How to Target Bluetooth Devices with Bettercap « Null Byte :: WonderHowTo

An incredible amount of devices use Bluetooth or Bluetooth Low Energy to communicate. These devices rarely have their radios switched off, and in some cases, are deliberately used as trackers for lost items. While Bluetooth devices support MAC address randomization, many manufacturers do not use it, allowing us to use tools like Bettercap to scan for and track Bluetooth devices.What Kind of Devices Use BluetoothNowadays, you might expect devices like laptops and smartphones use Bluetooth radios. Increasingly, Bluetooth is finding its way into nearly everything, fromsmart tracking devicesto find lost things tosmart police holstersthat phone home when a weapon is drawn.One thing these devices have in common is that they can be discovered with Bettercap. The difference between how useful that information is usually relies on the device manufacturer, as Bluetooth is a more secure protocol than Wi-Fi if implemented correctly. Fortunately, for hackers, many manufacturers don't choose to take advantage of device security like MAC address randomization, causing these Bluetooth devices to broadcast the same MAC address everywhere they go.Don't Miss:Use Ettercap to Intercept Passwords with ARP SpoofingThat makes them easy to track. It also makes it easy to determine what kind of device is behind the Bluetooth radio. While we can see nearby Bluetooth devices that do randomize their MAC address, they will likely appear as many devices are periodically transmitting around us at roughly the same signal strength.Bettercap for BluetoothBettercap is the successor toEttercapand features attack modules for many different types of radio and network technologies. Today, we'll be focusing on the Bluetooth module, but there is a lot more to Bettercap than just Bluetooth hacking. Bettercap can also hunt down and attack Wi-Fi networks, and by default, will begin enumerating devices on whatever network you are on when you start it. This ability translates well to identifying and scanning Bluetooth devices.The tool comes with a Bluetooth Low Energy suite that allows us to do much more than look at nearby Bluetooth devices. We can scan for the MAC address of any device in range, and then use that MAC address to connect to the device and get back information about it. Finally, we can write data to the device to try to exploit it, like a tag to track the device over time even if it changes its MAC address.What We Can LearnInformation is the first element of any attack. To start, we'll need to learn the manufacturer of the device so we can gain knowledge like the default pairing PIN. Once we identify the specific model behind the Bluetooth radio, we can start looking up specific information that could be used to hijack the device over Bluetooth.Don't Miss:Detect Bluetooth Low Energy Devices in Realtime with Blue HydraWhen scanning a Bluetooth device, we can learn information we should have no reason to know. We can determine the version of the operating system the target device is running, the name of the device, the manufacturer, and even details like the current battery level. If we learn a device is running old software, it becomes much easier to research vulnerabilities to exploit. The first step is discovering the device and scanning it to learn more about it.What You'll NeedTo follow this guide, I recommend starting with a fullKali Linuxinstallation. Bettercap can be easily installed on several platforms, but Bluetooth won't work on macOS.Step 1: Install BettercapIf you have a fully updated and upgraded version of Kali installed, you can runapt install bettercapto install Bettercap and the required dependencies. If you're on another Linux system, you can install Bettercap by running the following commands in a fresh terminal window.apt install golang
go get github.com/bettercap/bettercap
cd $GOPATH/src/github.com/bettercap/bettercap
make build
sudo make installStep 2: Start BettercapTo start Bettercap, you can simply runsudo bettercapin a terminal window.sudo bettercapbettercap v2.17 (type 'help' for a list of commands)

192.168.0.0/24 > 192.168.0.37  » [02:19:21] [endpoint.new] endpoint 192.168.0.10 detected as 3c:dc:bc:05:77:d4 (Samsung Electronics Co.,Ltd).
