandardization. OBD-II is mandatoryon all cars and light trucks built in the
US after 1996 and Europe after 2004.
An attacker uses ODB port to obtain
information from your car’s OBD/
OBD-II system to reveal critical detailed information about your vehicle,
which makes the hacking process
much easier.

(Image Credits: Car Hacker’s Handbook by OpenGarages)

Page 17

A Publication of Professional Information Security Association

PISA

JournalProfessional Information Security Association

Last but not least, the Controller Area Network(CAN bus) is a standard designed to allow microcontrollers and devices in your vehicle tocommunicate with each other's applications
without using a computer. With a proper protocol, an attacker can upload malware into yourvehicle enabling remote connection from external, which leaves a backdoor for the attacker toattack afterward. There are more advance attacks via CAN bus which we can discuss more
afterward.

OBDII scanner (Image Credits: 248am.com)(Image Credits: Car Hacker’s Handbook by
OpenGarages)

Page 18

An Organisation for Information Security Professionals

MAR-2020

Issue
Is My car hackable?

31

Mitigation Tips

Conclusion

What can we do to secure the car from being
hacked?

Securing a vehicle becomes a common hygiene
practice nowadays if you want to keep your vehicle safe from high-hacking risks. Whether
your connectivity is from external or internal
resources, following the above recommended
best practices and mitigation tips can be critical,
and should be reviewed from time-to-time.

The following items should be considered: Update your car’s software frequently Turn off your car’s Bluetooth and Wi-Fi con-necting to your infotainment unit when not inuse Do not broadcast your Wi-Fi SSID and use astrong password (if applicable)
 Scan USB drives before plugging them into

I wish all of you a safe ride and hope the above
sharing helps you to understand more about
your vehicle’s security & health status.

your car Use a strong password for LTE Connection

to your car’s component and change thepassword periodically Use reputable shops and allow only trusted

personnel to physically access to your car
 Do not download untrusted apps from yourinfotainment unit or use it as a browser,
which makes it vulnerable
 Regularly check with your car’s manufactur-

er for correspondent vehicle software updates
Copyright &Disclaimer

Copyright owned by theauthor. This article is theviews of the author and does
not necessarily reflect theopinion of PISA

Page 19

 Use the infotainment system with Android

Auto or Apple CarPlay feature, which ismore secure than a general one

A Publication of Professional Information Security Association

Mike Lo 

Professional Information Security Association

Event
Snapshot
We Share. We Progress.

Survival during epidemic, live version of an IT Professional
IT 人疫景求生 真人版 (6 Apr 2020)
Mr. Young Wo Sang who was forced to stay in the cruise ship in Japan for few weeks
due to other COVIN-19 infected passengers and was required to stay in the quarantine
camp for two weeks, shared us his invaluable experiences and challenges as a traveller and an IT professional during such unexpected adverse situation.

Interesting photo was shared. One the key components for handling unexpected scenario is to show care about people.

Page 20

An Organisation for Information Security Professionals

MAR-2020

Event
Snapshot
We Contribute. We Achieve.

Survival During The Epidemic Part II – The Struggling of
Using Video Conferencing Tools Webinar (12 May 2020)

Mr. Mike Lo shared some tips on how to
select video conference tools and protect
your meeting.

Live demo on how to establish asecure video conference was conducted.
Finally,
shared.

Page 21

take

away

A Publication of Professional Information Security Association

were

also

Professional Information Security Association

Professional Information Security Association
Visionto be the prominent body of professional information security practitioners, and utilise expertise andSuccessful Career

Be up-to-date and be morecompetitive in the info-sec
community – line up yourself
with the resources you needto expand your technicalcompetency and move forward towards a more successful career.

Many Ways

Networking

Continued Education

Enjoy networking and collaboration opportunities with otherin-the-field security professionals and exchange technical information and ideas for keeping
your knowledge up to date

Check out job listings information provided by members.
Get information on continuing
education and professional certification

Sharing of Information
Find out the solution to your technical problems from our emailgroups and connections with ourexperienced members and advisors.

Enjoy the discounted or freeadmissions to association activities - including seminars, discussions, open forum, IT related
seminars and conferences organised or supported by the
Association.

You Can Benefit

Membership
Information

Realise Your Potential

Professional Recognition

Develop your potentials andcapabilities in proposing and running projectgroups such as Education Sector Security, Mobile Security, Cloud Security, Honeynet, Public Policy Committee and others and enjoy the sense of achievement
and recognition of your potentials

Benefit from the immediate accessto professional recognition byusing post-nominal designation

Membership Requirements
Enquiry email:membership@pisa.org.hk

Membership
Application Form:
http://www.pisa.org.hk/
membership/member.htm

Code of Ethics:
http://www.pisa.org.hk/
ethics/ethics.htm
Page 22••

Relevant computing experience (post-qualifications) will be counted, and the recognition of professional
examinations / membership is subject to the review of the Membership Committee.
All members must commit to the Code of Ethics of the Association, pay the required fees and abide by
the Constitution and Bylaws of the Association
An Organisation for Information Security Professionals