In this post, we are going to discuss how to exploit a Bluetooth Low Energy (BLE) smart bulb using BtleJuice by performing a Man-in-the-Middle (MiTM) attack. The techniques explored in this blog post equally applies to other BLE based smart devices.
The things that we are going to cover include:
- Installing BtleJuice
- Analyzing all the Intercepted GATT operations running on target device
- Performing a Man-in-the-middle attack using GATT operations
- Exporting data to a file
In order to get started, we shall need the following items:
- A BLE Based IoT Smart Bulb
- Two Bluetooth Adapters
- Node.js > 4.3.2
- Virtual Machine (VMware/Virtual Box)
BtleJuice is a framework to perform MiTM attacks on BLE devices. BtleJuice is composed of two components - an interception proxy and a core. These two components are required to run separately on two systems each having a Bluetooth 4.0+ adapter attached. Rather than using two separate physical machines, we'll use one physical machine and another Virtual Machine(VM) running on the same host. One of the adapters will be attached to the host and the other to the VM. Install BtleJuice on both the host and the VM following the steps below.
Step 2: Install the dependencies of BtleJuice using the package manager.
sudo apt-get install bluetooth bluez libbluetooth-dev libudev-dev
Step 3: Install Btlejuice.
npm install -g btlejuice
Setting up BtleJuice proxy (in VM)
Step 1: Attach the bluetooth adapter to the VM and run
service bluetooth start
Step 2: Run
hciconfig to ensure that the adapter is functioning as expected.
Step 3: Launch
btlejuice-proxy in the vm.
Step 4: Find out the IP address of VM so that we can connect to it from the host. Alternatively run
ifconfig in a terminal to know the IP.
Setting up BtleJuice core (on host)
Step 1: Open a terminal on the host and run
Step 2: Stop the bluetooth service by running
sudo service bluetooth stop.
Step 3: Plug-in the bluetooth adapter on the host machine.
Step 4: Ensure that the Bluetooth adapter attached to the host is working by running
Step 5: Turn on the bluetooth adapter by running
sudo hciconfig hciX up where
X is bluetooth adapter number obtained in the previous step.
Step 6: Now we need to run the BtleJuice core and connect with the virtual machine.
sudo btlejuice -u <VM IP address> -w
u is the IP address of the VM where
btlejuice-proxy is running and
w means to start the web interface.
btlejuice-proxy running in the VM, would display a client connected message.
Step 7: Once BtleJuice core running on the host is successfully connected to
bltjejuice-proxy, open a web browser and navigate to
Step 8: Click on the "Select Target" button represented by the Bluetooth icon. A dialog box will appear which will display all the available bluetooth devices detected by the core.
Step 9: Double click on the desired target device and wait for the interface to be ready (the bluetooth button aspect will change).
Step 10: Connect the associated mobile application with the dummy device just created.
Step 11: If the connection succeeds, a connected event would be displayed on the main interface.
Performing Man-in-the-middle attack by replaying GATT operations
BtleJuice acts as a proxy between the mobile application and the BLE smart bulb. Any command sent to the bulb will be captured by BtleJuice and relayed to the Bulb. Let's interact with the bulb using the mobile application and try to decipher the way the commands are structured.
Step1: Change the bulb color to Blue using the android app. RGB value of Blue is 2, 0, 255.
BtleJuice captures the corresponding packets.
Now change the bulb color to red with RGB value 255, 8, 0.
BtleJuice capture the packets corresponding to the command for changing the color to red.
Inspecting the packets, we can notice a pattern. The RGB value of the color as displayed on the app matches with the second, third, and fourth byte in the capture. Thus, if this packet is replayed after changing any of these bytes, we should be able to get a different color.
Step 2: From the list of captured packets, right click on a color change command and click replay.
Step 3: Change the color bytes in the data value from
8c 86 ff to any other value say
8c 45 ff which is a color with a purple tinge.
Step 4: Click on the Write button. We'll notice that the bulb color changes to purple.
Exporting the captured data
BtleJuice can export the captured data to a file so that it can be used later or analyzed in other tools. To start exporting, click on the export button and download a JSON (or text) version of the intercepted data.
So far we've demonstrated the use of BtleJuice as a standalone tool. BtleJuice also offers NodeJS and Python bindings which we can use in our own tool for BLE attacks. For more information on these bindings visit here.