Bluetooth Low Energy (BLE) has become an intrinsic wireless technology for the Internet of Things (IoT). With the proliferation of BLE-embedded IoT devices, it is important to study the security and privacy implications of BLE. The forefront attack to BLE devices is the wireless sniffing attack, which would lead to more detrimental threats like jamming, encryption cracking or system penetration. Existing sniffing attacks are based on the correct detection of BLE connection initiation state, but they become ineffective for BLE long-lived connections. In this paper, we focus on the adversary setting with a low-cost single radio and develop a suite of real-time algorithms to determine the key parameters necessary to follow and sniff a BLE connection in the connected state. We implement our algorithms in the open source platform -Ubertooth One and evaluate its performance in terms of sniffing overhead and accuracy. By comparing with state-of-the-art schemes, experimental results show that our sniffer achieves much higher sniffing accuracy (over 80 ) and better stability to BLE operational dynamics.
Aforementioned sniffing attacks are based on multi-radio platforms which could be prohibitively expensive for less-capable adversaries. Currently, one popular platform Ubertooth One is an open-source, single-radio and cheap Bluetooth sniffer that was developed by Ryan @cite_17 . This is a powerful sniffer that is relied on observing advertisement packets and looking for AFH parameters to follow. As stated earlier it is difficult to sniff a BLE connection after the connection has been already established. In @cite_17 , Ryan imply how AFH parameters can be extracted from a long-lived BLE connection via jamming. Moreover, Ryan also demonstrate a proof-of-concept of key re-negotiation and man-in-the-middle (MitM) attack to BLE devices.
@cite_17
2563417884 2611258330 2013405390 58703277
This study investigated the impact of Bluetooth Low Energy devices in advertising beaconing mode on fingerprint-based indoor positioning schemes. Early experimentation demonstrated that the low bandwidth of BLE signals compared to WiFi is the cause of significant measurement error when coupled with the use of three BLE advertising channels. The physics underlying this behaviour is verified in simulation. A multipath mitigation scheme is proposed and tested. It is determined that the optimal positioning performance is provided by 10Hz beaconing and a 1 second multipath mitigation processing window size. It is determined that a steady increase in positioning performance with fingerprint size occurs up to 7 ±1, above this there is no clear benefit to extra beacon coverage. Infrastructure monitoring applications currently lack a cost-effective and reliable solution for supporting the last communication hop for low-power devices. The use of cellular infrastructure requires contracts and complex radios that are often too power hungry and cost prohibitive for sensing applications that require just a few bits of data each day. New low-power, sub-GHz, long-range radios are an ideal technology to help fill this communication void by providing access points that are able to cover multiple kilometers of urban space with thousands of end-point devices. These new Low-Power Wide-Area Networking (LPWAN) platforms provide a cost-effective and highly deployable option that could piggyback off of existing public and private wireless networks (WiFi, Cellular, etc). In this paper, we present OpenChirp, a prototype end-to-end LPWAN architecture built using LoRa Wide-Area Network (LoRaWAN) with the goal of simplifying the design and deployment of Internet-of-Things (IoT) devices across wide areas like campuses and cities. We present a software architecture that exposes an application layer allowing users to register devices, describe transducer properties, transfer data and retrieve historical values. We define a service model on top of LoRaWAN that acts as a session layer to provide basic encoding and syntax to raw data streams. At the device-level, we introduce and benchmark an open-source hardware platform that uses Bluetooth Low-Energy (BLE) to help provision LoRa clients that can be extended with custom transducers. We evaluate the system in terms of end-node energy consumption, radio penetration into buildings as well as coverage provided by a network currently deployed at Carnegie Mellon University. This paper presents a new pairing protocol that allows twoCPU-constrained wireless devices Alice and Bob to establish ashared secret at a very low cost. To our knowledge, this is thefirst software pairing scheme that does not rely on expensivepublic-key cryptography, out-of-band channels (such as a keyboardor a display) or specific hardware, making it inexpensive andsuitable for CPU-constrained devices such as sensors. In the described protocol, Alice can send the secret bit 1 toBob by broadcasting an (empty) packet with the source field set toAlice. Similarly, Alice can send the secret bit 0 to Bob bybroadcasting an (empty) packet with the source field set to Bob.Only Bob can identify the real source of the packet (since it didnot send it, the source is Alice), and can recover the secret bit(1 if the source is set to Alice or 0 otherwise). An eavesdroppercannot retrieve the secret bit since it cannot figure out whetherthe packet was actually sent by Alice or Bob. By randomlygenerating n such packets Alice and Bob can agree on ann-bit secret key. Our scheme requires that the devices being paired, Alice andBob, are shaken during the key exchange protocol. This is toguarantee that an eavesdropper cannot identify the packets sent byAlice from those sent by Bob using data from the RSSI (ReceivedSignal Strength Indicator) registers available in commercialwireless cards. The proposed protocol works with off-the-shelf802.11 wireless cards and is secure against eavesdropping attacksthat use power analysis. It requires, however, some firmwarechanges to protect against attacks that attempt to identify thesource of packets from their transmission frequency. We discuss our tools and techniques to monitor and inject packets in Bluetooth Low Energy. Also known as BTLE or Bluetooth Smart, it is found in recent high-end smartphones, sports devices, sensors, and will soon appear in many medical devices. We show that we can effectively render useless the encryption of any Bluetooth Low Energy link.