The Bluetooth Device Database

I will be speaking at DEFCON 21 this year about a project of mine titled "The Bluetooth Device Database".  In short, this is a fun project of mine that shows how track-able people are by discoverable bluetooth devices.  Here is a summary of the talk:

As of 2013, it is estimated that there are now billions of bluetooth devices deployed worldwide. The goal of the Bluetooth Database Project is to track and freely distribute real time sightings and statistics of these wide spread devices. The data collected from these devices can be used to answer questions pertaining to various topics, such as device geolocation, device proliferation, population analysis, device misconfigurations, and an assortment of other security related analytics.

During this presentation I will go over the current community driven, distributed, real time, client/server architecture of the project. I will show off some of analytics that can be leveraged from the projects data sets. Finally, I will be releasing various open source open source bluetooth scanning clients (Linux, iOS, OSX). These clients are easily installable across various operating systems and can be used to systematically contribute data to the project. 

All content related to this project which includes slides, client code, and server code can be found in this github repo.

Passive Bluetooth Monitoring with Scapy and Pandas @ Lockdown 2013

I will be giving a talk titled "Passive Bluetooth Monitoring with Scapy and Pandas" at Lockdown 2013.  During this talk, I will be boring the audience with some Pandas data analytics as well as releasing some new tools.  Included in these tools is a rough proof of concept pure python bluetooth baseband library for use with the Ubertooth dongle.

The slides, demo code and other content will be available at this github repo.

My 2012 Blackhat Ubertooth/Scapy slides, videos and content is now avalable

The video, slides and content from my Ubertooth/Scapy talk at Blackhat USA 2012 is now available here.  This talk was a shorter version of my DEFCON 20 talk.

Here is a summary of the content:

Recognizing a need to support passive bluetooth monitoring in Scapy, Python's interactive monitoring framework, a project was launched to produce this functionality. Through this functionality, a new means for interactively observing bluetooth was created along with Python APIs to assist in the development of bluetooth auditing, pentesting and exploitation tools.

The project supplements the work of Michael Ossman et al by providing Python extensions and Scapy modules which interact with an Ubertooth dongle. The project also provides support for other passive bluetooth techniques not present in the current Ubertooth core software such as NAP identification, vendor lookup, extended logging and more.

In conjunction with this presentation, the source for this project will be released along with distribution packages for easy installation.

My Defcon 2012 audio and slides

If you are interested in Defcon 2012 content on Scapy and Ubertooth... My Defcon 2012 audio and slides can be found here .

A nice writeup of my Defcon 20 Scapy/Ubertooth talk

There is a nice writeup of my Scapy/Ubertooth talk over at lavamonky.com. Ive gotten a lot of great feedback on the project and love hearing what others have to say about it. Here is a direct link to the article if you are interested.

Slides, libraries and tutorials from my Defcon and Blackhat talks on Scapy and Bluetooth Baseband.

SUMMARY

Well, I had a great time presenting my talk at Blackhat and Defcon this year. I got some great feedback and met some awesome people. If you were not at the conference or want the most up to date versions of my content, here are links to everything...

SLIDES

Here is a link to the slides from my talks. These are more up to date then the ones on the conference media and are the ones I actually used for the presentations.

SCAPY BTBB LIBRARY

Here is the latest version of the scapy bluetooth baseband layer I wrote. This is the module you need in order to populate bluetooth baseband data into scapy via pcap files. I will be committing an updated version of this library into the scapy community repository in the near future. The version being committed to scapy community has a few more btbb utility functions and has the pcap stream class separated from the layer code. The stream class will be moved to a more appropriate location.

DEMOS AND TUTORIALS

I wrote some in depth tutorials and demos for my talk. The first demo (pdf | ipython notebook) goes into great detail on how to use btbb pcap data in scapy. The second (pdf | ipython notebook) demo shows how to do some basic number crunching and basic plotting on scapy bluetooth baseband data. Both demos are in ipython notebook and pdf format. If you are unfamiliar with ipython notebook, keep an eye on my site as I am working on a few tutorials or just check out their main site.

PROJECT ROADMAP

The next major milestone for this project will be to clean up the code and commit it to the Scapy community repo. After this occurs, I will create a few more tutorials and demos and host them here at hackgnar.com. These tutorials will demo how to use my library as part of scapy community as opposed to the standalone module I presented at the conferences. I also have a rough implementation of a direct Scapy ubertooth interface. Once this is finished, it will be merged into the project. The best way to receive updates and news on my work is to follow me on twitter or keep an eye on this site.

Installing the latest bluez software in ubuntu 12.04 along with the test suite tools

Compiling the bluez software in linux is fairly straight forward, but getting getting the bluez test applications to build can be a pain your first time doing it. The test tools included with the source give us many cool applications not typically installed with ubuntus binary bluez package (i.e. apt-get install bluez). One of the applications included in the test tools that I use all the time is bdaddr. The bluez bdaddr tool allows users to change thier bluetooth mac address which can be useful for mitm attacks on bluetooth devices.

This tutorial is really short, but it should save you tons of time if you have never done this before. The thing that hung me up my first time was the build dependancy in the test tools called "check". If check is not installed, the test tools build fails, but the rest of the bluez source is compiled. This can lead to some frustration if you cant figure out why your test tools are not being compiled. Lets get started...

First, lets install some required tools.

sudo apt-get install build-essential libdbus-1-dev check

Now, lets download the latest bluez software.

wget http://www.kernel.org/pub/linux/bluetooth/bluez-4.101.tar.gz

Now lets untar it.

tar xfvz bluez-4.101.tar.gz

Finally, lets build our package.

cd bluez-4.101
./configure --enable-test
make

If you want, you can now run "sudo make install" to install the binaries to your distro packages. I typically dont do this. Also, if you are looking for the bdaddr tool, it is built in the bluez source's "test" directory