192.168.0.0/24 > 192.168.0.37  » [02:19:22] [endpoint.new] endpoint 192.168.0.3 detected as 50:33:8b:68:2d:73 (Texas Instruments).As you can see, the network module starts by default and has already begun to detect devices on the same network passively. Pretty cool! If we want to see the most updated list of devices we've identified, we can see it by typingnet.showand pressingEnter.192.168.0.0/24 > 192.168.0.37  » net.show+--------------+-------------------+---------+-------------------------------+--------+-------+----------+
|     IP ▴     |        MAC        |  Name   |            Vendor             |  Sent  | Recvd |   Seen   |
+--------------+-------------------+---------+-------------------------------+--------+-------+----------+
| 192.168.0.37 | 30:52:cb:6b:76:5f | wlan0   | Liteon Technology Corporation | 0 B    | 0 B   | 02:19:17 |
| 192.168.0.1  | 40:70:09:7a:64:97 | gateway | ARRIS Group, Inc.             | 590 B  | 0 B   | 02:19:18 |
|              |                   |         |                               |        |       |          |
| 192.168.0.3  | 50:33:8b:68:2d:73 |         | Texas Instruments             | 1.8 kB | 0 B   | 02:20:42 |
| 192.168.0.10 | 3c:dc:bc:05:77:d4 |         | Samsung Electronics Co.,Ltd   | 515 B  | 0 B   | 02:20:41 |
| 192.168.0.65 | 00:26:bb:1c:a0:87 |         | Apple, Inc.                   | 1.1 kB | 0 B   | 02:20:40 |
+--------------+-------------------+---------+-------------------------------+--------+-------+----------+

↑ 0 B / ↓ 131 kB / 1078 pktsTo stop this module, we can runnet.recon offto stop discovery.Step 3: Run the Bluetooth Sniffing ModuleNow, let's start the Bluetooth discovery! To start, typeble.recon onand pressEnter.192.168.0.0/24 > 192.168.0.37  » ble.recon on[02:23:55] [sys.log] [inf] ble.recon initializing device ...
[02:23:55] [sys.log] [inf] ble.recon state changed to PoweredOn
192.168.0.0/24 > 192.168.0.37  » [02:23:55] [sys.log] [inf] ble.recon starting discovery ...
192.168.0.0/24 > 192.168.0.37  » [02:23:55] [ble.device.new] new BLE device detected as 69:B0:77:33:32:B7 (Apple, Inc.) -77 dBm.
192.168.0.0/24 > 192.168.0.37  » [02:23:55] [ble.device.new] new BLE device detected as 11:8D:A3:DD:6F:23 (Apple, Inc.) -62 dBm.
192.168.0.0/24 > 192.168.0.37  » [02:23:55] [ble.device.new] new BLE device detected as 00:74:BB:1E:51:22 (Microsoft) -68 dBm.
192.168.0.0/24 > 192.168.0.37  » [02:23:55] [ble.device.new] new BLE device detected as 35:DE:BF:24:DE:02 (Microsoft) -57 dBm.
192.168.0.0/24 > 192.168.0.37  » [02:23:55] [ble.device.new] new BLE device detected as 26:22:8E:AC:BC:47 (Microsoft) -89 dBm.
192.168.0.0/24 > 192.168.0.37  » [02:23:55] [ble.device.new] new BLE device detected as 40:16:3B:ED:EF:21 (Samsung Electronics Co.,Ltd) -92 dBm.
192.168.0.0/24 > 192.168.0.37  » [02:23:55] [ble.device.new] new BLE device detected as 56:73:E6:EA:CE:C5 (Apple, Inc.) -51 dBm.
192.168.0.0/24 > 192.168.0.37  » [02:23:56] [ble.device.new] new BLE device Tile detected as C9:58:1F:16:7A:43 -79 dBm.
192.168.0.0/24 > 192.168.0.37  » [02:23:56] [ble.device.new] new BLE device detected as 5B:FA:11:B5:B1:3B (Apple, Inc.) -64 dBm.
192.168.0.0/24 > 192.168.0.37  » [02:23:56] [ble.device.new] new BLE device detected as 66:8D:90:81:2B:C5 (Apple, Inc.) -83 dBm.
192.168.0.0/24 > 192.168.0.37  » [02:23:57] [ble.device.new] new BLE device detected as F8:04:2E:B0:57:73 (Samsung Electro-Mechanics(Thailand)) -87 dBm.
