How to Detect Bluetooth Low Energy Devices in Realtime with Blue Hydra « Null Byte :: WonderHowTo

Bluetooth Low Energy (BLE) is the de facto wireless protocol choice by many wearables developers, and much of the emerging internet of things (IoT) market. Thanks to it's near ubiquity in modern smartphones, tablets, and computers, BLE represents a large and frequently insecure attack surface. This surface can now be mapped with the use ofBlue Hydra.Built on thebluez library, Blue Hydra employs built-in BLE hardware, which can be further enabled by the use ofUbertoothhardware, to discover and track not only low energy, but classic Bluetooth devices too. You can learn more about how Blue Hydra works by watching theDefcon 24 talk. In this tutorial, we will download Blue Hydra on a Raspberry Pi running Raspbian, and get started tracking.Those of you already familiar withusing Aircrack -ngwill be right at home with Blue Hydra, as they are very similar.Don't miss:Getting Started with the Aircrack-Ng Suite of Wi-Fi Hacking ToolsIf you want to get more familiar with Bluetooth security, Null Byte has you covered! You can get up to speed withTerms, Technologies, & Security, learn toControl Any Mobile Device, and get yourReconnaissanceon.What You'll Need to Get StartedRaspberry PiMicroSD cardMicroSD card readerPower supplyBluetooth dongle(optional to improve range)Ubertooth hardware(optional to detect Classic devices not in discoverable mode)Not a replacement for a conventional Bluetooth dongle!Step 1: Download & Flash the Raspbian ImageFirst, we'll prepare the OS we'll be runnig Blue Hydra on. For this tutorial, we'll be using Raspbian. You can download the Raspbian image directly, or torrent via your favorite Torrent client on theRaspbian download site.Once the download is complete, we need to write the image to our microSD card. It's a good idea to unplug any external hard drives or other USB devices you have, and then insert your microSD into its adapter and plug it in. This is important since you don't want to accidentally flash the wrong device.If you already have a program for flashing live images to the card, then you can use that. Otherwise, download andinstall Etcher, as it's the easiest to use for making bootable SD cards. It works on Windows, Mac, and Linux, while also having a simple to use interface. Go ahead and open Etcher when it finishes installing.Etcher should detect what operating system you are using, but if not, make sure you download the correct version based on your operating system, then open the file and follow the on-screen installation directions. Open Etcher (if it doesn't automatically open after installation), and select the image you just downloaded.Next, be sure the proper drive is selected and flash the image. Once it's done, it will safely eject the SD card.There is a rare chance that Etcher will cause an error. If that does happen, use ApplePiBaker for Mac or Win32 Disk Imager for Windows.If you plan on using a Secure Shell (SSH) to access your Pi, then you will want to add an empty file ssh with no file type to the boot folder on the microSD card.Step 2: Start Your PiInsert the SD card into the slot at the bottom of your Raspberry Pi and plug the Pi into an HDMI cable leading to a display and a power cable. If you want to SSH into your Pi, make sure to plug the Pi into Ethernet, with the other end of the Ethernet cable going into your router (which is wired or wirelessly connected to your computer).You can now connect to your Pi however you like. I'm old-school, so I just SSH into the Pi using PuTTY or theSecure Shell extensionfor Chrome.Remember the username ispiand the password israspberry. After you connect, make sure to change the password with passwd, and then update your Pi with the following commands.sudo apt-get updatesudo apt-get upgradesudo apt-get dist-upgradeStep 3: Ubertooth InstallationIf you aren't planning on using Ubertooth hardware, you should still follow these steps or Blue Hydra may not run correctly. If you are using an Ubertooth, make sure to plug it in before we start, as it may need a firmware update. Unfortunately, Ubertooth is not in the Raspbian repository, so we have to download it manually.First, we need to install the dependencies for Ubertooth before we can build libbtbb and Ubertooth. This can take some time, but usually not much longer than 5 minutes.sudo apt-get install cmake libusb-1.0-0-dev make gcc g++ libbluetooth-dev \pkg-config libpcap-dev python-numpy python-pyside python-qt4Now, we are ready to set up the Bluetooth baseband library, libbtbb. This lets the Ubertooth decode Bluetooth packets. Download the file from Github with the command