+ All Categories
Home > Documents > Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking...

Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking...

Date post: 10-Jul-2020
Category:

Documents
Upload: others
View: 2 times
Download: 0 times
Download Report this document
Share this document with a friend
57
Hacking BLE Bicycle Locks for Fun & A Small Profit
Transcript
Page 1: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

Hacking BLE Bicycle Locks for Fun & A Small Profit

Page 2: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

1

Page 3: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

whoami

• From Sunny Singapore

• Senior Security Consultant @ MWR

• Mobile and Wireless Geek

– BlackHat USA 2016 – Bad for Enterprise: Attacking BYOD Enterprise Mobile Security Solutions

2

Page 4: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

Bike-Sharing Economy and the BLE “Smart” Lock

1

Overview

3

Building a “Master” Key3

Demo

4

Analyzing Communications2

Page 5: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON
Page 6: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

Major Players

Page 7: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

Major Players

6

Country China China SingaporeFounded 2014 2015 2017

Operations 20 Countries 16 Countries 22 CountriesValuation $2 Billion $2.7 Billion

Cost SGD$0.50/30min

Page 8: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

Bluetooth Low Energy

Generic Access Profile (GAP)• Peripheral

Small low powered devicee.g. bicycle lock

• CentralHigh powered computing devicee.g. Mobile Phone

Page 9: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

Bluetooth Low Energy

8

Generic Attribute Profile (GATT)• Services

Groups of Characteristics16/128-bit UUID

• CharacteristicsA single data point16/128-bit UUID

Page 10: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

Bluetooth Bicycle Lock

9

Page 11: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

Personal BLE Bicycle Lock

Page 12: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

Major Components

11

Page 13: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

Lock Decomposition

Page 14: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

Motor to release lock

Logic Controller /

BLE

Page 15: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

Notch

Spring Mechanism

Notch

Pin

Page 16: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

15

Page 17: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

Ubertooth One – Wireshark Capture

Page 18: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

What do I need?

1.Communication Endpoints

2.Understanding the Data

17

Page 19: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

BLEAH - Services and Characteristics

Page 20: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

frida-trace

19

Page 21: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

iOS CoreBluetooth

CBPeripheral• Remote peripheral devices that the app has discovered advertising or is currently connected

to.• -m "*[CBPeripheral readValue*]"

• -m "*[CBPeripheral writeValue*]"

• -m "*[CBPeripheral setNotifyValue*]"

CBPeripheralDelegate• Provides methods called on events relating to discovery, exploration, and interaction with a

remote peripheral.• -m "*[* *didUpdateNotificationStateForCharacteristic*]"

• -m "*[* *didUpdateValueForCharacteristic*]"

20

Page 22: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

Summary…

Scan QR Code01

02Get Lock Key From Server

04Request Encrypted Token

05Gets Encrypted Token

06Decrypt Token & Unlock!

03Server Responds with Lock Key

Page 23: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON
Page 24: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

oBike

23

Page 25: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

oBike Lock

oBike lock teardown and rebuild, dockless share bike rescue: https://youtu.be/Vl3Gl8w8n-Q

https://youtu.be/Vl3Gl8w8n-Q
Page 26: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON
Page 27: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

02App Checks Lock Status. Uploads Coordinates.

04App Requests Key Source

05App Gets Key Source

06Request Unlock Key

07Server Responds with Unlock Key

08Unlock Bike Lock

03Server Responds with Lock Status

http://www.o.bike/download/app.html?m=06500206401

Page 28: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

POST /api/v2/bike/060511449/lockNo HTTP/1.1Host: mobile.o.bikeContent-Type: application/jsonversion: 3.2.4

{"deviceId":"1521828969000-8035385","dateTime":"1521984609867.631836","longitude":103.8XXXXXXXX,"latitude":1.3XXXXXXXX

}&58bc93f4ac249b829174520a5afe73

02App Checks Lock Status. Uploads Coordinates.

