[Infratech - release] version 0.6 de Bluetooth Stack Smasher

Par Pierre Betouin, secuobs.com
Le 05/02/2006

---

Résumé : BSS (Bluetooth Stack Smasher) est un outil développé dans le but est d'effectuer différents tests sur les périphériques Bluetooth. BSS doit pouvoir effectuer ses tests de façon entièrement transparente pour les périphériques audités (aucune demande de pairing). - Lire l'article



BSS v0.6 could be downloaded on lien (sha1sum bss-6.0.tar.gz 5aa002797cfc56c69e2738967818eb21639250c1 )






Recently, Bluetooth security has become a new source of interest for many people involved in IT security. Although forsaken by now - in particular for short ranges reasons - Bluetooth security touches more and more people : almost every device manufactured nowadays has a native Bluetooth support : cellular phones, laptops, digital assistants, cameras...

Mobility evolution allows almost all users to get an instant connection wherever they want, whenever they require it, to check mails, chat, or link their devices together (headsets, GPS systems, and so on). This unquestionably creates new security threats. If security was still so obscure for many people few years ago, it should now be considered by everyone owning a wireless capable device (802.11, Bluetooth...).

Who wouldn't care about getting huge phone bills, revealing his address book or calendar to anyone, or being owned walking in the street or drinking a coffee in a pub ?

Trifinite group was the first to reveal Bluetooth attacks, such as BlueBug or BlueSnarf. This paper describes existing attacks, and introduces a new way to assess Bluetooth enabled devices using a low lever fuzzer. Security on such devices is indeed very difficult to estimate because of the use of proprietary technologies. Security analysis can be lead by using reverse engineering techniques (disassembly for instance) but fuzzing remains the quickest and easiest way to "stress" Bluetooth implementations.

Exhaustive analysis won't be realized using the fuzzer presented below : deeper studies would require a complete disassembly work but I have been really astonnished of the number of devices crashing or presenting irrational behaviours.

BSS (Bluetooth Stack Smasher) is a L2CAP layer fuzzer, distributed under GPL licence. Current version is 0.6.

BSS requires the standard bluetooth library.


BSS Usage

Usage: ./bss [-s size] [-m mode] [-p pad_byte for modes 1-11] [-M maxcrash]
Modes :
0 All mode listed below
1 L2CAP_COMMAND_REJ
2 L2CAP_CONN_REQ
3 L2CAP_CONN_RSP
4 L2CAP_CONF_REQ
5 L2CAP_CONF_RSP
6 L2CAP_DISCONN_REQ
7 L2CAP_DISCONN_RSP
8 L2CAP_ECHO_REQ
9 L2CAP_ECHO_RSP
10 L2CAP_INFO_REQ
11 L2CAP_INFO_RSP
12 L2CAP Random Fuzzing (-s: max_size) (-M: crashcount)


BSS Example

./bss -s 100 -m 12 -M 0 XX:XX:XX:XX:XX:XX

This example sends short random (mode 12) packets (maxsize is set to 100 bytes), in an infinite loop (-M 0).

Performs several L2CAP checks sending malicious packets (L2CAP)

Initial source code analysis from tanya tool (tbear)

Other example of use (short random L2CAP packets):

./bss -s 50 -m 12 00:12:EE:XX:XX:XX
.......

00:12:EE:XX:XX:XX BT stack may have crashed. This device seems to be vulnerable to buggy packets. Please, ensure that the device has really crashed doing a bt scan for instance.

Host 00:12:EE:XX:XX:XX
Packet size 11

Packet dump

0x75 0x3F 0x1E 0x3B 0x0B 0xBD 0xC4 0x98 0xBB 0x72 0xD0

char replay_buggy_packet[]="\x75\x3F\x1E\x3B\x0B\xBD
\xC4\x98\xBB\x72\xD0";

Then, try to ensure that this packet is responsible (and only this one :sometimes, cellphones crash because of multiple packets, or flooding effects) :

cd replay_packet

Edit replay_l2cap_packet.c and modify SIZE and replay_buggy_packet :

#define SIZE 11
char replay_buggy_packet[]="\x75\x3F\x1E\x3B\x0B\xBD
\xC4\x98\xBB\x72\xD0";

Then, type make :

make

and try this packet against your equipment :

./replay_l2cap_packet 00:12:EE:XX:XX:XX


TIPS

* In order to benchmark BT implementation, you may want to use time command :
time ./bss -m 12 00:12:EE:XX:XX:XX

* You may increase -M value, which allows you to go on fuzzing even if some packets have not been sent to the equipment : some devices may crash because of flooding for instance. 0 means an infinite loop.


Related links

Download BSS v0.6 - lien (sha1sum bss-6.0.tar.gz 5aa002797cfc56c69e2738967818eb21639250c1 )
Article on "Bluetooth insecurity" (French) - lien
Sony/Ericsson DoS advisory lien
Sony/Ericsson display reset exploit - lien
hcidump DoS advisory lien
hcidump Proof of Concept - lien