Long-Range (200m) BLE Beacons with 1Mb EEPROM

Re:Long-Range (200m) BLE Beacons with 1Mb EEPROM by thawab on Wednesday August 24, 2016 @08:36PM (#12356198)

It's not similar to the devices covered in the article. This is how a beacon work:

1- A beacon broadcast a UUID.

2- The users should install my app, the app reads the UUID.

3- The app requests the picture or video related to this UUID from my server.

If an attacker can access the beacon and modify it, then my app is not going to find the UUID's i added to the server.

[ Parent | on HN ]

Re:Long-Range (200m) BLE Beacons with 1Mb EEPROM by rasz_pl on Friday August 26, 2016 @08:50AM (#12365802)

and here is the attack:

-evul haxor learns about those beacons at the target location

-finds a weakness in remote firmware update

-prepares special firmware with added Microsoft/logitech mouse/keyboard emulation (nRF52 can do this). Bonus points if he can make one beacon flash other beacons in range.

-infects one beacon using long range setup (yagi, amp)

-profit

[ Parent | on HN ]