http://www.o.bike/download/app.html?m=06500206401

Page 29: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

03Server Responds with Lock Status

HTTP/1.1 200Content-Type: application/json;charset=UTF-8Connection: closeVary: Accept-EncodingContent-Length: 93

{"data":{"lockNo":"639BADF22","lockType":2,"faultBike":false},

"success":true,"errorCode":100}

Page 30: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

]16506 ms | -[CBPeripheral setNotifyValue:0x1 forCharacteristic:

CBCharacteristic: 0x1704ae100 UUID = FFF6,

16519 ms | | | | | | -[CBPeripheral writeValue:0x17483f980 forCharacteristic:0x1704ae100

04App Requests Key Source

Page 31: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

16774 ms -[BluetoothManager peripheral:0x1742f6080 didUpdateValueForCharacteristic:0x1704ae100

bikeId":"060511449","deviceId":“XXXXXXXXXX","dateTime":"1521984617263.854980","keySource":"c4f1dc24"}

05App Gets Key Source

Page 32: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

POST /api/v2/bike/unlockPass HTTP/1.1Host: mobile.o.bikeContent-Type: application/jsonversion: 3.2.4

{"bikeId":"060511449","deviceId":"1521828969000-8035385","dateTime":"1521984617263.854980","keySource":"c4f1dc24"

}&ad6dad370f01782adfe200584ff63be31af29069

HTTP/1.1 200Content-Type: application/json;charset=UTF-8Connection: closeVary: Accept-EncodingContent-Length: 130

{"data":{"encryptionKey":180,"keys":"8be1be17d41e8fdff1ae1c82e4500fec","serverTime":1521984619298

},"success":true,"errorCode":100}

06Request Unlock Key

07Server Responds with Unlock Key

Page 33: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

19108 ms | | | | | +[BluetoothSendMessage Index:0xb4Key:8be1be17d41e8fdff1ae1c82e4500fec]

19118 ms | | | | | -[CBPeripheral writeValue:0x174a54340 forCharacteristic:0x1704ae100

19127 ms | | | | | -[CBPeripheral writeValue:0x174a53ef0 forCharacteristic:0x1704ae100

08Unlock Bike Lock

Page 34: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

Unlock Algorithm

Message 1??? Static Message Length Command67 74 18 82

Message 2AES Key (Truncated) BCC8b e1 be 17 d4 1e 8f df f1 ae 1c 82 ff

Index:0xb4Key:8be1be17d41e8fdff1ae1c82e4500fec

Key Index ??? Static Date Timeb4 00 00 02 79 40 48 00 6b a4 b7 5a

BCC Calculation:

for i in bytearr {x ^= i

}return x

bytearr = Command … AES Key

Page 35: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

HTTP Message Encryption

POST /api/v2/bike/060511449/lockNo HTTP/1.1Host: mobile.o.bikeContent-Type: application/jsonversion: 3.2.4Authorization: Bearer *****

{"value":"68693cfa10579681d81837350843342d99f0ba4373f9926c53c1f1c88576304d0b936e7003888288fe949e73eb1d3267b713d2b261829ee0498523423d6965db28e8b99854bf2adf592e51fb9da3b77068f647b29caa5f22473ad01ec1011270a9d3a73100292b0fdf331b17b37564556df790a58489d8cad3f4dd276d5ae68a95fc7effefc998de151eeb0983ddc7216345e7682df8cf2de0d2cbf3a8b7e7c1c8f8604016c377b0195b0ab9e83c604d"}

POST /api/v2/bike/unlockPass HTTP/1.1Host: mobile.o.bikeContent-Type: application/jsonversion: 3.2.4Authorization: Bearer *****

