Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

We are sorry to see you leave - Beta is different and we value the time you took to try it out. Before you decide to go, please take a look at some value-adds for Beta and learn more about it. Thank you for reading Slashdot, and for making the site better!

Sniffing and Decoding NRF24L01+ and Bluetooth LE Packets For Under $30

timothy posted about 10 months ago | from the on-the-cheap dept.

Input Devices 46

An anonymous reader writes "I was able to decode NRF24L01+ and Bluetooth Low Energy protocols using RTL-SDR. As far as I can see, this is the first time NRF24L01+ is being decoded, especially considering the low entry price for the hardware. Given the extreme popularity of this transceiver, we are likely to see a wave of hackers attacking the security of many wireless gadgets, and they are likely to succeed as security is usually the last priority for hardware designers of such cheap gadgets. A lot of work has been done to decode bluetooth using dedicated hardware, and I am sure this software can be adapted to output the right format as input to existing Bluetooth decoders such as Wireshark."

Sorry! There are no comments related to the filter you selected.

My dog (-1)

Anonymous Coward | about 10 months ago | (#46026655)

Can sniff your packets so we dont need this shit

wireless keyboards and mouse (3, Insightful)

nobuddy (952985) | about 10 months ago | (#46026743)

Who needs a keylogger when you can just pipe their output to your local machine directly?

Re: wireless keyboards and mouse (3, Insightful)

AmiMoJo (196126) | about 10 months ago | (#46027263)

Good wireless keyboards and mice encrypt the data. Microsoft hardware does this, and I believe that at least some of it also uses Nordic chips.

This isn't really a security vulnerability at all. It's like trying to argue that ethernet is insecure. It's a transport layer, the security comes higher up the chain at the application level. Individual devices may fail to do this, but the author of the blog post made no attempt to determine how many of the devices he claims he could see fit into this category.

Re: wireless keyboards and mouse (1)

Joce640k (829181) | about 10 months ago | (#46027723)

Good wireless keyboards and mice encrypt the data. Microsoft hardware does this

Yeah, right...

https://www.google.com/search?... [google.com]

Re: wireless keyboards and mouse (0)

Anonymous Coward | about 10 months ago | (#46029349)

mice?

What useful data can you deduce from mouse clicks and movements if you don't have access to the screen? I'm missing something so I would like to know what because I cannot think of any application where it would be a security issue if some unauthorized party got the mouse movements and clicks made. Not to mention that the simplicity of data a mouse can send means that if it must be secure, the encryption has to be pretty good. When the set of possible values is so small (move up/down/right/left + click right/left) it's vulnerable to many attacks that e.g. text isn't in practice.

It's not just reading, it's writing too (2)

dutchwhizzman (817898) | about 10 months ago | (#46030051)

If you can intercept the traffic, you can also take over control over the peripheral and write. Once you control someones mousepointer, you suddenly have a lot more power, no?

Re:It's not just reading, it's writing too (1)

chihowa (366380) | about 10 months ago | (#46032349)

You can't transmit with an RTL-SDR, it's just a software defined receiver. You can, however, just buy a NRF24L01+ IC [sparkfun.com] and build your own transceiver like you always could.

The novelty here is decoding the transmissions using an RTL-SDR, not in decoding the transmissions in general.

Re: wireless keyboards and mouse (0)

Anonymous Coward | about 10 months ago | (#46029739)

Logitech encrypts.

Microsoft keyboard sniffing. (0)

Anonymous Coward | about 10 months ago | (#46033653)

Microsoft keyboards use XOR with the 5-byte MAC address.

http://travisgoodspeed.blogspot.de/2011/02/promiscuity-is-nrf24l01s-duty.html

Well, that was LUdditic (0)

Anonymous Coward | about 10 months ago | (#46026833)

As we all know, we can 3D print any hardware we want. Can't someone just 3D print a new transceiver and we can download a new one?

Logic Violation Citation (1, Flamebait)

briancox2 (2417470) | about 10 months ago | (#46026917)

As far as I can see, this is the first time NRF24L01+ is being decoded, especially considering the low entry price for the hardware.

begin sarcasm:: It is either the first time or it is not the first time. There is nothing that makes it "especially" so. Your violation has been noted. You will be watched for further grammar/logic errors in the future. Tread carefully on Slashdot.