192.168.0.0/24 > 192.168.0.37  » [02:23:59] [ble.device.new] new BLE device detected as 39:71:FA:71:9F:53 (Apple, Inc.) -94 dBm.
192.168.0.0/24 > 192.168.0.37  » [02:24:01] [ble.device.new] new BLE device detected as 6A:95:78:A8:8D:FC (Microsoft) -94 dBm.
192.168.0.0/24 > 192.168.0.37  » [02:24:04] [ble.device.new] new BLE device detected as 1A:53:E5:84:E2:10 (Microsoft) -95 dBm.
192.168.0.0/24 > 192.168.0.37  »This discovery will continue for as long as you like. Devices that haven't been seen for a few scans will drop off the list automatically.Step 4: Identify Hosts to ProbeAfter a few seconds, we've gathered a pretty big list. In a coffee shop at 2 a.m., I was able to identify many devices. To see the devices you've discovered, typeble.showand pressReturn.192.168.0.0/24 > 192.168.0.37  » ble.show+---------+-------------------+------+-------------------------------------+--------------------------------------------------------------------+---------+----------+
| RSSI ▴  |        MAC        | Name |               Vendor                |                               Flags                                | Connect |   Seen   |
+---------+-------------------+------+-------------------------------------+--------------------------------------------------------------------+---------+----------+
| -51 dBm | 56:73:e6:ea:ce:c5 |      | Apple, Inc.                         | LE + BR/EDR (controller), LE + BR/EDR (host)                       | ✔       | 02:24:50 |
| -59 dBm | 35:de:bf:24:de:02 |      | Microsoft                           |                                                                    | ✖       | 02:24:50 |
| -64 dBm | 5b:fa:11:b5:b1:3b |      | Apple, Inc.                         | LE + BR/EDR (controller), LE + BR/EDR (host)                       | ✔       | 02:24:49 |
| -68 dBm | 69:b0:77:33:32:b7 |      | Apple, Inc.                         | LE + BR/EDR (controller), LE + BR/EDR (host)                       | ✔       | 02:24:50 |
| -71 dBm | 00:74:bb:1e:51:22 |      | Microsoft                           |                                                                    | ✖       | 02:24:50 |
| -75 dBm | 11:8d:a3:dd:6f:23 |      | Apple, Inc.                         | Limited Discoverable, LE + BR/EDR (controller), LE + BR/EDR (host) | ✖       | 02:24:50 |
| -77 dBm | c9:58:1f:16:7a:43 | Tile |                                     | BR/EDR Not Supported                                               | ✔       | 02:24:50 |
| -86 dBm | 4f:da:70:25:35:09 |      | Google                              |                                                                    | ✖       | 02:24:48 |
| -86 dBm | 66:8d:90:81:2b:c5 |      | Apple, Inc.                         | LE + BR/EDR (controller), LE + BR/EDR (host)                       | ✔       | 02:24:46 |
| -88 dBm | f8:04:2e:b0:57:73 |      | Samsung Electro-Mechanics(Thailand) |                                                                    | ✖       | 02:24:48 |
| -90 dBm | 40:16:3b:ed:ef:21 |      | Samsung Electronics Co.,Ltd         |                                                                    | ✖       | 02:24:47 |
| -91 dBm | 1a:53:e5:84:e2:10 |      | Microsoft                           |                                                                    | ✖       | 02:24:45 |
| -91 dBm | 26:22:8e:ac:bc:47 |      | Microsoft                           |                                                                    | ✖       | 02:24:49 |
| -91 dBm | 61:b7:ab:e4:84:e7 |      | Apple, Inc.                         | LE + BR/EDR (controller), LE + BR/EDR (host)                       | ✔       | 02:24:36 |
| -91 dBm | 6a:95:78:a8:8d:fc |      | Microsoft                           |                                                                    | ✖       | 02:24:48 |
| -91 dBm | 7a:e8:23:e7:b5:59 |      | Apple, Inc.                         | LE + BR/EDR (controller), LE + BR/EDR (host)                       | ✔       | 02:24:23 |
| -91 dBm | 7d:e3:6c:c7:12:7c |      | Apple, Inc.                         | LE + BR/EDR (controller), LE + BR/EDR (host)                       | ✔       | 02:24:44 |
| -95 dBm | 39:71:fa:71:9f:53 |      | Apple, Inc.                         | Limited Discoverable, LE + BR/EDR (controller), LE + BR/EDR (host) | ✖       | 02:24:41 |
+---------+-------------------+------+-------------------------------------+--------------------------------------------------------------------+---------+----------+
192.168.0.0/24 > 192.168.0.37  » [02:24:55] [ble.device.lost] BLE device 7A:E8:23:E7:B5:59 (Apple, Inc.) lost.
