Bluetooth device hacking

Choosing a busy place allows them to remain undetected and to monitor the same devices which pass by regularly. Hackers may also choose places where people linger for several hours like cafes, pubs and restaurants. Dorset Police recently discovered an instance of bluebugging in the busy seaside town of Bournemouth. Local residents began reporting incidents where they were receiving automated messages and files from unknown senders as they walked through the city.

Dorset Police issued some guidance to Bournemouth residents — advice that we can all use to avoid becoming victims of bluebugging. First, disable Bluetooth on your devices whenever it is not in use. Second, disable file-sharing services that rely on Bluetooth like AirDrop or Fast Share unless you are sending or receiving files from a trusted friend.

Limiting access to Bluetooth services makes it much harder if not impossible to be a victim of bluebugging. Finally, ensure you have an antimalware ap p installed on your smartphone, tablet and Bluetooth-enabled computers. In the event that a hacker does try to break into your device, the antimalware app will detect and block suspicious activity, protecting your privacy and personal data.

Fortunately, bluebugging attacks are still not very common — but that could quickly change. Panda Security specializes in the development of endpoint security products and is part of the WatchGuard portfolio of IT security solutions.

Initially focused on the development of antivirus software, the company has since expanded its line of business to advanced cyber-security services with technology for preventing cyber-crime. Make a conscious effort to switch off your bluetooth when not in use. Hackers are constantly in search of unsuspecting people who have forgotten to turn off their bluetooth.

So beware of this, especially in public areas and spaces. Since it is effortless for hackers to pick and steal all your private information once they have hacked your bluetooth, be very mindful when sharing any confidential information.

Do not share any passwords, bank details, photos, and addresses via bluetooth. When you have to pair your device be a hundred percent sure of the other device you will be pairing. Do not allow any unknown devices to pair with your device. If you need to share any data with a known person, try pairing your devices in the comfort of your private space.

Avoid pairing your devices in public places. Also, once you have successfully shared and transferred all the data, be particular about unpairing your device. The majority of the tech companies realize any bugs or shortcomings of their device software once the public starts using the gadget.

The companies then roll out updates to fix these bugs. So always keep your device updated to protect it against any cyber virus attacks and hackers. There are always advantages and disadvantages of advancing technology. Even the strongest cryptographic protocol has been known to fail due to the random number generator not being "random enough. Thus, it can be said that the security of BLE lies in the hands if its implementers. While all Bluetooth Low Energy devices were developed with the principal motive of enhancing user experience, did security take a backseat during the process?

This is responsible for the connections and advertising in BLE. GAP is responsible for the visibility of a device to the external world and also plays a major role in determining how the device interacts with other devices. The following two concepts are integral to GAP:.

Peripheral devices : These are small and low energy devices that can connect with complex, more powerful central devices. Heart rate monitor is an example of a peripheral device. Central devices : These devices are mostly cell phones or gadgets that have an increased memory and processing power.

The peripheral device will send an advertising data once every 2 seconds. If the central device is ready to listen to the advertisement packets, it will respond with a scan response request. In response to this request, the peripheral device will send a scan response data.

Thus, the central and peripheral device gets advertised and connected with each other. Making use of a generic data protocol known as Attribute Protocol, GATT determines how two BLE devices exchange data with each other using concepts - service and characteristic.

This protocol stores all the service and characteristic in a lookup table using a 16 bit IDs as specified by the Bluetooth SIG. Services Services are simply defined as a cabinet which can hold many drawers in it, which in turn are called as characteristics. A service can have many characteristics. Each service is unique in itself with a universally unique identifier UUID that could either be 16 bit in size for official adapted services or bit for custom services.

Characteristics contain a single data point and akin to services, each characteristic has a unique ID or UUID that distinguishes itself from the other characteristic. For example HRM sensor data from health bands etc. Linux offers the best support for BLE. In order to use BLE, we need to install the bluetooth stack blueZ. It can be installed by running. This device will work as the central gateway for communicating with other peripheral devices. Before starting, we need to scan for BLE devices in our vicinity.

For these purposes, the hcitool is indispensible. In order to find out the relevant services and characteristics, one may use a gatttool. GATT stands for Generic Attribute and defines a data structure for organizing characteristics and attributes. We can discover, read, and write characteristics using gatttool. After obtaining the address of the BLE device we need to connect to it and this is when we use gatttool. In case of devices that only connect with phones and not to a computer, the above steps might not work.

In order to connect with such devices, we need to use a random address. After successful connection, we can see the services and characteristics of the device using the commands. We can also filter the displayed handles to a particular range using a command like char-desc 01 05 which displays 5 handles from 1 to 5. In order to write to a specific handle, we need to know which one is a write handle.

For this, we can go for a hit and try method and try reading all the handles one by one until we encounter a read error. A read error means the specific handle is a write handle write handles cannot be read. Alternatively, apps like such as nrf connect can automatically figure out the write handles.