►
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Unfit Story of Fitness Trackers: Hacking BLE Fitness Trackers - Yogesh Ojha, Tata Consultancy Services
Bluetooth Low Energy is being used extensively in almost all the modern "Smart" devices from smart phones, smart devices, smart watches as well as advanced medical equipment. This talk will introduce several new Bluetooth Low energy hacking techniques, various tools and techniques for performing attacks on Bluetooth Low Energy Device. The talk will focus on gathering enough information about BLE devices from the security standpoint, discovering them, reverse engineering the mobile application(if any) and attacking them. As a part of live demonstration we will be using some "Smart" BLE Fitness Trackers, reverse engineer their mobile applications and gather enough information to attack them. We will also see how uploading the malicious firmware over the air is also possible.
https://sched.co/Nruu
A
Yeah,
so
my
name
is
Jurgis
and
I
woke
at
the
service
security
analyst
another
said:
Theseus
cyber
security
unit
India,
where
I
spend
a
lot
of
time
working
on
IOT
and
mobile
applications,
security.
Apart
from
that
I
love
to
build
and
play
with
robots
and
sometimes
break
them
very
often,
and
today,
I'm
here
to
talk
about
the
security
in
Bluetooth,
low-energy
devices
and
how
to
hat
the
fitness
trackers.
So
let
me
tell
you
a
story:
it
all
began
a
year
and
a
half
back
when
I
started
getting
excited
about
IOT
security.
Is
this?
A
That
I
saw
many
people
having
IOT
devices
at
that
home
I.
Would
he
was
just
booming
up,
so
in
a
security
guy,
I
had
to
focus
on
IOT
and
then
I
realized
I
needed
a
device.
So
I
got
myself
a
fitness
tracker,
definitely
not,
please
stay
fit,
but
to
hack
in
so
once
I
got
the
fitness
tracker,
I
started
researching
more
and
more
about.
How
does
it
connect
to
the
mobile
application?
And
what
are
the
communication
protocol
that
it
uses
to
interact
with
the
mobile
application
and
then
I
realize
thing?
A
Is
a
communication
protocol
called
ble
thermal
lace
are
different
than
your
Bluetooth
classic,
but
pretty
much
almost
same
so
it
uses
barely
protocol
to
communicate
with
your
mobile
application
and
then
I've
started
realizing
that
I
could
do
something
really
cool
with
that.
So
and
then
I
started
hunting
for
you
know
box
in
that
fitness
tracker
and
then
I
found
something
really
cool.
So
this
talk
will
be
on
how
I
found
the
vulnerability
in
the
fitness
trackers
and
how
is
it
to
add
into
the
fitness
trackers
so
expectations?
So
what
can
you
expect
from
this
talk?
A
You'll
be
getting
a
basic
understanding
of
Bluetooth
and
then
I'll
talk
about
what
exactly
the
difference
between
buildeth
classic
and
booted
low-energy
and
then
after
that,
I'll
be
talking
about
the
ble
stack
and
what
we
generally
call
Bluetooth
man,
the
middle
attack,
which
is
capturing
the
ble
packet.
So
whatever
conversation
that
you
have
between
your
mobile
application
and
your
fitness
tracker,
so
I'll
be
talking
about
how
to
capture
them
and
what
hard
words
are,
what
software
you
need
them,
and
then,
after
that,
I
have
reverse
engineering
the
mobile
application
of
fitness
trackers.
A
It
could
be
anything
you
know
a
lot
of
time.
What
happens
is
in
this
smart,
so
called
smart
devices.
They
have
that
on
mobile
application,
and
then
hardware
manufactures
furthered
in
to
harden
the
security
further
to
harden
the
reverse
engineering
process.
So
what
happens?
Is
a
lot
of
information
could
be
gathered
from
here?
So
I'll
tell
you
how
how
exactly
to
reverse
engineer
the
mobile
applications
and
then
I'll
be
talking
about
how
to
upload
the
former
over
the
year.
A
This
is
something
really
cool,
so
if
you
want
to
upload
the
former
over
the
year
in
the
ble
devices,
are
we're
talking
about
how
exactly
to
do
them.
So
all
right.
First
thing:
first,
let's
talk
about
Bluetooth.