192.168.0.0/24 > 192.168.0.37  » [02:25Step 5: Scan & Interact with DevicesAfter we identify a device of interest, we can use Bettercap to interrogate it further. The key here is knowing the MAC address of the target.Based on the scan above, the device with the strongest signal is an Apple device with the MAC address of 56:73:e6:ea:ce:c5. We can direct a scan of this device by typing the commandble.enum 56:73:e6:ea:ce:c5to enumerate details about the device.192.168.0.0/24 > 192.168.0.37  » ble.enum 56:73:e6:ea:ce:c5[02:27:30] [sys.log] [inf] ble.recon connecting to 56:73:e6:ea:ce:c5 ...
192.168.0.0/24 > 192.168.0.37  » [02:27:30] [sys.log] [inf] ble.recon connected, enumerating all the things for 56:73:E6:EA:CE:C5!
192.168.0.0/24 > 192.168.0.37  »
+--------------+-------------------------------------------------------------+------------------+---------------+
|   Handles    |                  Service > Characteristics                  |    Properties    |     Data      |
+--------------+-------------------------------------------------------------+------------------+---------------+
| 0001 -> 0005 | Generic Access (1800)                                       |                  |               |
| 0002         |     Device Name (2a00)                                      | read             | iPhone        |
| 0004         |     Appearance (2a01)                                       | read             | Generic Phone |
| 0006 -> 0009 | Generic Attribute (1801)                                    |                  |               |
| 0007         |     Service Changed (2a05)                                  | indicate         |               |
| 000a -> 000e | Apple Continuity Service (d0611e78bbb44591a5f8487910ae4366) |                  |               |
| 000b         |     8667556c9a374c9184ed54ee27d90049                        | write, notify, x |               |
| 000f -> 0013 | 9fa480e0496745429390d343dc5d04ae                            |                  |               |
| 0010         |     af0badb15b9943cd917aa77bc549e3cc                        | write, notify, x |               |
+--------------+-------------------------------------------------------------+------------------+---------------+
192.168.0.0/24 > 192.168.0.37  » [02:27:30] [sys.log] [inf] ble.recon disconnecting from 56:73:E6:EA:CE:C5 ...
192.168.0.0/24 > 192.168.0.37  » [02:27:30] [sys.log] [inf] ble.recon device disconnected, restoring discovery.
192.168.0.0/24 > 192.168.0.37  » [02:27:30] [ble.device.lost] BLE device 73:13:D4:64:AF:7D (Apple, Inc.) lost.As you can see, there are a few services that allow us to write data!Let's try writing data to a characteristic. After another scan, we discover a device with the MAC address 7e:dc:48:7c:77:ea and a writable field labeled "69d1d8f345e149a898219bbdfdaad9d9." We can write the value of "ffffffffffffffff" to that device by typing the commandble.write TheMacAddress TheFieldToWriteTo ValueToWrite, as seen in the example below.192.168.0.0/24 > 192.168.0.37  » ble.write 7e:dc:48:7c:77:ea 69d1d8f345e149a898219bbdfdaad9d9 ffffffffffffffff[02:38:22] [sys.log] [inf] ble.recon connecting to 7e:dc:48:7c:77:ea ...
