BlueMaho - Bluetooth Security Testing Suite

BlueMaho is GUI-shell (interface) for suite of tools for testing security of bluetooth devices. It is freeware, opensource, written on python, uses wxPyhon. It can be used for testing BT-devices for known vulnerabilities and major thing to do - testing to find unknown vulns. Also it can form nice statistics.

What it can do? (features)

• scan for devices, show advanced info, SDP records, vendor etc
• track devices - show where and how much times device was seen, its name changes
• loop scan - it can scan all time, showing you online devices
• alerts with sound if new device found
• on_new_device - you can spacify what command should it run when it founds new device
• it can use separate dongles - one for scaning (loop scan) and one for running tools or exploits
• send files
• change name, class, mode, BD_ADDR of local HCI devices
• save results in database
• form nice statistics (uniq devices by day/hour, vendors, services etc)
• test remote device for known vulnerabilities (see exploits for more details)
• test remote device for unknown vulnerabilities (see tools for more details)
• themes! you can customize it

What tools and exploits it consist of?

• Tools:
• atshell.c by Bastian Ballmann (modified attest.c by Marcel Holtmann)
• bccmd by Marcel Holtmann
• bdaddr.c by Marcel Holtmann
• bluetracker.py by smiley
• carwhisperer v0.2 by Martin Herfurt
• psm_scan and rfcomm_scan from bt_audit-0.1.1 by Collin R. Mulliner
• BSS (Bluetooth Stack Smasher) v0.8 by Pierre Betouin
• btftp v0.1 by Marcel Holtmann
• btobex v0.1 by Marcel Holtmann
• greenplaque v1.5 by digitalmunition.com
• L2CAP packetgenerator by Bastian Ballmann
• obex stress tests 0.1
• redfang v2.50 by Ollie Whitehouse
• ussp-push v0.10 by Davide Libenzi
• exploits/attacks:
• Bluebugger v0.1 by Martin J. Muench
• bluePIMp by Kevin Finisterre
• BlueZ hcidump v1.29 DoS PoC by Pierre Betouin
• helomoto by Adam Laurie
• hidattack v0.1 by Collin R. Mulliner
• Mode 3 abuse attack
• Nokia N70 l2cap packet DoS PoC Pierre Betouin
• opush abuse (prompts flood) DoS attack
• Sony-Ericsson reset display PoC by Pierre Betouin
• you can add your own tools by editing 'exploits/exploits.lst' and 'tools/tools.lst'

Requirements

• OS (tested with Debian 4.0 Etch / 2.6.18)
• python (python 2.4 http://www.python.org)
• wxPython (python-wxgtk2.6 http://www.wxpython.org)
• BlueZ (3.9/3.24) http://www.bluez.org
• Eterm to open tools somewhere, you can set another term in 'config/defaul.conf' changing the value of 'cmd_term' variable. (tested with 1.1 ver)
• pkg-config(0.21), 'tee' used in tools/showmaxlocaldevinfo.sh, openobex, obexftp
• libopenobex1 + libopenobex-dev (needed by ussp-push)
• libxml2, libxml2-dev (needed by btftp)
• libusb-dev (needed by bccmd)
• libreadline5-dev (needed by atshell.c)
• lightblue-0.3.3 (needed by obexstress.py)
• hardware: any bluez compatible bluetooth-device 

Download BlueMaho

Read More

BluetoothLogView - Creates a log of Bluetooth devices activity around you

BluetoothLogView is a small utility that monitors the activity of Bluetooth devices around you, and displays a log of Bluetooth devices on the main window. Every time that a new Bluetooth device arrives to your area and when the device leaves your area, a new log line is added with the following information: Device Name, Device Address, Event Time, Event Type ('Device Arrival' or 'Device Left'), Device Type, and the company that created the device. BluetoothLogView also allows you to specify a description for every device (according to its MAC address) that will appear under the 'Description' column.

Download BluetoothLogView

Read More

[BTCrack v1.1] The worlds first Bluetooth Pass phrase (PIN) Bruteforce Tool

BTCrack is the worlds first Bluetooth Pass phrase (PIN) bruteforce tool, BTCrack will bruteforce the Passkey and the Link key from captured pairing* exchanges.

BTcrack was demoed and realeased at Hack.lu 2007 and 23C3 in Berlin, the video of the presentation is available on Google Video .