Do
these
assault
wireless
short-range
wireless
communication
protocol
and
allows
devices
such
as
your
smartphones,
headset
and
many
of
the
smart
bulbs
in
DC
to
connect
with
each
other
and
see
the
data
and
a
voice
wirelessly
it
was
developed
in
1994
by
election.
A
Is
it
a
replacement
for
cables
and
uses
2.4
gigahertz
frequency
and
creates
a
10
meter,
radius
called
piconet
now
and
for
many
years
what
happened?
Was
it
had
constant
data
transmission
adjustments?
High
power
consumption
right
when
you
have
fashioned
a
transmission
in
the
device,
it
has
higher
power
consumption
when
it
has
higher
power
consumption.
This
building
applications
suffered
a
lay-in
better
life
for
many
years
until
a
few
years
ago,
Bluetooth
4.0
or
what
we
can
generally
call
Bluetooth
smart
came
into
the
scene.
A
It's
basically
the
power
efficient
version
of
bluetooth
that
has
made
many
amazing
device
fast.
You,
like
your
fitness,
trackers,
your
coffee
makers,
your
lightbulbs
and
many
medical
devices.
It
is
see
if
you
see
the
applications
of
ble
devices
it's
right
now
everywhere.
This
version
of
Bluetooth
smart,
are
simply
called
ble
is
designed
to
be
powered
ficient
and
low-cost,
and
that's
the
region
where
you
can
get
these
ble
devices
for
as
low
as
7
to
8
dollars.
You
can
get
any
ble
applications
for
7
to
8
dollars.
But
yes,
really
is
an
awesome
technology.
A
It
allows
it
enables
us
to
connect
to
everyday
things
that
we
thought
wouldn't
be
possible
to
do.
Have
you
ever
thought
that
we
would
be
any
day
connecting
the
smart
shoes
with
a
fitness
eye
with
a
mobile
application?
Not
right
so
right
now,
thanks
to
Billy,
smart
shoes
are
out
there
in
the
world
and
you
could
count
how
many
steps
that
he
walked
and
you
could
do
so
much
things
with
your
smart
shoes
right.
So
now,
let's
talk
about
what
exactly
is
the
difference
between
the
various
classic
and
ble?
A
So
this
classic
is
generally
what
you
see
in
your
fitness.
Sorry
in
your
headset
inability
speakers
and
ble,
is
what
you
the
smart
devices,
so
this
Bluetooth
classic
is
great
for
product.
That
requires
the
continuous
assuming
of
data
your
headphone
has
to
has
the
continuous
assuming
of
data
right.
Your
Bluetooth
speaker
has
to
have
the
kind
of
continuously
streaming
of
data,
so
in
both
application,
Bluetooth
classic
is
always
preferred
so
when,
if
it
has
higher
sorry,
it
has
continuously
streaming
of
data.
A
It
has
higher
power
consumption
and
needs
to
have
a
faster
data
rate
as
well,
but,
on
the
other
hand,
I
have
this
Bluetooth
Low
Energy.
This
beautiful
ONC
is
great
for
product
that
not
require
the
continuously
streaming
of
data,
like
maybe
in
your
smart
bulb,
just
to
send
on/off
to
the
bulb
right.
So,
in
that
case,
you
don't
need
the
device
to
continuously
send
on
and
on
and
on
right.
You
don't
have
to
send
that.
A
So
in
that
case
we
prefer
Billy
over
Bluetooth
classic
and
it
has
an
ultra
low
power
consumption
since,
since
it
doesn't
have
to
do
the
continuous
data
transmission,
it
can
go
for
slow
data
rate
as
well.
The
beauty
of
ble
is
that
it
is
designed
to
operate
in
a
sleep
mode
and
waken
up
only
when
the
connection
is
initiated.
So
what
happens?
Is
you
have
a
Bluetooth
low-energy
device
may
be
a
smart
ball,
the
connection
between
your
central
server,
that
is,
a
mobile
application
and
the
native
application.
A
The
connection
is
on
sleep
mode
when
there
is
no
and
there's
nothing
to
sign,
so
it
is
waken
up
only
when
the
connection
is
initiated.