below.wgethttps://github.com/greatscottgadgets/libbtbb/archive/2017-03-R2.tar.gz-O libbtbb-2017-03-R2.tar.gzNow, unzip it, navigate to the directory, and create a build directory by typing the following.tar xf libbtbb-2017-03-R2.tar.gzcd libbtbb-2017-03-R2mkdir buildcd buildWe are now ready to use cmake to install it.cmake ..makesudo make installWonderful! Now that we have libbtbb installed, we are ready to install Ubertooth itself. Move to your home directory by typingcdand then are ready to do the same process as before to install Ubertooth file. Download it from Github.wgethttps://github.com/greatscottgadgets/ubertooth/releases/download/2017-03-R2/ubertooth-2017-03-R2.tar.xz-O ubertooth-2017-03-R2.tar.xzThen use the same process as before to install.tar xf ubertooth-2017-03-R2.tar.xzcd ubertooth-2017-03-R2/hostmkdir buildcd buildcmake ..makesudo make installLastly, move back home withcd, and if you actually have an Ubertooth device, make sure it is configured correctly withsudo ldconfigandubertooth-util -vwhich should be "Firmware version: 2017-03-R2 (API:1.02)"Now we are ready to install Blue Hydra's dependencies.Step 4: Install Blue Hydra DependenciesBlue Hydra runs on Ruby code, so first we need to check to see if we have that already installed by runningwhich ruby. If that returns "/usr/bin/ruby" or something similar then you're good to go. If you don't have it thensudo apt-get install ruby-fullStart with downloading bundlersudo gem install bundlerNow we are ready to install the long list of other dependencies required.sudo apt-get install python-bluez python-dbus sqlite3 bluez-tools ruby-dev bluez bluez-test-scripts python-bluez python-dbus libsqlite3-devStep 5: Install Blue HydraNow we are ready to clone Blue Hydra from Githubgit clonehttps://github.com/pwnieexpress/blue_hydra.gitThen we need to move to the "blue_hydra" directorycd blue_hydraBefore running the last command you should know that if you run it as root it could cause problems for other users that try to use Blue Hydra. If you only use root then you're fine, otherwise, you can use the sudo command as needed.bundle installStep 6: Run Blue HydraNow we're ready to start tracking Bluetooth devices. Make sure that you have your Ubertooth connected if you are using one. Keep in mind that the use of multiple dongles such as having an external Bluetooth dongle and Ubertooth hardware can draw a lot of power so you want to be doubly sure that you have at least a 2.5A power supply or you may run into power issues. Now move to "blue_hydra/bin/", if you're already in "blue_hydra" justcd ./binThen start the program withsudo ./blue_hydraThere are also a number of flags you can use when you run the program:-dor--daemonizesuppress Command Line Interface (CLI) output and run in background-zor--demoruns with CLI output but mask displayed macs for demo purposes-por--pulseattempt to send data to Pwn PulseYou may want to write down some quick notes about the controls before you press enter or you can just reference this screenshot.To test it out I set off to the local Starbucks, for reference you can see how crowed it was below.Hoid's local Starbucks at the time.Image by Hoid/Null ByteYou can see there are quite a few devices in this small area.My setup was nothing but the internal Bluetooth and Ubertooth hardware. With an external Bluetooth dongle and the range it offers, I could have easily detected twice as many devices. If you are wondering, I'm powering the Pi off of a battery pack and usingJuice SSHon my smartphone, Blue Hydra is being run in demo mode to help protect the privacy of the people.Step 7: Configuring OptionsThe "blue_hydra.yml" file can be edited to configure several options:log_levelIf this is set to "false" then the log files will not be created.bt_deviceThis is how you change the main Bluetooth interface, change if you're using a dongle.info_scan_rateThis is how often info scan is run in seconds.status_sync_rateThis is how often to sync device status to Pulse in seconds.btmon_logWhen True it will log filtered btmon output.btmon_rawlogWhen True it will log unfiltered btmon outputfileIf set to a file it will use it rather than live sensor datarssi_logControls if serialized RSSI values are loggedaggressive_rssiThis will aggressively send RSSIs to PulsePulse is Pwnie Express' IoT Security PlatformStep 8: Tracking with BLE FinderBlue Hydra saves to two log files, "blue_hydra.log" is where it logs all the data it collects, which is more than it shows on the user interface, this is how it tracks devices over time. The second, "blue_hydra_rssi.log" is where it logs signal strength which can be used to find the distance to the Bluetooth device. For example, you could make asimple python scriptthat alerts you