bluetooth

602 Articles

Bluetooth As Proxy For Occupancy

December 13, 2023 by 59 Comments

During [Matt]’s first year of college, he found in a roundabout way that he could avoid crowds in the dining hall by accessing publicly available occupancy data that the dining hall collected. Presumably this was data for the dining hall to use internally, but with the right API calls anyone could use the information to figure out the best times to eat. But when the dining hall switched providers, this information feed disappeared. Instead of resigning himself to live in a world without real-time data on the state of the dining hall, he recreated the way the original provider counted occupancy: by using Bluetooth as a proxy for occupancy.

Bluetooth devices like smartphones, fitness sensors, and other peripherals often send out advertising packets into the aether, to alert other devices to their presence and help initiate connections between devices. By sniffing these advertising packets, it’s possible to get a rough estimate of the number of people in one particular place, assuming most people in the area will be carrying a smartphone or something of that nature. [Matt]’s Bluetooth-sniffing device is based on the ESP32 set up to simply count the number of unique devices it finds. He had some trouble with large crowds, though, as the first ESP32 device he chose didn’t have enough RAM to store more than a few hundred IDs and would crash once the memory filled. Switching to a more robust module seems to have solved that issue, and with a few rounds of testing he has a workable prototype that can run for long periods and log at least as many Bluetooth devices passing by as there are within its range.

While [Matt] hasn’t deployed this to the dining hall yet, with this framework in place most of the work has been done that, at least in theory, one of these modules could be easily placed anywhere someone was interested in collecting occupancy data. He has plans to submit his project to the university, to research the topic further, and potentially sell these to businesses interested in that kind of data. This isn’t an idea limited to the ESP32, either. We’ve seen similar projects built using the Raspberry Pi’s wireless capabilities that perform similar tasks as this one.

Thanks to [Adrian] for the tip!

Update On The BLUFFS Bluetooth Vulnerability

December 2, 2023 by 14 Comments

As we first reported in yesterday’s weekly security post, researchers at EURECOM have revealed the details (PDF, references) of a new man-in-the-middle (MITM) attack on Bluetooth 4.2 through 5.4, which has been assigned CVE-2023-24023. Like preceding CVEs, it concerns the session authentication between Bluetooth devices, where the attacker uses spoofed paired or bonded devices to force the use of a much shorter encryption key length.

The name of this newly discovered vulnerability is BLUFFS (Bluetooth Forward and Future Secrecy), where forward and future secrecy are important terms that refer to the protection of secure sessions against compromise in the past (forward, FoS) and future (FuS). The CVE presentation notes that the Bluetooth specification does not cover either FuS or FoS. In total two new architectural vulnerabilities were discovered, both of which attack the security key.

The Bluetooth SIG has released a statement regarding this attack method. Although serious, it would seem that the core issue is that some implementations allow for encryption key lengths below 7 octets:

Continue reading “Update On The BLUFFS Bluetooth Vulnerability” →

This Week In Security: Owncloud, NXP, 0-Days, And Fingerprints

December 1, 2023 by 18 Comments

We’re back! And while the column took a week off for Thanksgiving, the security world didn’t. The most pressing news is an issue in Owncloud, that is already under active exploitation.

The problem is a library that can be convinced to call phpinfo() and include the results in the page response. That function reveals a lot of information about the system Owncloud is running on, including environment variables. In something like a Docker deployment, those environment variables may contain system secrets like admin username and password among others.

Now, there is a bit of a wrinkle here. There is a public exploit, and according to research done by Greynoise Labs, that exploit does not actually work against default installs. This seems to describe the active exploitation attempts, but the researcher that originally found the issue has stated that there is a non-public exploit that does work on default installs. Stay tuned for this other shoe to drop, and update your Owncloud installs if you have them. Continue reading “This Week In Security: Owncloud, NXP, 0-Days, And Fingerprints” →

Converting Bluetooth Sensors To Zigbee

November 29, 2023 by 19 Comments

With the increase in popularity of Internet of Things (IoT) devices and their need to communicate wirelessly,  there’s been a corresponding explosion of wireless protocols to chose from. Of course there’s Wi-Fi and Bluetooth, but for more specialized applications there are some other options like Z-Wave, LoRa, Sigfox, and Thread. There’s a decent amount of overlap in their capabilities too, so when [SHS] was investigating some low-cost Xiaomi sensors it was discovered that it is possible to convert them from their general purpose Bluetooth protocol over to the more IoT-specialized Zigbee protocol instead.