Re:Logic Violation Citation (0)

Anonymous Coward | about 10 months ago | (#46027483)

you forgot to end the sarcasm

Re:Logic Violation Citation (1)

foobar bazbot (3352433) | about 10 months ago | (#46028791)

you forgot to end the sarcasm

YMBNH; on /., the sarcasm never ends.

Re:Logic Violation Citation (2)

Joce640k (829181) | about 10 months ago | (#46027497)

I can't imagine it was very difficult. It's not as if they're trying to hide anything or even pretending it's secure.

It's a 2.4GHz transmitter using GFSK modulation. All the information is in the datasheet, downloadable from their website. [nordicsemi.com]

You can get transceivers for a couple of bucks on eBay. Knock yourself out... [ebay.com]

create a secure computer (1)

swschrad (312009) | about 10 months ago | (#46026991)

1) dig a hole 30 feet deep, say, 10x10 feet.

2) drop computer in.

3) no wires, dammit, take those out.

4) fill with concrete.

5) place crew-served weapons on top 24x7 for eternity.

that's the only way. it would also help to nuke the machine in a microwave for a minute first so all the chips are back to sand.

Re:create a secure computer (0)

Anonymous Coward | about 10 months ago | (#46027279)

1) dig a hole 30 feet deep, say, 10x10 feet.

2) drop computer in.

3) no wires, dammit, take those out.

4) fill with concrete.

5) place crew-served weapons on top 24x7 for eternity.

that's the only way. it would also help to nuke the machine in a microwave for a minute first so all the chips are back to sand.

Ha, let's see 'em try to sniff RF signals off my difference engine!

Re:create a secure computer (1)

plover (150551) | about 10 months ago | (#46027699)

Ha, let's see 'em try to sniff RF signals off my difference engine!

You kid, but a radar set could easily do just that.

Re:create a secure computer (2)

wonkey_monkey (2592601) | about 10 months ago | (#46027285)

Someone digs in from miles away, steals the computer - you forgot to pour any concrete in before the computer, and even if you did they could take their time cutting through it - and you're completely oblivious to the crime. I'd put it in a glass box at the top of a greasy pole in the middle of the gun-toters.

Re:create a secure computer (1)

evilviper (135110) | about 10 months ago | (#46029359)

I'd put it in a glass box at the top of a greasy pole in the middle of the gun-toters.

Then somebody drives up in a bucket-truck, wearing a high-visibility shirt with the city/county/state logo on it, and smiles at everyone passing by, while he robs you....

What security does Bluetooth have? (2)

gstoddart (321705) | about 10 months ago | (#46026999)

I've always suspected pretty much none at all, which is why I keep it turned off unless I really specifically need it -- that and it sucks battery life.

So, what do the people who know the protocols say? Is Bluetooth a protocol with any actual security, or is it just a lame, wide-open security hole written by lazy people who don't care?

Re:What security does Bluetooth have? (1)

plover (150551) | about 10 months ago | (#46027105)

The security is "adequate" for most people. However, it's not perfect: http://www.hackfromacave.com/p... [hackfromacave.com]

Re:What security does Bluetooth have? (1)

Megol (3135005) | about 10 months ago | (#46027123)

The question could be answered by a search string shorter than your post - I'd suggest you'd learn to optimize.

Yes BT supports encryption, or not. It depends on what is sent and how.

Re:What security does Bluetooth have? (1)

gstoddart (321705) | about 10 months ago | (#46027237)

The question could be answered by a search string shorter than your post - I'd suggest you'd learn to optimize.

I know how to use google there, skippy.

But since Slashdot is most useful when we put these things into the comment threads, I opted for that.

But, hey, you can feel free to continue to be a smarmy little wanker who thinks the rest of us don't know how to use search engines.

Because, your "yes, maybe, sorta" adds nothing of value to the discussion.

Re:What security does Bluetooth have? (0)

Anonymous Coward | about 10 months ago | (#46027291)

you're a fuckwit. Plain and simple... and since you were called out, you're double-sacked.

Loser.

Re:What security does Bluetooth have? (0)

Anonymous Coward | about 10 months ago | (#46027601)

Awww, did your daddy cum in your ass again, and now you feel the need to throw a tantrum to be sure people are still listening?

Re:What security does Bluetooth have? (2)

AmiMoJo (196126) | about 10 months ago | (#46027305)

BTLE has minimal security. It is designed to be low power and low range, and most devices are transmit only. I suppose they were hoping that limited range and the transmit only nature of most devices would be enough to get away with extremely minimal security, but in practice users probably don't want other people to be able to monitor their heart rate sensor or send messages to their smart watch.

