iGuRu
Now Reading
bluescan: A powerful Bluetooth scanner
iGuRu

bluescan: A powerful Bluetooth scanner

Bluescan is one project open source by SAPcell Xu of the DBAPP Security HatLab team. 

When violating new Bluetooth targets, the scanner can help us gather information, such as:

  • BR devices
  • LE devices
  • LMP features
  • GATT services
  • SDP services
  • Vulnerabilities

System requirements

This tool is based on BlueZ, the official Bluetooth stack of Linux. The following packages must be installed:

sudo apt install libglib2.0-dev libbluetooth-giant

Installation

sudo pip3 install bluescan

Use

$ bluescan -h
bluescan v0.1.1

A powerful Bluetooth scanner.

Author: Sourcell Xu from DBAPP Security HatLab.

License: LPG-3.0

Usage:
    bluescan (-h | --help)
    bluescan (-v | --version)
    bluescan [-i < hcix>] -m br [--inquiry-len=< n>]
    bluescan [-i < hcix>] -m lmp BD_ADDR
    bluescan [-i < hcix>] -m sdp BD_ADDR
    bluescan [-i < hcix>] -m le [--timeout=< sec>] [--le-scan-type=< type>] [--sort=< key>]
    bluescan [-i < hcix>] -m gatt [--include-descriptor] --addr-type=< type> BD_ADDR
    bluescan [-i < hcix>] -m vuln --addr-type=br BD_ADDR

Arguments:
    BD_ADDR Target Bluetooth device address

Options:
    -h, --help Display this help
    -v, --version Show the version
    -i < hcix> HCI device for scan [default: hci0]
    -m < mode> Scan mode, support BR, LE, LMP, SDP, GATT and vuln
    --inquiry-len=< n> Inquiry_Length parameter of HCI_Inquiry command [default: 8]
    --timeout=< sec> Duration of LE scan [default: 10]
    --le-scan-type=< type> Active or passive scan for LE scan [default: active]
    --sort=< key> Sort the discovered devices by key, only support RSSI now [default: Rssi]
    --include-descriptor Fetch descriptor information
    --addr-type=< type> Public, random or BR

Scanning BR devices -m br

Classic Bluetooth devices may use three technologies: BR (Basic Rate), EDR (Enhanced Data Rate) and AMP (Alternate MAC / PHY). Since they all belong to the Basic Rate system, we call them BR scanners:

example br scan - bluescan: A powerful Bluetooth scanner

 

As shown above, by scanning BR devices, we can obtain the address, name, device type and RSSI of the surrounding classic Bluetooth devices.

Scanning devices LE -m le

Bluetooth technology, in addition to the Basic Rate system, also has the low power system (LE). Scanning low power Bluetooth devices is called LE device scan:

example le scan 768x580 1 - bluescan: A powerful Bluetooth scanner

As shown above, by scanning LE devices, we can obtain the address, address type, connection status, RSSI, and GAP data of the surrounding LE devices.

SDP scanning services

Classic Bluetooth devices inform the outside world about their open services via SDP. After scanning SDP, we can receive the service data of this classic Bluetooth device:

example sdp scan - bluescan: A powerful Bluetooth scanner

You can try to connect to these services for further benefits.

LMP scan functions

Detecting the LMP functions of classic Bluetooth devices allows us to judge the basic security features of the classic Bluetooth device:

example lmp scan - bluescan: A powerful Bluetooth scanner

 

Scanning GATT services

LE devices inform the outside world about their open services through GATT. After scanning the GATT, we can receive the GATT service of the specified LE device. You can try to keep the GATT data for further breaches:

example gatt scan 768x601 1 - bluescan: A powerful Bluetooth scanner

Vulnerability Scan (Demo)

The vulnerability scan is still in the demonstration phase and currently only supports CVE-2017-0785:

$ sudo bluescan -m vuln --addr-type=br ??:??:??:??:??:??
... ...
CVE-2017-0785

 

You can download the program from here.

Read them Technology News from all over the world, with the validity of iGuRu.gr

Follow us on Google News

View Comments (0)

Leave a Reply

Your email address Will not be published.

 

iGuRu.gr © 2012 - 2021 Keep it Simple Stupid Custom Theme

Scroll To Top