News for hackers. Stuff that matters.
Re:Bluetooth 5 by matthewmacleod on Wednesday June 08, 2016 @04:54AM (#11860908)
I've been really fascinated recently by whipping out my smartphone in public and using a Bluetooth LE explorer app to look at what's being advertised, and it's brilliant. We are all constantly surrounded by devices which are screaming data about themselves everywhere they go.

Bluetooth 5 seems to increase the range of LE communications, but since I'm almost sure we're going to have some horrible public hack of one of the platforms at some point, I hope there is increased focus on the security of devices that use it!

Re:Bluetooth 5 by MrQuincle on Wednesday June 08, 2016 @12:55PM (#11863655)
The advantage of Bluetooth is that it runs on every smartphone out there. There is quite some incentive to have the basics right. This can not be said about chips that are not present on smartphones. I'm not saying that Bluetooth cannot be hacked, before 4.2 they didn't use proper key exchange, so e.g. you could use Ubertooth (https://www.sparkfun.com/products/10573) to capture the exchange. However, with Elliptic curve Diffie–Hellman it became pretty standard. The requirements from Apple for HomeKit are even so ridiculously high that your gadgets might be safer than your bank account.

My bet is that indoor positioning is gonna be the game changer in the coming years (not robotics, not AI, not voice recognition, not yet, at least). So, I'm particularly looking forwards to see what's in store on the Bluetooth roadmap in that respect. The only thing I wish is that they would be faster in rolling out mesh functionality...

Re:Bluetooth 5 by digi_owl on Wednesday June 08, 2016 @02:27PM (#11864386)
Lets keep in mind that bluetooth, unlike wifi, has made use of channel hopping from day one.

Ubertooth had to be custom built to sniff bluetooth traffic, while just about any old dongle will do for wifi.

And IMO, a big advantage with bluetooth is that it has profiles for common usage scenarios. Meaning that you have defined standards for how to do things like file transfers over bluetooth, while it is wild west when it comes to wifi.

Re:Bluetooth 5 by sangnoir on Wednesday June 08, 2016 @06:11AM (#11861180)
> We are all constantly surrounded by devices which are screaming data about themselves everywhere they go.

Perhaps you would like to explain what the problem with this is? Broadcasting presence in itself is not a security hole - unless you think "Do not broadcast SSID" is a WiFi AP security feature (it's not). If WiFi can be secured (with devices that "scream data about themselves"), why would Bluetooth be any different?

Re:Bluetooth 5 by matthewmacleod on Wednesday June 08, 2016 @07:31AM (#11861487)
Perhaps you would like to explain what the problem with this is? Broadcasting presence in itself is not a security hole - unless you think "Do not broadcast SSID" is a WiFi AP security feature (it's not). If WiFi can be secured (with devices that "scream data about themselves"), why would Bluetooth be any different?

Well, there are a couple of reasons I think this is different:

1. APs are static and not mobile, versus Bluetooth devices – which can move, and are more importantly personally associated with a person. That inherently provides opportunities for more leakage on information, since device addresses can now be used to track people.

2. Devices aren't just advertising their existence. They're also advertising their services, and in some cases actually just sending whatever data a client asks for. There's a particular brand of iPad stylus which seems to just open up and send it's accelerometer readings to any device which connects. There seem to be heart-rate monitors that do the same.

For me, it's much more worrying that devices happily broadcast personal information without authentication – I don't actually think device advertisement is a big deal in comparison!

Re:Bluetooth 5 by secfirstmd on Wednesday June 08, 2016 @10:37AM (#11862533)
Agreed. Checking for Bluetooth devices in the immediate area is one trick we teach in our physical counter-surveillance training for NGOs and journalists in high risk countries.
Re:Bluetooth 5 by digi_owl on Wednesday June 08, 2016 @02:32PM (#11864425)
The basic problem with 2, is that until nfc became commonplace doing pairing was either by pin not at all. So many devices still accept 0000 or 1234 because they have so way to input a pin, and is too old to use nfc pairing.
Re:Bluetooth 5 by matthewmacleod on Wednesday June 08, 2016 @02:37PM (#11864478)
Even then, quite a lot of Bluetooth LE devices don't have support for authentication as such. How to you authenticate a connection to a heart monitor, for example? It doesn't have any buttons!
Re:Bluetooth 5 by hueving on Wednesday June 08, 2016 @06:47AM (#11861310)
>If WiFi can be secured (with devices that "scream data about themselves"), why would Bluetooth be any different?