Re:What security does Bluetooth have? (1)

Chelloveck (14643) | about 10 months ago | (#46028351)

users probably don't want other people to be able to monitor their heart rate sensor

I should say not! Hell, if hackers can monitor your heart rate sensor they can get in and adjust it. Make your heart race until it explodes! This is why we need to restrict the transceiver technology this article talks about. Keep it in the hands of licensed professionals. It's just too dangerous to let hackers get anywhere near it.

Re:What security does Bluetooth have? (1)

dfsmith (960400) | about 10 months ago | (#46029363)

You can adjust the heart rate of someone nearby by telling them a joke. ("Wenn ist das Nunstück git und Slotermeyer?", etc.)

Re:What security does Bluetooth have? (1)

AmiMoJo (196126) | about 10 months ago | (#46029489)

Did you read the bit about it being transmit only? It has no receiver, you can't send commands to it. Even if you could it doesn't have any control over your heart, it is just a sensor.

Re:What security does Bluetooth have? (1)

Ingenium13 (162116) | about 10 months ago | (#46027687)

It used to suck battery on my older phones, but on my last 2 phones (current being Galaxy S4) it doesn't even register most of the time. Bluetooth is integrated into the same chip as wifi, so if you leave wifi on then it shouldn't really use any extra power.

Re:What security does Bluetooth have? (1)

gstoddart (321705) | about 10 months ago | (#46027735)

Bluetooth is integrated into the same chip as wifi, so if you leave wifi on then it shouldn't really use any extra power.

Well, I'm not really prepared to leave wifi on for well documented [slashdot.org] reasons.

Wifi and Bluetooth are turned on only as needed -- anything else seems like a dumb idea.

Re:What security does Bluetooth have? (1)

jodosh (1260096) | about 10 months ago | (#46029111)

That well documented reason is only an issue if you have your device try to join any open WiFi network. Why that is even an option is beyond me, but leaving WiFi on is not itself a problem.

Re:What security does Bluetooth have? (4, Informative)

mpeg4codec (581587) | about 10 months ago | (#46028289)

Hi, I'm a Bluetooth Security researcher [lacklustre.net] . My primary focus is on BLE for which I built a highly robust sniffer on the Ubertooth platform [sourceforge.net] . I have experience in other aspects of Bluetooth.

TL;DR: Classic Bluetooth is very secure, BLE is secure under some circumstances. Even if you leave your Bluetooth on in discoverable mode, there isn't much an attacker can do to harm you barring bugs in your Bluetooth stack.

Bluetooth is a well-designed protocol stack that takes security seriously in its design. Implementation quality (and bugs therein) varies from stack to stack. It's always a good idea to disable Bluetooth if you aren't using it, as is the case with any other remotely accessible feature.

Classic Bluetooth has used Secure Simple Pairing (SSP) since 2.1 in 2007. This pairing mechanism is based on ECDH to provide perfect forward secrecy and is highly secure. There was one weakness discovered in the numeric entry pin mode [blackhat.com] in 2008 by Andrew Lindell. This mode is not commonly used in older devices and more recent devices do not implement it. It's effectively impossible for an attacker to sniff any data sent over Bluetooth with SSP.

BLE has major weaknesses in its pairing protocol that I spoke about at BlackHat USA 2013 [blackhat.com] and other venues. For the most recent video see my presentation at USENIX WOOT 13 [usenix.org] .

In BLE, a passive eavesdropper who is present during pairing can recover the secret key used to encrypt all communications. This effectively makes the security worthless. However, if the attacker is not present during pairing then the encryption is very effective. It uses AES-CCM and doesn't have any major flaws in the design. AES-CCM is used in WPA2-AES; it's well-established and has no major shortcomings.

Finally, some Bluetooth stack implementations have bugs. I've found remote bugs in one major vendor's stack.

Get a life? (-1)

Anonymous Coward | about 10 months ago | (#46027083)

Does the anonymous reader have way too much time of their hands or what? Seriously, stop sniffing other people's butt cracks and live your own damn life instead.

