Active Topics

 



Notices
Page 1 of 2 1 2
Reply
Thread Tools
qwerty12's Avatar
qwerty12 is offline qwerty12
2008-06-07 , 16:02
Posts: 4,274 | Thanked: 5,358 times | Joined on Sep 2007 @ Looking at y'all and sighing
#1
http://trifinite.org/trifinite_stuff_carwhisperer.html


The carwhisperer project intends to sensibilise manufacturers of carkits and other Bluetooth appliances without display and keyboard for the possible security threat evolving from the use of standard passkeys.

A Bluetooth passkey is used within the pairing process that takes place, when two Bluetooth enabled devices connect for the first time. Besides other public data, the passkey is a secret parameter used in the process that generates and exchanges the so-called link key. In Bluetooth communication scenarios the link key is used for authentication and encryption of the information that is exchanged between the counterparts of the communication.

The cw_scanner script is repeatedly performing a device inquiry for visible Bluetooth devices of which the class matches the one of Bluetooth Headsets and Hands-Free Units. Once a visible Bluetooth device with the appropriate
device class is found, the cw_scanner script executes the carwhisperer binary that connects to the found device (on RFCOMM channel 1) and opens a control connection and connects the SCO links.

The carwhiperer binary connects to the device found by the cw_scanner. The passkey that is required for the initial connection to the device is provided by the cw_pin.pl script that replaces the official Bluez PIN helper (graphical application that usually prompts for the passkey). The cw_pin.pl script provides the passkey depending on the Bluetooth address that requests it. Depending on the first three bytes of the address, which references the manufacturer, different passkeys are returned by the cw_pin.sh script. In quite a few cases the preset standard passkey on headsets and handsfree units is '0000' or '1234'.

Once the connection has been successfully established, the carwhisperer binary starts sending audio to, and recording audio from the headset. This allows attackers to inject audio data into the car. This could be fake
traffic announcements or nice words. Attackers are also able to eavesdrop conversations among people sitting in the car.

Ideally, the carwhisperer is used with a toooned dongle and a directional antenna that enhances the range of a Bluetooth radio quite a bit. (see Long-Distance-Snarf experiment)
Basically it works on the principle of standard passkeys to eavesdrop on a bluetooth headset and to send your own message to it.

Some things:
  • I've made some modifications to support some more classes of headsets and to fix up the scripts a little, paths were dodgy.
  • I was unable to test with my headset, it seems to switch off. let me know if this works for you.
  • This makes a lot of changes to the hcid.conf. Uninstall when you are done with this.
  • SoX needs to be compiled for best use out of this. I will compile later.
  • Nokia thought it would be a brilliant decision to modify the Bluez and their version of hcid refuses to acknowlege the pin_helper argument and still brings up the standard pair device dialog. Look in /usr/bin/cw_pin.pl for the list of pins. Thank Nokia for this annoyance, not me.
  • Thanks to KotCzarny for the grep help and Johnx for his scripts to "divert" things a little.

I lied, i didn't fix. reattaching and trying to fix tommorow. bluez-utils-test is needed too. memorise and guess the default passcodes. uninstall when you are done. make a better port of sox than my one.
Attached Files
File Type: deb carwhisperer_0.2-1_armel.deb (12.7 KB, 794 views)
Last edited by qwerty12; 2008-06-08 at 05:44.
 

The Following 3 Users Say Thank You to qwerty12 For This Useful Post:
qwerty12's Avatar
qwerty12 is offline qwerty12
2008-06-07 , 17:01
Posts: 4,274 | Thanked: 5,358 times | Joined on Sep 2007 @ Looking at y'all and sighing
#2
Here is a quick compile of Sox. Very dodgily packaged. It wants libtool and libsamplerate too. Plus others. Good luck

http://www.mediafire.com/?jsdcu2db2cf
Attached Files
File Type: deb amrwb_7.0.0.2-1_armel.deb (242.2 KB, 302 views)
File Type: deb amrnb_7.0.0.1-1_armel.deb (391.5 KB, 266 views)
 
tso's Avatar
tso is offline tso
2008-06-07 , 17:10
Posts: 4,783 | Thanked: 1,253 times | Joined on Aug 2007 @ norway
#3
heh, this made me think about a school camping trip i was on.

on one of your days out and about we watched a road from a hillside. the teacher then mused about having the equipment to get a message onto the radio of the car passing below.
 
qwerty12's Avatar
qwerty12 is offline qwerty12
2008-06-07 , 17:29
Posts: 4,274 | Thanked: 5,358 times | Joined on Sep 2007 @ Looking at y'all and sighing
#4
Ok, I lied. Reattached.

Anyone know which program is calling the standard maemo pair dialog? I've compiled a clean hcid thinking it was that to no avail :/
 
Benson's Avatar
Benson is offline Benson
2008-06-09 , 14:04
Posts: 4,930 | Thanked: 2,272 times | Joined on Oct 2007
#5
I've gotten sox from a bora repo; works fine...

Not sure what's wrong with your port; that one may be no better, but I've gotten along fine with it...
__________________
World's first inductively-charged N900!
 

The Following User Says Thank You to Benson For This Useful Post:
kernelpanic is offline kernelpanic
2008-06-10 , 14:09
Posts: 179 | Thanked: 90 times | Joined on Dec 2007
#6
Originally Posted by qwerty12 View Post
Here is a quick compile of Sox. Very dodgily packaged. It wants libtool and libsamplerate too. Plus others. Good luck
You're having problems cause you're standing on the bleeding edge. (14.1.0+CVS).

I've got sox-12.17.9 compiled for os2008 if anyone wants it. It only requires the vorbis libs, which I have also.

I haven't played with it yet to see how well it works, but it's simply the Debian package ported over to Maemo...

Cheers,
kernelpanic
 

The Following 2 Users Say Thank You to kernelpanic For This Useful Post:
tz1's Avatar
tz1 is offline tz1
2008-06-19 , 18:06
Posts: 716 | Thanked: 236 times | Joined on Dec 2007
#7
I did sox-13 (for kismet).

http://www.zdez.org/sox-13.0.deb

I don't know if it has what you need.
 

The Following User Says Thank You to tz1 For This Useful Post:
Tintin is offline Tintin
2009-12-05 , 09:25
Posts: 418 | Thanked: 174 times | Joined on Oct 2009
#8
Was anyone able to get this all working - and if so what are the packages needed?
Interesting project.
__________________
I luv Google
 
awett is offline awett
2011-11-10 , 18:48
Posts: 50 | Thanked: 16 times | Joined on May 2011
#9
Hi any progress on this nice little helper for n900?
 
awett is offline awett
2011-11-11 , 00:40
Posts: 50 | Thanked: 16 times | Joined on May 2011
#10
and another question is it save to play with the .deb from the first post ? or is it for maemo 4 ? :-)
 
Reply
Page 1 of 2 1 2

« Previous Thread | Next Thread »

 
Forum Jump


All times are GMT. The time now is 02:27.

Contact Us - Home - Archive - Top