I suspect the GP is just referring to the stuff they happen to be transmitting in the clear right now because they weren't thinking about the risks. Basically like early days 802.11 when you needed to pay big money for something like wireshark.

Re:Bluetooth 5 by sundvor on Wednesday June 08, 2016 @08:02AM (#11861594)
I feel it's an Orwellian privacy issue. If you capture Bluetooth signatures in myriad places, you should be able to track where people are going with relative ease. Increasing the range without adding security features (if that's the case) would do nothing to ameliorate such concerns.
Re:Bluetooth 5 by 0x6c6f6c on Wednesday June 08, 2016 @02:30PM (#11864406)
The tracking capability of Bluetooth is nothing next to GPS and cellular triangulation though. In an Orwellian sense, Bluetooth is not the largest threat in a mobile device.
Re:Bluetooth 5 by Kadin on Wednesday June 08, 2016 @02:55PM (#11864631)
A GPS receiver doesn't broadcast, and cellular triangulation is only possible if you control the cellular infrastructure (meaning either you are a government-level adversary or you have a set of Stingray-type devices). That's a fairly high bar.

You could track people around a fairly good area, like a shopping mall, using off-the-shelf, inexpensive Bluetooth hardware and just keeping track of where various IDs turn up. Indoors, that's probably much more accurate tracking than you could perform using cellular triangulation. It's more like the kind of tracking you do using RFID tokens in a warehouse.

I don't know if it's a problem per se, but it's something people should be aware of; many devices are constantly broadcasting a unique identifier almost all the time unless they take steps to turn it off.

Re:Bluetooth 5 by sangnoir on Thursday June 09, 2016 @06:20PM (#11872810)
> I don't know if it's a problem per se, but it's something people should be aware of; many devices are constantly broadcasting a unique identifier almost all the time unless they take steps to turn it off.

I can't tell whether you're referring to Bluetooth, WiFi, or both. WiFi is worse (longer range) and I suspect more widely used and likely to be left on on phones.

Re:Bluetooth 5 by wastedhours on Wednesday June 08, 2016 @06:52AM (#11861327)
OP doesn't seem to insinuate any problem with being surrounded by devices screaming data about themselves though?
Re:Bluetooth 5 by BuildTheRobots on Wednesday June 08, 2016 @06:03AM (#11861155)
What app have you been using?
Re:Bluetooth 5 by pdjstone on Wednesday June 08, 2016 @06:18AM (#11861200)
Not sure what the GP is using, but on Android the Nordic BLE app is very good - https://play.google.com/store/apps/details?id=no.nordicsemi....

I'm also one of the authors of RaMBLE, another BLE app (https://play.google.com/store/apps/details?id=com.contextis....). It can run in the background, and can export logged BLE advertising packets and geolocation data to a SQLite DB.

Re:Bluetooth 5 by yoodenvranx on Wednesday June 08, 2016 @10:49AM (#11862596)
I installed Ramble half an hour ago on my 2014 Moto G and it seems to be working as advertized! The only thing which confuses me is the empty list under the history tab. Is this a bug or is this feature not implemented yet?
Re:Bluetooth 5 by pdjstone on Wednesday June 08, 2016 @10:53AM (#11862616)
The history tab is pull-to-refresh, but it's not particularly discoverable :)

I've implemented a UI hint to make this more obvious, which will be in the next version of RaMBLE.

Re:Bluetooth 5 by yoodenvranx on Wednesday June 08, 2016 @11:47AM (#11863016)
You are right, pull-to-refresh was not very discoverable ;) Somehow I an auto-update function for a tab called "history".