192.168.0.0/24 > 192.168.0.37  » [02:38:22] [sys.log] [inf] ble.recon connected, enumerating all the things for 7E:DC:48:7C:77:EA!
192.168.0.0/24 > 192.168.0.37  » [02:38:23] [sys.log] [inf] ble.recon writing 8 bytes to characteristics 69d1d8f345e149a898219bbdfdaad9d9 ...
192.168.0.0/24 > 192.168.0.37  » [02:38:23] [sys.log] [err] ble.recon error while writing: insufficient authentication
192.168.0.0/24 > 192.168.0.37  »
+--------------+----------------------------------------------------------------------+------------------+-----------------------------+
|   Handles    |                      Service > Characteristics                       |    Properties    |            Data             |
+--------------+----------------------------------------------------------------------+------------------+-----------------------------+
| 0001 -> 0005 | Generic Access (1800)                                                |                  |                             |
| 0002         |     Device Name (2a00)                                               | read             | iPhone                      |
| 0004         |     Appearance (2a01)                                                | read             | Generic Phone               |
| 0006 -> 0009 | Generic Attribute (1801)                                             |                  |                             |
| 0007         |     Service Changed (2a05)                                           | indicate         |                             |
| 000a -> 000e | Apple Continuity Service (d0611e78bbb44591a5f8487910ae4366)          |                  |                             |
| 000b         |     8667556c9a374c9184ed54ee27d90049                                 | write, notify, x |                             |
| 000f -> 0013 | 9fa480e0496745429390d343dc5d04ae                                     |                  |                             |
| 0010         |     af0badb15b9943cd917aa77bc549e3cc                                 | write, notify, x |                             |
| 0014 -> 0017 | Battery Service (180f)                                               |                  |                             |
| 0015         |     Battery Level (2a19)                                             | read, notify     | insufficient authentication |
| 0018 -> 001d | Current Time Service (1805)                                          |                  |                             |
| 0019         |     Current Time (2a2b)                                              | read, notify     | insufficient authentication |
| 001c         |     Local Time Information (2a0f)                                    | read             | insufficient authentication |
| 001e -> 0022 | Device Information (180a)                                            |                  |                             |
| 001f         |     Manufacturer Name String (2a29)                                  | read             | Apple Inc.                  |
| 0021         |     Model Number String (2a24)                                       | read             | iPhone9,1                   |
| 0023 -> 002c | Apple Notification Center Service (7905f431b5ce4e99a40f4b1e122d00d0) |                  |                             |
| 0024         |     69d1d8f345e149a898219bbdfdaad9d9                                 | write, x         |                             |
| 0027         |     9fbf120d630142d98c5825e699a21dbd                                 | notify           |                             |
| 002a         |     22eac6e924d64bb5be44b36ace7c7bfb                                 | notify           |                             |
| 002d -> 0038 | Apple Media Service (89d3502b0f36433a8ef4c502ad55f8dc)               |                  |                             |
| 002e         |     9b3c81d857b14a8ab8df0e56f7ca51c2                                 | write, notify, x |                             |
| 0032         |     2f7cabce808d411f9a0cbb92ba96c102                                 | write, notify, x |                             |
| 0036         |     c6b2f38c23ab46d8a6aba3a870bbd5d7                                 | read, write, x   | insufficient authentication |
+--------------+----------------------------------------------------------------------+------------------+-----------------------------+