{"value":"aa47e49f01cc740fdaa87973966799f94bf02ced7416b15f1cc7f63bf52f50f928e76c5d7f911a054188751f7243d68daef4b69b22432ec2166dc823f29de811e21f4adbfdb826748b9e2573912422b0a51f6a07a5c7be2bf7d41b56d69945c3ecf3ec94444db5abb26b8c771fe8eba91cb1a5d336cc2130bde9bcb25350250bb92c5aa880b2e6c0b3c0004c11ab0f14eb1182b78fb3dcb5eb68e61205ae5048"}

Page 36: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

HTTP Message Encryption - AES

35

9386 ms | | +[OBikeEncrypt aesEncryptString:{"deviceId":"1521828969000-8035385","dateTime":"1521984609867.631836","longitude":103.8331503422035,"latitude":1.381631386467611}&58bc93f4ac249b829174520a5afe733503f371f8]

9388 ms | | | +[OBikeEncrypt aesEncryptData:<7b226465 76696365 4964223a 22313532 31383238 39363930 30302d38 30333533 3835222c 22646174 6554696d 65223a22 31353231 39383436 30393836 372e3633 31383336 222c226c 6f6e6769 74756465 223a3130 332e3833 33313530 33343232 3033352c 226c6174 69747564 65223a31 2e333831 36333133 38363436 37363131 7d263538 62633933 66346163 32343962 38323931 37343532 30613561 66653733 33353033 66333731 6638> keyData:<6f42694f 534d5946 557a4c65 64333234>]

keyData:<6f42694f 534d5946 557a4c65 64333234> = oBiOSMYFUzLed324

oBiOSMYFUzLed 324AES Key

Page 37: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

HTTP Message Encryption – SHA1Sum

36

POST /api/v2/bike/unlockPass HTTP/1.1Host: mobile.o.bikeContent-Type: application/jsonversion: 3.2.4

{"bikeId":"060511449","deviceId":"1521828969000-8035385","dateTime":"1521984617263.854980","keySource":"c4f1dc24"

}&ad6dad370f01782adfe200584ff63be31af29069

{"bikeId":"060511449","deviceId":"1521828969000-8035385","dateTime":"1521984617263.854980","keySource":"c4f1dc24"

}&

oBiOSX4buhBMG 324

Page 38: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

08Unlock Bike Lock

09Lock Status & Start Timer

10Lock Status & End Timer

… continued …

11You have been billed $$$

Page 39: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

oBike Demo

38

Page 40: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

Retrieving Firmware… /

40

Page 41: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

MoBike

41

Page 42: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON
Page 43: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

02App Checks Lock Status. Uploads Coordinates.

04Server Responds with Unlock Key

03Server Responds with Lock Status

http://www.mobike.com/download/app.html?b=A1234567

01

05Unlock Bike Lock

Page 44: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

05Unlock Bike Lock

06Lock Status & Start Timer

07Lock Status & End Timer

08You have been billed $$$

… continued …

Page 45: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

HTTP Message Integrity Check

45

POST /api/v2/rentmgr/unlockBike.do?sign=b9441790c2e3c42a57b439b51995f546 HTTP/1.1Host: app.mobike.comtime: 1530100847000mobileNo: +6512345678accesstoken: XXXXXXXXXXXXXXXXplatform: 0Content-Type: application/x-www-form-urlencodedConnection: closeContent-Length: 445

accesstoken=XXXXXXXXXXXXXXXX&bikecode=A0000XXXXX&biketype=0&btEnabled=1&channel=1&client_id=ios&epdata=Es7dCTkXiZ1IV3H6z%2BS9R%2BYzRjFby0T4ADUNKh0aXm6wfZzfJtQEQ5IC%2By5lZYGKFVy8I9vP6wwvkKCEqxNSMMCM3WespduyU8Svj7qyadFV4pN/nbC1behZa7ew3V0G8ofy6udhTkjbWLcjWeWvioJwrELB24aALccUKxCoMds%3D&latitude=1.3XXX&longitude=103.8XXX&mobileNo=+6512345678&time=1530100847000&timestamp=1530100847.123456&userid=XXXXXXXXX