Uh, Nordic documents its over the air protocols... (2)

tlambert (566799) | about 10 months ago | (#46027289)

Uh, Nordic documents its over the air protocols...

https://devzone.nordicsemi.com... [nordicsemi.com]

Re:Uh, Nordic documents its over the air protocols (1)

Chelloveck (14643) | about 10 months ago | (#46028257)

This reminds me of a 2600 article I saw way back in the day. The authors had painstakingly reverse engineered the analog cellular system control channel. I read the article, saw the trouble they went through and where they drew the wrong conclusions, and thought to myself, "Guys, you know you can just go buy the actual spec, right?"

yuo Fail I t (-1)

Anonymous Coward | about 10 months ago | (#46027425)

their hand...she 4aper towels please moderate

Fun project but... (1)

svirre (39068) | about 10 months ago | (#46027519)

why so much complexity to decode a standardized protocol.

Just to be clear. This is no security breach this is just a very complicated way to set up a demodulator. All that happens is that this guy pulls out the bits from the on-air datastream. Any reasonably configurable 2.4GHz band RF device capable of 1Mbit GFSK would be able to do this.

BLE uses AES to encrypt the channel, so to compromise security you need to extract the key. You either need to compromise the initial key exchange, or you need to perform a successful side channel attack. Both options are certanly viable technically. However in practice. BLE devices pair once at the start of their life and never again limiting the practical scope of a key extractioppn by key exchange comprtomise. Side channel attacks require physical access and as BLE devices tend to be in physical control of their user this is also a bit challenging.

Re:Fun project but... (1)

plover (150551) | about 10 months ago | (#46027761)

If you can force errors to cause the user to perform another key exchange that you can compromise, it's still game over. Never pair your Bluetooth devices in an untrustworthy location, especially if they "used to work".

RTFA, everyone... (4, Informative)

Shoten (260439) | about 10 months ago | (#46027527)

He isn't decrypting the traffic; he's just able to pull the raw packets from the air and express then, still encrypted, as data. And for BTLE, he isn't even able to do that, as he can't manage the frequency agility. So he isn't even seeing the encrypted data, just the BT advertisements...which you can already do with a variety of tools (bluetoothscan, bluelog, etc.) and a cheap BT dongle with greater range than the setup he has put together.

It's a clever kluge for capturing and reading 2.4 GHz traffic with a sub-2.2 GHz device on the cheap but it's not really meaningful from a security perspective.

Re:RTFA, everyone... (1)

mpeg4codec (581587) | about 10 months ago | (#46028399)

I built a BLE sniffer on Ubertooth [sourceforge.net] which does capture traffic on BLE data channels. Also I wrote a tool that can crack the pairing protocol and decrypt the data [lacklustre.net] .

It is more expensive than the sniffer in the article ($120) but very robust. I achieve the requisite frequency agility by handling timing in real-time on the microcontroller on the dongle.

Not even close to the first time on nRF24l01+ (1)

Anonymous Coward | about 10 months ago | (#46028057)

This is not a hack. This is a kludge that is more expensive and way more complicated than any competent person could have done by reading the datasheet and using the device as it was intended. I know this because I use it this way on a project I'm working on right now.

There is no security on the nRF24l01+. It transmits in the clear and describes how it does so in it's publicly and freely available datasheet.

The nRF24l01+ data has been decoded millions of times - by other nRF24l01+ devices. If you just buy one of their modules (Under $3, about $1 in bulk) and set it as a receiver with no ACK packets, you can decode whatever you like by selecting one of the 3 speed options and scanning the 128 frequency channels until you see a 1 in the Recieved Power Detector register. Then it's a matter of selecting one of the 32 addresses so it will accept the data. In all, should take less than an hour to program and set up on an Arduino, a little longer but cheaper on a TI MSP430f2012 (Under $7 total).

RTLSDR is NOT tranceiver! (0)

Anonymous Coward | about 10 months ago | (#46028247)

The RTLSDR is a receiver ONLY! To actually transmit, it would require a USRP or similar, costing 100s of dollars.

Why is this a big deal? (2)

Bender_ (179208) | about 10 months ago | (#46029105)

This is a nice hack, but in the end, he just build a receiver for the 2.4Ghz band. Big deal.

There has been a much nicer hack to convert a nRF24L01 into a promiscuous listening device:

http://travisgoodspeed.blogspo... [blogspot.de]

This achieves a very similar goal, but much cheaper.

Sex witH 4 taco (-1)

Anonymous Coward | about 10 months ago | (#46029389)

found out$ about the sales and so on, lizard - In other And she ran hobby. It was all yes, I work for I see the same out of businees wall: *BSD faces a first organization
Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?