That's
the
reason
where
you
have
fitness
trackers
that
can
go
on
and
on
and
on
for
days
and
days,
the
battery
life
can
go
on
and
on
for
days
and
days
right,
and
this
is
best
suited
for
your
home,
automation,
fitness
trackers
and
many
other
things,
but
being
say
that
it
is
not
perfect.
A
It
has
flaws
almost
at
any
point
in
time
its
discoverable,
it's
like
hey
I'm,
here,
send
me
any
information
and
I'm
going
to
spit
out,
send
me
anything
and
I'm
going
to
spit
out
the
information
it
works
on
the
same
frequency
and
same
channel
average.
There
is
no
channel
hopping,
so
if
you
want
to
do
you
know
a
denial
of
service
attack,
it
can
happen
because
there
is
no
channel
hopping
here
and
almost
at
any
point
in
time.
A
It
allows
any
device
to
connect
to
it
and
on
top
of
that,
most
of
the
devices
do
not
take
the
benefit
of
link
layer
security
link
layer
encryption.
So
what
happens
is
if
they
implement
this
link
encryption,
the
cost
of
the
devices
are
going
to
go
up
high,
but
they
have
to
sell
a
lot
of
them
right.
So
this
hardware
manufactures
blindly
do
not
you
know,
has
this
legal
encryption,
but
there
are
few
devices
like
a
smart
watches,
though,
that
costly
that
can
go
for
200.
A
That
really
has
the
link
encryption.
You
can
capture
the
packets
in
between
you
can
perform
the
man
the
middle
attack,
but
the
packets
are
encrypted.
Yes,
you
can
decrypt
the
packets
also.
So
now,
let's
go
back
to
the
fitness
tracker
that
I
talked
earlier.
I
decided
to
focus
on
the
fitness
tracker.
It's
because
I
saw
many
people
using
that
and
I
decided.
It
would
be
really
fun
to
pop
up
some
notification
to
pop
up
some
messages
on
my
friends,
fitness
trackers,
and
to
do
that,
we
need
to
understand
this
ble
stack.
So
in
really.
A
This
is
the
ble
stack,
so
in
Baileys
that
there
are
two
really
important
that
you
need
to
remember,
that
is
enric,
attribute
profile
and
generate
access
profile.
So
the
first
thing
dad-dad
defines
the
way
these
ble
devices
communicate
with
each
other,
the
client
and
a
server.
The
client
could
be
your
fitness
tracker
and
the
server
could
be
a
mobile
application
using
something
else,
service
and
characteristics.
A
Remember
this
term
service
and
cards
characteristics
I'm,
going
to
use
it
very
often,
I'll
tell
you
what
exactly
that
so
hick
our
connections
are
explicit,
mean
merely
the
connections
are
exclusive
when
I
say
exclusive,
it's
suppose
when
the
client,
that
means
a
ble
device,
it's
connected
to
one
central
server
at
a
time,
it
won't
advertise
itself
saying
that
hey
I'm
here
so
once
it
is
connected,
it
goes
into
this.
It
stops
advertising
itself,
so
no
any
other
device
can
be
connected
until
the
connection
is
actually
broken.
A
So
now,
here
in
Vienna,
we
have
something
that
profile
profile
is
actually,
it
doesn't
actually
exist
in
a
ble,
but
it's
just
a
collection
of
service
and
characteristics
service
defines
it's
a
setup
provided
features
associated
with,
with
associated
behavior,
to
interact
that
peripheral
each
service
has
on
collection
of
characteristics,
characteristics
that
define
attribute
types
that
are
that
contains
a
single
logical
value.
Now
example
in
your
fitness
tracker
service
could
be
something
like
device
information
device.
A
Information
is
a
service
and
characteristic
would
be
something
like
software
revision
number
Hardware,
even
number
of
maybe
any
value,
and
maybe
your
hardware
name
or
something
like
that.
Right
so
now
this
is
an
app
that
is
there
in
the
place
to
if
you
want
to
install
I,
will
talk
about
this
app
on
the
ledger
slides.
This
is
an
apple
and
RF
connect
which
allows
you
to
scan
the
nearby
ble
devices.