Page 46: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

HTTP Message Encryption

46

30714 ms | +[RSA encryptString:XXXXXXXXXXuseridXXXXXXX#1530031691.737942

]

enter mbk_lowercaseMd5 -> accesstoken=XXXXXXXXXX&bikecode=A0000XXXXX&biketype=0&btEnabled=1&channel=1&client_id=ios&epdata=Es7dCTkXiZ1IV3H6z+S9R+YzRjFby0T4ADUNKh0aXm6wfZzfJtQEQ5IC+y5lZYGKFVy8I9vP6wwvkKCEqxNSMMCM3WespduyU8Svj7qyadFV4pN/nbC1behZa7ew3V0G8ofy6udhTkjbWLcjWeWvioJwrELB24aALccUKxCoMds=&latitude=1.381585998461937&longitude=103.8330852148159&mobileNo=+65XXXXXXXX&time=1530031691000&timestamp=1530031691.737942&userid=XXXXXXXXX@iossecret

leave mbk_lowercaseMd5 -> b9441790c2e3c42a57b439b51995f546

Page 47: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

02App Checks Lock Status. Uploads Coordinates.

POST /api/v2/rentmgr/unlockBike.do?sign=9623f419340536f95c314d81c4c2b548 HTTP/1.1

bikecode=A0000XXXXX&biketype=0&btEnabled=1&channel=1&client_id=ios&epdata=ML1G%2BNjHnhzQPMoRZwtBx5k3c0yOBpBFZKePvb3WsR0%2BWBvtT7saxcwIwbI6JAkG27HGjWKMGjeCwUyvw1zOgOA17Lybmbv30ltfBwUkeFmpgklpG2YMEgFEEdCjYxhskfMtoLKWCz3WFBriiZ5S6yHnH5aT1yKe/YB7mMo1f0U%3D&latitude=1.3XXX&longitude=103.8XXXX&timestamp=1530096030.920647&userid=XXXXX

http://www.mobike.com/download/app.html?b=A1234567

01

Page 48: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

03Server Responds with Lock Status

Faulty

HTTP/1.1 200Content-Type: application/json;charset=UTF-8Connection: close{

..."message": "Our apologies, this bike needs

maintenance, please use another one",...}

Good

HTTP/1.1 200Content-Type: application/json;charset=UTF-8

Connection: close

{...

"authkey": "","data":

"001BB441CB88B4034565E1C7BE448CD4B3D9F5CAA8452A23235201",

...}

04Server Responds with Unlock Key

Page 49: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

05Unlock Bike Lock

32484 ms -[MBKUnlockBikeData setData:001BB441CB88B4034565E1C7BE448CD4B3D9F5CAA8452A23235201]

35449 ms | -[CBPeripheral setNotifyValue:0x1 forCharacteristic , UUID = A000FEE1-0047-005A-0052-6D6F62696B65,

35452 ms | -[CBPeripheral setNotifyValue:0x1 forCharacteristic , UUID = A000FEE0-0047-005A-0052-6D6F62696B65,

Page 50: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

05Unlock Bike Lock

35591 ms | -[MBKPeripheral writeString:30001BB441CB88B40345]35592 ms | | -[CBPeripheral writeValue:0x17525e1b0 forCharacteristic:0x174aa46e0 type:0x0]

35666 ms | -[MBKPeripheral writeString:3165E1C7BE448CD4B3D9]35667 ms | | -[CBPeripheral writeValue:0x17145c410 forCharacteristic:0x174aa46e0 type:0x0]

35739 ms | -[MBKPeripheral writeString:32F5CAA8452A23235201]35741 ms | | -[CBPeripheral writeValue:0x17125e720 forCharacteristic:0x174aa46e0 type:0x0]

Page 51: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

Unlock Algorithm

Message 1Index ? Message33 30 001BB441CB88B40345

32484 ms -[MBKUnlockBikeData setData:001BB441CB88B4034565E1C7BE448CD4B3D9F5CAA8452A23235201]