when a certain device is close by, just as the Hacker Warehouse team did. Let's download it and take a look at it.First move to the Blue Hydra directory,cd ~/blue_hydraand then download the Python programwgethttps://raw.githubusercontent.com/hackerwarehouse/ble_finder/master/ble_finder.pyThe Python program uses the tailer module as well, so we need to get that withpip install tailerNow we need to make sure that Blue Hydra is saving the RSSI log file so lets use nano to open the configuration file mentioned before.sudo nano blue_hydra.ymlthen setrssi_log trueThen save withCtrl + XandYthenEnter. The only thing for us to do now is tell the script which Mac IDs to look for. To do that lets open the python file with nano.sudo nano ble_finder.pyif you have trouble opening it with nano just restart the pi withsudo rebootfind the devices list and edit it to the MAC IDs of your choice, remember it is case sensitive. If you want more than, you can just expand the list with ['MAC ID', 'Name', ' '],Below this you can also set how often it reports, the default is 45 seconds.While you are here you may want to go over the code. The program checks the RSSI log for the MAC IDs from our list. When you're done, save just like before withCtrl + XandYthenEnter.Now let's put it in action withcd blue_hydra/bin/and then usesudo ./blue_hydranow open another shell and move to Blue Hydra withcd blue_hydrathen runpython ble_finder. If all is working properly you'll see something like this.Put It to Use for YourselfNow that you have the basics, you can do something much more advanced. Say you wanted to get into a high-level executive's office, but you need to know when they are there. You could put a Pi running Blue Hydra, and set some code to email me when his Fitbit leaves the office.Don't Miss:How To Hack BluetoothYou could also set up a trilateration program to map all the devices in the environment. Even just leaving it sitting in place can yield interesting results. The real limiting factor to Blue Hydra's usefulness is your imagination, so don't let it hold you back!Follow me onTwitterFollow Null Byte onTwitterandGoogle+Follow WonderHowTo onFacebook,Twitter,Pinterest, andGoogle+Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image by Kody &mecha_ariesScreenshots by Hoid/Null ByteRelatedHow To:Target Bluetooth Devices with BettercapHow To:Detect BlueBorne Vulnerable Devices & What It MeansNews:Bluetooth 5.1 Adds Precision Location, Offers Beacons for Indoor Navigation & More Augmented Reality ExperiencesNews:Myo Lets You Control All Your Gadgets Like a JediHow To:Automate Tasks on Your Mac Whenever You Come or Leave Home via BluetoothHow to Hack Bluetooth, Part 1:Terms, Technologies, & SecurityHow To:Find Out if Your Mac Can Support Continuity's Handoff FeatureHow To:16 Tips for Staying Awake When You're TiredHack Like a Pro:How to Crack Online Passwords with Tamper Data & THC HydraThe Hacks of Mr. Robot:How to Hack BluetoothHow To:Track Your Lost iPhone, iPad, or Mac Even When Its Offline — As Long as This Feature Is EnabledAndroid Basics:How to Connect to a Bluetooth DeviceHow To:5 Ways to Improve the Bluetooth Experience on Your Samsung GalaxyBT Recon:How to Snoop on Bluetooth Devices Using Kali LinuxHow To:Use U2F Security Keys on Your Smartphone to Access Your Google Account with Advanced ProtectionHow To:Detect unknown devices with Windows' Device ManagerHow To:Bypass Android's File Type Restrictions on Bluetooth File SharingHow To:No-Bake Energy Bites Are the Perfect On-the-Go Snack for SummerHow To:Connect a PS4 Controller to Your Mac for Improved GameplayHow To:5 Wireless Headphones That'll Pair Perfectly with Your Galaxy Note 10How To:Play Music on 2 Devices Using Your Samsung Galaxy PhoneHow To:What All the Bluetooth & Wi-Fi Symbols Mean in iOS 11's New Control Center (Blue, Gray, or Crossed Out)How To:Fix Google Now Bluetooth Problems on Your Samsung Galaxy Note 2 or Other Android DeviceHow To:Hack Wireless Router Passwords & Networks Using HydraNews:Weekly Challenge 4. The HydraMaking Electromagnetic Weapons:Directed Microwave EnergyHow To:iOS 13 Has Radically Improved Connecting to AirPods & Bluetooth DevicesMaking Electromagnetic Weapons:Flashlamp LasersHow To:How a Home Energy Audit Can Lower Your Energy CostsNews:OmnicronNews:Collections OverviewNational Ignition Facility:Big, Giant Lasers of Doom... Or Endless Energy?How To:Read Your Inital Bounce Energy BillNews:Panasonic's New Millimeter-Wave Radar Technology Could Save Lives at IntersectionsNews:The Bounce Energy BlogNews:Bounce Energy's Rewards ProgramHow To:How Much Energy Is Your Home Using? Test It!News:Bounce Energy Races for The CureNews:Collections that give you Energy and XP