A
So
if
you
see
here,
there
is
something
called
device
information
down
there,
which
says
a
UUID
as
well,
so
the
device
information
is
actually
serviced
inside.
If
you,
you
know,
if
you
open
it,
that
you'd
see
software
vision,
number
hardware
is
a
revision
number
and
the
device
name
itself.
So
this
is
this
is
the
actual
definition
of
service
and
characteristics.
So
what
happens
is
if
you
really
wanted
to
attack
a
be
a
device
that
few
basic
process?
The
first
is
step
number
zero,
selecting
the
target.
So
here
what
happens?
A
Is
you
want
to
collect
more
and
more
information
about
the
device?
It's
always
better
to
actually
refer
the
hardware
manufacturers
manual.
There
is
nothing
as
better
than
a
hardware
manufacturers
manual
to
grab
more
and
more
information
about
the
devices
right
and
in
Linux.
If
you
are
in
Linux,
there
are
many
of
the
many
tools
like
using
stack.
I'd
say,
tool
and
guide
tool
which
allows
you
to
you
know,
gather
more
more
information
and
more
the
devices
and
the
a
step
numbers.
A
You
know
once
a
step
number
one
once
you
have
all
the
information
in
with
the
device
now
you're
good
to
go.
So
now
you
want
to
animate
the
service
and
characteristics.
You
want
to
figure
out
how
many
services
are
running
in
that
particular
one
and
how
many
characteristics
are
running
there
and
you
want
to
figure
out
what
service
does
exactly?
What
and
what
kind
of
shake
that
is
exactly
what
so
yeah
the
basic
process
is.
A
You
could
use
the
tools
like
at
say,
tool
to
scan
the
nearby
devices
and
then
connect
using
something
called
GATT
tool,
and
then
you
can
list
on
all
the
service
and
carry
six
sometimes
most
of
times.
What
happens
is
your
characteristics
are
just
unknown
services.
If
you
want
to
figure
out
what
exactly
characteristic
is
doing
what
you
could
just
do,
Google
search
there,
you
could
find
many
information
and
the
step
number
two
then
service
entering
the
mobile
application.
A
If
they
have
any
for
revisiting
in
Linux,
we
have
something
called
apktool
using
that
you
could
reverse
engineer
epoch
until
minus
D
they
could
decompile
any
Android
applications.
So
what
happens
here
is
like
I
was
working
on
a
hacking,
a
smartlock
that
is
that
reason
only
gate,
so
I
ordered
it
from
somewhere
it
from
China
and
once
I
got
it.
I,
reverse
engineer
the
mobile
application,
the
default
password
to
unlock
that
lock.
Suppose,
if
you
don't
have
the
mobile
phone
with
you
or
maybe
you
want
to
physically
unlock
the
lock,
it
had
some
hard-coded
password.
A
So
once
you
reverse
engineer
the
mobile
application,
the
hard-coded
password
was
then
inside
the
mobile
application
and
many
times
a
lot
of
information
like
figuring
out
how
exactly
your
ble
application
is
connecting
to
you.
Fitness
track.
Sorry,
a
mobile
application,
every
information
that
you
need
to
connect
between
a
mobile
application
and
if
it
really
devices
is
there
in
the
mobile
applications.
A
So
if
you
good
at
reverse
engineering,
this
is
a
very
good
sound
suite
are
done
and
then,
after
the
last
one
is
finally
doing
some
Coolidge
stuff,
maybe
sending
some
notification,
maybe
changing
the
light
bulbs
sending
turning
on
and
off
your
newest
light
bulb
and
many
other
things
and
in
a
reverse
engineering.
I
would
be
surprised
if
we
didn't
get
any
information,
because
all
the
devices
that
I
had
tested
out
had
something
at
least
in
the
mobile
applications.
A
So
step
number
do.
That
is
selecting
the
target
with
the
very
first
step
that
you
want
to
do.
You
want
to
find
out
the
nearby
Bluetooth
devices
right.
So
for
that
event,
Kali
or
any
version
of
Linux
distribution,
you
have
something
called
bluesy
stack,
so
brizzy's.
It
is
as
easy
as
installing
sudo
apt-get
install
bluesy.