Message 2Index ? Message33 31 65E1C7BE448CD4B3D9

Message 3Index ? Message33 32 F5CAA8452A23235201

Page 52: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

MoBike Demo

55

Page 53: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

In Summary…

57

Page 54: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

2 Types of Lock Schemes

Challenge Response1. Poll Lock for a Token

2. Send Token to Server to Request Key

3. Receive Key

4. Unlock!

58

Direct1. Request Key from Server

2. Receive Key

3. Unlock!

Page 55: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

Repeatable Process

1. Enumerate Services and Characteristics - BLEAH

2. Capture Characteristics Settings-m "*[CBPeripheral setNotifyValue*]"

3. Capture BLE Reads & BLE Writes-m "*[CBPeripheral readValue*]"-m "*[CBPeripheral writeValue*]"-m "*[* *didUpdateNotificationStateForCharacteristic*]"-m "*[* *didUpdateValueForCharacteristic*]"

59

Page 56: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

Tools Used

60

Page 57: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

61

Thank you for listening!

@Vincent_tky


Recommended
WEAPONIZING THE BBC MICRO:BIT - DEF CON CON 25/DEF CON 25 presentations/DEFCON...WEAPONIZING THE BBC MICRO:BIT ... Python code size is limited, ... DEF CON Conference, DEF CON, DEFCON,

WEAPONIZING THE BBC MICRO:BIT - DEF CON CON 25/DEF CON 25 presentations/DEFCON...WEAPONIZING THE BBC MICRO:BIT ... Python code size is limited, ... DEF CON Conference, DEF CON, DEFCON,

Documents

Crypto for Hackers - DEF CON CON 23/DEF CON 23 presentations/DEF CON 23... · Crypto for Hackers Eijah v1.00 August 7th, 2015 “Shall we play a game? ...

Crypto for Hackers - DEF CON CON 23/DEF CON 23 presentations/DEF CON 23... · Crypto for Hackers Eijah v1.00 August 7th, 2015 “Shall we play a game? ...

Documents

Hacking travel routers like it’s 1999 - DEF CON Media Server CON 25/DEF CON 25 presentations/DEF… · Hacking travel routers like it’s 1999 Mikhail Sosonkin. Mikhail Sosonkin

Hacking travel routers like it’s 1999 - DEF CON Media Server CON 25/DEF CON 25 presentations/DEF… · Hacking travel routers like it’s 1999 Mikhail Sosonkin. Mikhail Sosonkin

Documents

Network Protocol Reverse Engineering - DEF CON CON 24/DEF CON 24 presentations/DEF… · Network Protocol Reverse Engineering ... Linux, Mac •Scapy –Python based, extensible •Fuzzing

Network Protocol Reverse Engineering - DEF CON CON 24/DEF CON 24 presentations/DEF… · Network Protocol Reverse Engineering ... Linux, Mac •Scapy –Python based, extensible •Fuzzing

Documents

Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

Documents

Cracking Cryptocurrency Brainwallets - DEF CON CON 23/DEF CON 23 presentations/DEF… · Cracking Cryptocurrency Brainwallets Ryan Castellucci ... pass a file with pubkeyhashs, ...

Cracking Cryptocurrency Brainwallets - DEF CON CON 23/DEF CON 23 presentations/DEF… · Cracking Cryptocurrency Brainwallets Ryan Castellucci ... pass a file with pubkeyhashs, ...