To capture the pairing data it is necessary to have a Professional Bluetooth Analyzer : FTE (BPA 100, BPA 105, others), Merlin OR flash a CSR based consumer USB dongle with special firmware.

Speed Comparison :

· P4 2Ghz - Dual Core 200.000 keys/sec

· FPGA E12 @ 50Mhz 7.600.000 keys/sec

· FPGA E12 @ 75Mhz 10.000.000 keys/sec

· FPGA E14 30.000.000 keys/sec

Changes :· 1.0 First release · 1.1 Intermediate Release    E12 + E14 FPGA Support ( http://www.picocomputing.com)   Splash Screen    Process Priority    Speed increase (+15%)

Download BTCrack v1.1

Read More

[Harald scan] Bluetooth discovery scanning

Harald Scan is able to determine Major and Minor device class of device, as well as attempt to resolve the device's MAC address to the largest known Bluetooth MAC address Vendor list.

If you are running Harald Scan and see a entry with 'Unknown' in the vendor column please email me the file which is created in the same directory with the first 8 characters of the MAC address.
Feature Requests If you would like to see a feature added the Harald Scan, Fill in a Issue report and set the label as Type-Enhancement

Download Harald scan

Read More

[Blue|Smash] Bluetooth Penetration Testing Suite

Blue|Smash is a free open source bluetooth pentest suite, powered by python for linux. I built Blue|Smash to aid me in my bluetooth adventures and thought others might benefit from my work :D. Here is a list of some of the tools included.

• Sorbo's Frontline bluetooth sniffer.
• A bruteforce scanner
• Mac address spoofer
• Load's of exploits
• Autopwn vunrebility checker
• CSR Firmware Backup/Updater

Download Blue|Smash

Read More

[Bluelog v1.1.1] Simple Bluetooth Scanner

Bluelog is a simple Bluetooth scanner designed to tell you how many discoverable devices there are in an area as quickly as possible.

It is intended to be used as a site survey tool, identifying the number of possible Bluetooth targets there are in the surrounding environment.

Changelog v1.1.1

Codename: “Marshmallow Peep Edition”

• Merged in libmackerel
• Merged in MACLIST from haraldscan
• Experimental manufacturer lookups (currently x86 only)
• Configuration options broken out into config.h
• Allow for friendly class names in verbose mode, thanks Dean
• EXPERIMENTAL: Added -e option to encode MACs with CRC32
• Updated MAN page
• Updated README
• Improved memory management, thanks Paolo
• Improved file cleanup, less idiotic

Compatibility

Bluelog has been written with portability and efficiency in mind, so it is able to run on a number of systems and hardware platforms. Basically, as long as the device can run (and get results from) “hcitool scan”, and you can compile software for it, there is a good chance Bluelog can run on it.

In addition to running on all major Linux distributions, Bluelog has been used successfully on Chrome OS (running on the CR-48 netbook), and MIPS based OpenWRT devices. For information on the OpenWRT build of Bluelog, see the “openwrt” directory.

More Information: here

Download Bluelog v1.1.1

Read More

[Spooftooph 0.5.2] Automated spoofing or cloning Bluetooth device

Spooftooph is designed to automate spoofing or cloning Bluetooth device Name, Class, and Address. Cloning this information effectively allows Bluetooth device to hide in plain site. Bluetooth scanning software will only list one of the devices if more than one device in range shares the same device information when the devices are in Discoverable Mode (specificaly the same Address).

Features

• Clone and log Bluetooth device information
• Generate a random new Bluetooth profile
• Change Bluetooth profile every X seconds
• Specify device information for Bluetooth interface
• Select device to clone from scan log

Usage : To modify the Bluetooth adapter, spooftooth must be run with root privileges. Spooftooph offers five modes of usage:

1) Specify NAME, CLASS and ADDR.
root@thnlab: spooftooph -i hci0 -n new_name -a 00:11:22:33:44:55 -c 0x1c010c

2) Randomly generate NAME, CLASS and ADDR.
root@thnlab: spooftooph -i hci0 -R

3) Scan for devices in range and select device to clone. Optionally dump the device information in a specified log file.
root@thnlab: spooftooph -i hci0 -s -w file.csv

4) Load in device info from log file and specify device info to clone.
root@thnlab: spooftooph -i hci0 -r file.csv

5) Clone a random devices info in range every X seconds.
root@thnlab: spooftooph -i hci0 -t 10

Download Spooftooph 0.5.2

Read More