A
A
All
the
low
energy
devices
mayor
of
Mesa
native
and
then
yeah,
so
if
you
wanted
to
do
if
you're
an
Android
and
you
want
to
do
it
from
your
Android
mobile
phone,
you
can
download
this
mobile
app
call
and
I
have
connected.
So
it
allows
you
to
scan
the
nearby
devices
using
a
mobile
smartphone.
So
you
can
just
go
to
the
corporation
and
download
this
app
and
if
I
don't
iOS,
you
can
download
this
light.
Blue
yeah
iOS
has
another
fennec
as
well
as
light
blue.
You
can
choose
either
of
them.
A
If
it
device
is
actually
advertising
if
it
is
not
connected
to
any
central
server,
if
it
is
not
in
a
sleep
mode,
it
should
pop
up
here
so
so
this
is
how
exactly
it
works.
Let's
say
to
officially
I'd
say
to
its
listing
out
all
nearby
input
devices.
There
is
a
namib
and
there's
a
fitness
tracker
and
the
next
here
you
can
see
all
the
ble
devices
that
I
have
nearby
vicinity
and
then
a
screenshot
from
the
light
blue.
You
have
all
the
health
monitor.
A
A
If
you
want
to
do
it
actively,
then
you
can
connect
the
device
to
your
phone
and
you
can
use
apps
like
I
mentioned
earlier,
light
blue
and
if
you
do
that,
once
you're
connected
is
just
going
to
tell
what
services
are
running
exactly
what
so,
if
you
go
back
here,
I
don't
have
the
slide
anyways.
So
once
you
connected
in
your
NRF
connect,
you
call
this
characteristic
since
Alfie's
are
gonna.
A
Have
that
name
like
the
one
earlier
you
saw
device
information
right
so
like
that
you'll
have
notification
service
in
the
fitness,
trackers
notification,
service,
messaging
service
and
many
other
services
are
maybe
in
the
Linux.
You
can
have
this
tool
called
sa
tool
using
at
Seattle
and
Cali
machine,
or
maybe
any
of
your
favorite
distribution.
We
can
connect
using
gabbu
and,
if
you're
connected,
you
can
return
all
the
primary
dietitian
services
using
a
command
called
primary
and
Kerry
districts.
This
is
for
SCA
tool,
so
you
must
have
the
UUID
and
handle.
A
If
you
remember
in
my
earlier
third
slide,
the
device
information
had
some
little
vo
idea
right.
So
if
you
wanted
to
send
or
receive
any
sensor
value,
if
you
understand
you
know
read
what
exactly
is
happening
on
particularly
sensor,
you
need
to
have
a
UUID
so
that
UID
could
be.
You
could
get
it
from
sa
tool
as
well
as
you
could
get
it
from
another
fennec.
But
if
you
want
to
do
it
passively,
that
means
you're
asleep.
A
Somebody
somebody's
connection
at
the
beginning
of
these
devices
when
they
are
talked
with
each
other
they're,
like
hey
I'm
here
and
I,
had
these
many
service
and
these
many
characteristics
and
mice
this
service
does
this,
and
might
this
characteristic
does
that?
So
what
happens
is
if
you
could?
You
know,
slip
this
communication
between
the
ble
device
and
the
central
server
using
some
sort
of
hardware's
like
uber
tooth.
You
could
know
what
service
is
doing
exactly
what.
So,
if
you
really
wanted
to
sleep
the
ble
packets,
but
it
is
a
perfect
solution.
A
It's
like
yeah
over
this
is
a
perfect
solution.
It
works
here
both
for
classic
and
Bailey.
If
you
wanted
to
capture
the
classic
the
one
with
a
toll,
if
you
wanted
to
do
it
for
your
headset,
if
I
don't
do
it
for
speakers,
it
works
for
classic
as
well,
and
it's
iran's
an
open-source
hardware
and
software
both
and
it
was
some
$100.
If
you
don't
want
to
spend
hundred
dollars,
there
are
cheaper
alternative
for
that.
A
These
really
cheap
sniffers
CC,
two
five,
four
zero
with
the
cheaper,
but
with
limited
configuration
it
doesn't
have
the
higher
data
rate
as
much
as
over
tooth
one.
It
costs
somewhere
on
$50.