Documents

DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DEF… · Don’t"believe"anything"I"Say • Also,"hold"those"around"you"accountable

DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DEF… · Don’t"believe"anything"I"Say • Also,"hold"those"around"you"accountable

Documents

HACKING HOTEL KEYS - DEF CON CON 24/DEF CON 24 presentations/DEF… · HACKING HOTEL KEYS Security Consultant ... Researcher. 9About 11 years pen-testing, Security Research, ... 912

HACKING HOTEL KEYS - DEF CON CON 24/DEF CON 24 presentations/DEF… · HACKING HOTEL KEYS Security Consultant ... Researcher. 9About 11 years pen-testing, Security Research, ... 912

Documents

WhyMI so Sexy? WMI Attacks, Real-Time Defense, … CON 23/DEF CON 23...Title DEF CON 23 Presentation Author DEF CON 23 Speaker Subject DEF CON 23 Presentation Keywords

WhyMI so Sexy? WMI Attacks, Real-Time Defense, … CON 23/DEF CON 23...Title DEF CON 23 Presentation Author DEF CON 23 Speaker Subject DEF CON 23 Presentation Keywords

Documents

DEF CON 26 Voting Village - DEF CON® Hacking Conference CON 26 voting... · 2018-09-27 · DEF CON 26 Voting Village Report on Cyber Vulnerabilities in U.S. Election Equipment, Databases,

DEF CON 26 Voting Village - DEF CON® Hacking Conference CON 26 voting... · 2018-09-27 · DEF CON 26 Voting Village Report on Cyber Vulnerabilities in U.S. Election Equipment, Databases,

Documents

Network Protocol Reverse Engineering - DEF CON CON 24/DEF CON 24...Katea Murray –murrayka@leidos.com 2016-08-05 Estell/Murray Eavesdropping on the Machines 28. Title: DEF CON 24

Network Protocol Reverse Engineering - DEF CON CON 24/DEF CON 24...Katea Murray –[email protected] 2016-08-05 Estell/Murray Eavesdropping on the Machines 28. Title: DEF CON 24

Documents

Download - Def Con

Download - Def Con

Documents

DEF CON 25 Hacker Conference CON 25/DEF CON 25 presentations/DEF… · $ python c2960-lanbasek9-m-12.2 ... DEF CON 25 Hacker ... Subject: DEF CON 25 Presentation Keywords: DEF CON

DEF CON 25 Hacker Conference CON 25/DEF CON 25 presentations/DEF… · $ python c2960-lanbasek9-m-12.2 ... DEF CON 25 Hacker ... Subject: DEF CON 25 Presentation Keywords: DEF CON

Documents

DEF CON 26 Hacking Conference CON 26/DEF CON 26...Find us on Twitter: @michaelossmann / @dominicgs Title DEF CON 26 Hacking Conference Author DEF CON Speaker Subject DEF CON 26 Presentation

DEF CON 26 Hacking Conference CON 26/DEF CON 26...Find us on Twitter: @michaelossmann / @dominicgs Title DEF CON 26 Hacking Conference Author DEF CON Speaker Subject DEF CON 26 Presentation

Documents

Hacking MANET - Def Con

Hacking MANET - Def Con

Documents

DEF CON 24 Hacking Conference CON 24/DEF CON 24 presentations/DEF CON 24...RDS-1 or "Stalin's Jet Engine" Inside knowledge of the Manhattan Project combined with looting Germany's

DEF CON 24 Hacking Conference CON 24/DEF CON 24 presentations/DEF CON 24...RDS-1 or "Stalin's Jet Engine" Inside knowledge of the Manhattan Project combined with looting Germany's

Documents

Introduction to x86 disassembly - DEF CON CON 24/DEF CON 24 workshops/DEF CON 24... · x86 •Today, “x86” generally refers to all architectures based off of the original 8086

Introduction to x86 disassembly - DEF CON CON 24/DEF CON 24 workshops/DEF CON 24... · x86 •Today, “x86” generally refers to all architectures based off of the original 8086

Documents

DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DEF CON 23... · GPS SPOOFING Low-cost GPS simulator HUANG Lin, YANG Qing Unicorn Team – Radio and Hardware Security Research

DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DEF CON 23... · GPS SPOOFING Low-cost GPS simulator HUANG Lin, YANG Qing Unicorn Team – Radio and Hardware Security Research

Documents