192.168.0.0/24 > 192.168.0.37  » [02:38:23] [sys.log] [inf] ble.recon disconnecting from 7E:DC:48:7C:77:EA ...While we weren't able to write to this Bluetooth device, many devices will. If we learn a device is running a service with a vulnerability we can exploit by writing to a value, we can use Bettercap to begin poking around for ways to further exploit nearby devices. We can also use these fields to fingerprint devices using MAC address randomization, as the values will uniquely identify a device that's changing other properties like its MAC address to try to avoid correlation.Bluetooth Devices Are EverywhereIn our sample scan, we discovered lots of Bluetooth devices nearby, even in a relatively empty coffee shop late at night. One of these devices was aTile-branded trackerthat never changes its MAC address, but others were smart devices that rotate the MAC address they transmit over time. We can defeat this with Bettercap by reading the values of characteristics like the battery life to compare them and determine whether a Bluetooth device we're seeing is the same as one we've seen recently.Don't Miss:How to Hack Bluetooth — Terms, Technologies & SecurityWith the ability to write data, we can even "tag" a device with a value so that we can identify it uniquely later. The ability to discover and unmask Bluetooth radio transmissions is useful for tracking the people and devices behind them. By knowing the type of hardware and version of software a device we're detecting is using, we have the best possible chance of being able to successfully attack it.I hope you enjoyed this guide to scanning and tracking Bluetooth devices with Bettercap! If you have any questions about this tutorial on Bluetooth sniffing or you have a comment, there's the comments section below, and feel free to follow me on Twitter@KodyKinzie.Don't Miss:How to Hack Bluetooth Like Mr. RobotFollow Null Byte onTwitter,Flipboard, andYouTubeSign up forNull Byte's weekly newsletterFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo and screenshots by Kody/Null ByteRelatedHow To:Hack Wi-Fi Networks with BettercapHow To:Perform Network-Based Attacks with an SBC ImplantBT Recon:How to Snoop on Bluetooth Devices Using Kali LinuxHow to Hack Bluetooth, Part 1:Terms, Technologies, & SecurityHow To:Bypass Android's File Type Restrictions on Bluetooth File SharingHow to Hack Bluetooth, Part 2:Using MultiBlue to Control Any Mobile DeviceNews:The Best Black Friday 2017 Speaker Deals for Your SmartphoneAndroid Basics:How to Connect to a Bluetooth DeviceHow To:5 Ways to Improve the Bluetooth Experience on Your Samsung GalaxyThe Hacks of Mr. Robot:How to Hack BluetoothHow To:Launch Any Music App When You Connect Headphones to Your LG on Android 10How To:Play Music on 2 Devices Using Your Samsung Galaxy PhoneHow To:See Battery Life for Paired Bluetooth Accessories on AndroidHow To:Set Default Volume Levels for Each of Your Bluetooth Accessories IndividuallyHow To:Fix Google Now Bluetooth Problems on Your Samsung Galaxy Note 2 or Other Android DeviceNews:Bluetooth 5.1 Adds Precision Location, Offers Beacons for Indoor Navigation & More Augmented Reality ExperiencesNews:The Best Black Friday 2017 Deals on Headphones for Your SmartphoneHow To:Set Up a Distress Signal on Android for Your Bluetooth Headphones (So You Never Leave Them Behind)News:Bluetooth 5 Is Here—But It Won't Make Your Headphones Sound BetterHow To:Automate Tasks on Your Mac Whenever You Come or Leave Home via BluetoothHow To:Switch or Connect to Wi-Fi Networks & Bluetooth Devices Right from the Control Center in iOS 13How To:Detect BlueBorne Vulnerable Devices & What It MeansHow To:Share Your iPhone's Internet Connection with Other DevicesHow To:Find Out if Your Mac Can Support Continuity's Handoff FeatureNews:The Best Black Friday 2019 Deals on Headphones for Your SmartphoneHow To:Use U2F Security Keys on Your Smartphone to Access Your Google Account with Advanced ProtectionHow To:Replace Android's Voice Dialer with Google Now for Better Bluetooth DialingHow To:Use Ettercap to Intercept Passwords with ARP SpoofingHow To:Change Your AirPods' Name to Something More Unique — Right from Your iPhone or Android PhoneHow To:Track Your Lost iPhone, iPad, or Mac Even When Its Offline — As Long as This Feature Is EnabledHow To:Connect a PS4 Controller to Your Mac for Improved GameplayHow To:Use “Smart Lock” on Android Lollipop for More Convenient SecurityHow To:Use Bluetooth to Control Your DSLR (Or Any Device with an Infrared Receiver)How To:iOS 13 Has Radically Improved Connecting to AirPods & Bluetooth DevicesNews:Is HP touchpad 64GB a possible rival to iPad 2?