So
if
I'm
wondering
how
to
capture
the
packet
down
to
the
label,
the
packet
level
would
be
the
perfect
solution.
I
prefer
not
to
use
any
sniffers
settle,
because
sniffers
do
drop
a
lot
of
packets.
So
if
there's
somebody
like
me
who
doesn't
want
to
spend
any
money
in
hard
way,
there
is
an
alternative,
an
Android
phone.
A
So
what
I
do
is
every
time
there's
an
app
available
on
Android
called
an
Aleph
connect
which
I
told
you
do
install
that
and
let
the
app
communicate
with
it.
So
if
example,
you
have
a
ble
device
and
you
have
a
it's
central
application:
mobile
application,
the
fitness
trackers
mobile
application.
So
what
happens
is
as
soon
as
you
start
communicating
they're
both
gonna
share
a
lot
of
a
lot
of
information
right.
A
So
if
you
really
wanted
to
see
that
what
you
could
do
is
you
could
go
to
your
settings
developer,
option
and
five
times,
so
you
can
go
to
the
settings
and
about
and
tap
the
build
em
of
five
times,
and
you
could
enable
this
developer
option
once
the
developer
option
is
enabled
you
can
enable
this
below.
Do
this
add,
say
swim
blog,
so
I'd
say
it
just
means
Hospital
interface,
it's
on
a
log
all
the
communication
that
is
happening
within
your
mobile
application
and
the
ble.
A
A
If
the
developer
option
is
enabled
you
can
give
up
using
the
ADB,
so
you
can
pull
the
file
from
sdcard
and
BTS
snoop
and
unregistered
say
that
log
you
could
take
that
file
to
any
packet
analyzer,
maybe
in
the
Wireshark
or
anything
I
prefer
to
use
voice
at
so
once
you
have
that
in
the
water
side
you
can
analyze
the
packets.
So
here
you
could
see
under
which
you
know
a
protocol.
It
is
communicating
under
with
you
know,
UUID
it
is
sending
and
what
all
values
it
is
sending.
A
You
could
say
everything
there,
so
it
super
easy
right.
So
now
what
happens
is
now
you're
connected?
You
might
ask
me
the
question:
hey
Leo,
guess
I'm
connected
to
the
device
now
what's
next,
so
next
safe
is
authentication.
The
fun
thing
is
3m
yeah.
This
is
one
of
the
metrics
that
I
had
three
of
the
five
devices
that
I
I
did
had
lee
allen,
key
encryption
and
then
two
of
the
five
division
that
I
tested
didn't
even
have.
The
authentication
like
the
one
I
was
testing
out
was
a
smart
ball.
A
So
in
that
front
wall
the
hardware
manufacturer
thought
it
would
be
a
really
fun
and
really
cool
tool,
a
turn
either
next
day
to
allow
your
lights
to
be
turned
on
and
off.
Since
it's
a
smart
world
right,
they
didn't
have
any
authentication.
So
then
your
neighbor
next
door
could
actually
install
app
phone
and
put
this
down
on
and
off
the
light.
It
was
that
single,
no
any
authentication.
A
So
this
is
the
same
thing
if
they
implement
these
security
measures,
the
cost
of
the
devices
are
going
to
go
up
high,
but
they
have
to
sell
a
lot
of
them,
so
they're,
just
ignoring
so
after
the
authentication.
Yes.
So
this
was
the
thing
that
I
was
able
to
do
now.
I
was
connected
to
the
fitness
tracker
using
my
etsy
tool
and
gat
tool.
I
wrote
my
own
it
escapes
and
then,
after
that,
I
needed
to
do
some
really
cool
stuff
right.
So
now
you
have
to
reverse-engineer
the
packets.
A
So
once
I
was
reverse
engineer,
a
packet
I
got
something
like
this:
it
was
sending
valid,
Co
3,
0,
1
4,
it's
six,
nine
one
particular
channel
two
particular
characteristics.
So
then
I
realized
it's
doing
something
really
cool
here.
The
first
one
byte
first
study.
First,
two
bytes
are
actually
a
notification
type.
So
if
you
wanted
to
patient
notification
is
saying
that
pay
Trump
is
calling
you,
maybe
you
could
do
the
send
do
3i.