Another thing I just realised is the number of new devices in the notification label. Let's say I put ramble in the background. After 10 minutes it tells me that there are n_1 new devices. I click on the notification in order to check them out. If I then put ramble in the background and it finds n_2 new devices then the notification says that there are now n_1 + n_2 new devices. I would expect that it says n_2 devices.

Re:Bluetooth 5 by pdjstone on Wednesday June 08, 2016 @02:56PM (#11864643)
The notification is a summary of the current scan (until you stop it). New devices are ones you've never seen before the current scan. I often run it on my commute, the 'total' number give me an idea of how busy (in terms of BLE devices) it is today.

If you export the database you can pull some more interesting numbers out, e.g. http://www.contextis.com/resources/blog/bluetooth-le-increas...

Re:Bluetooth 5 by matthewmacleod on Wednesday June 08, 2016 @07:33AM (#11861498)
LightBlue Explorer – https://itunes.apple.com/gb/app/lightblue-explorer-bluetooth...

I have no idea if it's particularly good in comparison to others, but I downloaded it to debug a Bluetooth LE device I was building and it was a pretty straightforward UI.

Re:Bluetooth 5 by janekm on Wednesday June 08, 2016 @08:47AM (#11861839)
It's the standard one, pretty much. The one everyone uses...
Re:Bluetooth 5 by IshKebab on Wednesday June 08, 2016 @06:19AM (#11861205)
The best on by far is Nordic's Master Control Panel. It's really good. Only available on Android though. I don't think there are any good ones for iOS.
Re:Bluetooth 5 by dalbin on Wednesday June 08, 2016 @06:29AM (#11861250)
Nordic MCP is also available on iOS : https://appsto.re/fr/JSe2-.i
Re:Bluetooth 5 by IshKebab on Thursday June 09, 2016 @02:54PM (#11871489)
Ah I didn't know that! Assumed my iOS-using co-workers would be using it if it did.
Re:Bluetooth 5 by homero on Wednesday June 08, 2016 @01:25PM (#11863899)
What app
Re:Bluetooth 5 by B1FF_PSUVM on Wednesday June 08, 2016 @05:42AM (#11861081)
> We are all constantly surrounded by devices which are screaming data about themselves everywhere they go.

It's also terrible that people, and their clothing, are so detectable in the visible light spectrum. Where's the 'tarnkappe' when you need it?

( https://en.wikipedia.org/wiki/Cloak_of_invisibility )

Also appreciate the "will be marketed as 'Bluetooth 5.' [no dot zero]". Sounds like a band name, or a gang. Good thinking there - the Bluetooth 5 are now taking over the neighborhood ...

Re:Bluetooth 5 by matthewmacleod on Wednesday June 08, 2016 @07:35AM (#11861507)
It's also terrible that people, and their clothing, are so detectable in the visible light spectrum.

I wasn't completely clear above, but there are a couple of differences:

- Your clothing doesn't contain unique identifiers (yet!) :)

- The devices seem to often be happy to broadcast their information in the clear. Your clothes don't advertise your position or heart rate to the whole world either!

Re:Bluetooth 5 by Frank2312 on Wednesday June 08, 2016 @08:25AM (#11861712)
They do "broadcast" where you shop (if someone knows where your clothes are from), what kind of job you have, your social class and many other informations about the person.
Re:Bluetooth 5 by matthewmacleod on Wednesday June 08, 2016 @08:43AM (#11861810)
Well, that's very true. At least its easy for everyone to see what they're sharing there though!
Re:Bluetooth 5 by tremon on Wednesday June 08, 2016 @09:15AM (#11862034)
Your clothing doesn't contain unique identifiers

But your face does...

Re:Bluetooth 5 by nileshtrivedi on Wednesday June 08, 2016 @10:24AM (#11862447)
Which requires a camera being pointed at you, whereas bluetooth isn't based on line-of-sight.
Re:Bluetooth 5 by heeen2 on Wednesday June 08, 2016 @10:25AM (#11862457)
And ubiquitous public surveillance is just as troublesome. Even more so with face/movement pattern recognition or paired with other information such as MAC broadcasting.