These combination temperature and humidity sensors have already been explored by [Aaron Christophel] who found that it’s possible to flash these devices with custom firmware. With that background, converting them from Bluetooth to Zigbee is not a huge leap. All that’s needed is the Zigbee firmware from [Ivan Belokobylskiy] aka [devbis] and to follow the steps put together by [SHS] which include a process for flashing the firmware using an over-the-air update and another using UART if the wireless updates go awry. Then it’s just a short process to pair the new Zigbee device to the network and the sensor is back up and running.

Converting from one wireless protocol to another might not seem that necessary, but using Bluetooth as an IoT network often requires proxy nodes as support devices, whereas Zigbee can communicate directly from the sensor to a hub like Home Assistant. Other Zigbee devices themselves can also act as a mesh network of sorts without needing proxy nodes. The only downside of this upgrade is that once the Bluetooth firmware has been replaced, the devices no longer has any Bluetooth functionality.

Thanks to [RoganDawes] for the tip!

The Best-Sounding Walnut You’ll Hear Today

November 2, 2023 by 17 Comments

Do you ever find yourself eating walnuts and think, this would make a great enclosure for something like a Bluetooth speaker? That seems to be exactly what happened to [Penguin DIY].

In the mesmerizing video after the break, you’ll see [Penguin DIY] do what seems to be impossible. They start with a tiny 5 V power bank module which is still not small enough to fit, so they remove all the components and dead-bug them back together.

This is really just the beginning. There of course has to be a female USB of some type, so [Penguin DIY] Dremels out the perfect little slot for it.

They did manage to stack and fit a MH-MH18 Bluetooth audio module and an HXJ8002 mini audio amplifier module in the walnut, but of course, it took a lot of fiddly wiring to extend the LEDs and wire them up.

Then in the other half of the shell went the 4Ω 2 W mini speaker. [Penguin DIY] of course drilled a ton of little holes in the shell for the sound to come through. Also on this side are three tiny switches for play/pause and previous and next track, and the latter two can be long pressed to control the volume. Definitely check this out after the break.

Do the notifications of your Bluetooth speaker annoy you? There’s a hack for that.

Continue reading “The Best-Sounding Walnut You’ll Hear Today” →

Blatano Art Project Tracks Devices In Its Vicinity

October 26, 2023 by 2 Comments

Computers, surveillance systems, and online agents are perceiving us all the time these days. Most of the time, it takes place in the shadows, and we’re supposed to be unaware of this activity going on in the background. The Blatano art piece from [Leigh] instead shows a digital being that actively displays its perception of other digital beings in the world around it.

The project is based on an ESP32, using the BLE Scanner library to scan for Bluetooth devices in the immediate vicinity. Pwnagochi and Hash Monster tools are also used to inspect WiFi traffic, while the CovidSniffer library picks up packets from contact-tracking apps that may be operating in the area.

This data is used to create profiles of various devices that the Blatano can pick up. It then assigns names and little robotic images to each “identity,” and keeps tabs on them over time. It’s an imperfect science, given that some devices regularly change their Bluetooth identifiers and the like. Regardless, it’s interesting to watch a digital device monitor the scene like a wallflower watching punters at a house party.

If you’ve built your own art-surveillance devices to comment on the state of modernity, don’t hesitate to drop us a line!

Bluetooth Device Visualizer Reveals Devices In Vicinity

October 21, 2023 by 2 Comments

Have you ever wondered how many Bluetooth devices are floating around you? You could use one of those creepy retail store Bluetooth tracking systems, or set your smartphone to scan. Alternatively, you could use the Bluetooth Devices Visualizer from [Jeremy Geppert].

The device was inspired by [Jeremy’s] trip to Hackaday Supercon 2022. Wanting to build something with LEDs that worked in a badge-like form factor, he set out on whipping up a device to scan and display a readout of Bluetooth devices in the immediate area.

The device is based on an ESP32 microcontroller, which provides the necessary Bluetooth hardware to scan for devices. It then displays the number of devices found using an 8 x 8 array of addressable LEDs. There is also a small OLED display on board for displaying relevant details to the device’s operation. The device neatly fits on a lanyard, and is more of an art project than anything else. It’s no wardriver, and details of devices found are not logged or stored in any way when the device is switched off.

With a variety of operational modes, it’s a fun way to get an idea of just how many Bluetooth devices are really out there these days. If you’ve got your own nifty Bluetooth hacks in the works, don’t hesitate to let us know!