Maybe
if
you
wanted
to
send
somebody
hey
your
email.
A
Is
there
in
the
fitness
tracker,
you
could
just
type
in
zero
one.
You
could
replace
it
with
a
zero
one,
and
maybe
if
it's
a
misspell,
you
can
just
do
zero
for
something
like
that
and
the
next
one
is
how
many
notifications
you
understand.
So
if
you
want
to
flood
the
notification,
so
I
fitness
tracker
with
the
notification,
you
could
just
replace
that
with
the
number
of
times
you
want
to
send
the
notification,
maybe
99
like
that
and
the
last
bytes
last
bytes
for
sending.
A
What
do
you
want
so,
like
suppose,
if
I'm
sending
high
is
the
hex
value
of
a
site,
that's
in
just
48
and
I
just
69,
so
it's
calculating
hex
value
and
then
sending
it
over
that
particular
characteristics.
If
you
see
the
card
is
X
right
now,
it's
5
f9
v3
for
a
B.
This
is
one
particular
characteristics
where
the
notification
is
being
sent.
A
So
how
I
knew
this
is
because
it's
from
the
Wireshark
once
you
lose
that
log
log
file,
you
could
take
it
in
the
fitness
tracker
say
if
you
take
it
in
the
Wireshark
and
analyze
this
packet,
and
you
would
know
that
when
there
is
actually
a
notification
coming
and
your
phone
on
this
particular
34
FB
kadhi
sticks,
there
was
some
value
that
was
being
sent.
So
once
your
reverse,
is
you
know
that
you
could
figure
out
it?
Is
that
simple?
A
So
then,
this
is
one
of
the
very
simple
sleep
aid
of
the
court
and
tool
that
I
built
to
say
that
notification,
if
you're
interested
in
looking
this
tool,
this
tool
is
there
in
the
pitch
hub.
Github.Com,
slash
yoga
shows
I
spell
is
why
or
gess
Jose
at
a
if
you
wanted
to
look
into
the
tools.
So
this
is
an
example.
What
IDs
so
I'm
writing
the
values
to
one
of
these
services
34
at
B.
So,
if
I
do
that,
this
is
exactly
what
is
going
to
emulate.
There's
the
device
so
he's
gonna
further
notification.
A
So
what
I
got
after
that
was
I
was
able
to
pop
up
on
anybody's
fitness
tracker
saying
that
Trump
is
calling
you
and
maybe
whatever
notification
that
I
wanted
to
pop
up
it
was
that
simple,
so
listen.
The
next
thing
that
I
wanted
to
do
was
doing
something
on
the
forum.
Well,
the
real
question
was:
where
was
I
interested
in
form?
Well,
it's
because
I
saw
many
people
using
fitness,
tracker
and
I
thought
when
it
scared.
Somebody
with
these
icons
are
maybe
images
on
the
fitness
trackers.
A
So
let's
first
talk
about
what
exactly
is
formal
formal
is
a
piece
of
software
that
runs
on
an
embedded,
CPU,
typically
written
and
C
is
compiled
into
binary,
and
that
is
loaded
into
your
device
using
a
programmer
or
wired
connection.
Well,
the
next
question
is:
how
do
I
get
the
former
right?
One
option
could
be
reverse
engineering,
the
mobile
application
that
I
told
earlier
if
they
have
any
and
look
into
the
electrical
asset.
Instead,
they
said
they're
going
to
have
everything
for
you.
A
It
could
be
a
farmer,
it
could
be
a
resources
and
anything
otherwise
capture
the
file
during
the
day
of
your
bill.
Now
this
finished
these
really
devices
they
have
something
called
over
the
year
updates
right.
So
what
happens
is
over
the
year?
If
you
have
something,
if
there
is
new
update,
it's
gonna
first
make
a
call
to
some
API.
Maybe
your
accident,
wider
comm,
slash,
maybe
you
know
new
for
my
dad
FW
or
something
like
that.
So
if
you
capture
the
format
doing
the
DfE,
then
you
could
get
the
format
for
me
I
yeah.
A
So
this
is
once
I
reverse
engineer.
The
mobile
application,
I
think
yeah.
So
once
I
reverse
engineer
the
mobile
application
in
the
site
directly.
This
is
what
I
got
dot
after
beautify,
that
is
a
format,
file
and
dot
race
file.
That's
a
resource
file!
So
for
my
file,
you
could
do
a
lot
of
things.
Maybe
write
on
question
from
it
for
that
and
for
that
resource,
like
all
the
images
that
you
have
on
your
fitness
tracker,
everything
was
there
inside
the
race.
A
So,
if
you
remember,
I
mention
an
app
powerful,
app
called
an
RF
connect.
This
is
a
screenshot
from
here,
so
once
I
got,
the
former
I
was
expecting
it
to
have
clear
name
device,
firmware,
update
and
then
hey
uploads.
The
firm
is
here,
but
in
reality
what
happens.
It
is
harder
manufactures
sometimes
slightly
too
hard
on
the
reverse
engineering
process.
They
might
have
unknown
services.
So
it's
not
really
difficult.
You
could
go
to
github
and
probably
search
for
this
particular
UID
to
see
what
exactly
they
co-ed
is
doing.
A
I,
maybe
just
go
to
google
and
search
what
exactly
this
UID
is
doing.
I
may
be
in
the
hardware
manufacturers
specification
manual.
You
could
just
go
and
look
for
this
particular
UID
and
they
have
some
other
other
information
on
that.
So
once
I
got
this,
you
know
once
I
found
out
that
okay,
this
particular
Kadesh
ticks,
is
actually
except
in
the
form
where
I
started,
operating
the
format
and
I
was
wondering
I
have
a
file
called
dot
after
the
file.
How
do
I
put
the
former
over
the
year
right
so
yeah?
A
A
So
if
a
file
size
is
maybe
800,
KB
or
maybe
even
3
for
cavies,
it
will
translate
that
into
your
the
file
size
into
the
hicks,
and
then
it's
going
to
append
that
with
0
1,
it's
going
to
send
it.
To
this
sorry,
carry
six
number
one.
Five,
three
one!
Once
it's
saying
it's
gonna,
the
fitness
tracker
is
ready
to
except
the
for
me
and
it
on
your
fitness
tracker.
It
just
says:
hey:
I'm
ready
to
exit
the
format
so
now
for
the
resource.
A
The
difference
with
the
former
and
resource
is
that
former
actually
controls
a
hardware
resource
is
something
which
you
have.
Maybe
your
images
of
the
skull
that
I
showed
earlier.
We
have
when
you
receive
a
phone
call.
You
have
that
phone
call
image
in
a
fitness
tracker
right,
so
that's
actually
sure
so
for
resources,
actually,
five
bytes.
It
has
to
tell
to
the
day
of
your
formal
updates.
Are
we
saying
that
hey
I'm
not
sending
the
form
way?
I
am
Sania
resource,
so
it's
gonna
happen
geo
to
this
particular
byte.
A
At
the
end
of
the
this
particular
packet,
sending
that
hey
it's,
not
a
farmer,
it's
a
resource
so
once
I
start
out,
aborting
the
format
and
then
I
realized
it
was
stuck
in
99
percent
is
every
time
and
does
never
accept
in
the
format.
I
spent
a
lot
of
time
figuring
out
what
exactly
was
happening.
Then
I
realized
there
was
something
important
called
section.
So,
let's
see
what
exactly
it's
section,
so
what
is
happening?
They
was
once
the
former
is
being
sent
it's
waiting
for
section
values.
A
So
what
exactly
section
six
o
is
a
calculated
value
that
is
used
to
determine
the
integrity
of
the
data
during
the
transmission,
so
that
the
man
the
middle
of
that
doesn't
happen.
Take
some
subs
is
a
unique
identifier
for
the
data
that
is
being
transmitted.
If
the
data
is
changed
it
that
6
M
will
change
as
well
right.
This
makes
it
super
easy
to
verify
the
integrity
of
the
data
over
the
year,
so
now
how
to
verify
the
integrity.
Is
that
the
sender
when
it
is
sending
the
form
way
before
even
sending
the
format?
A
It
calculates
somebody
flat
section
now
receiver
when
it
finishes
accepting
the
finishes
receiving
the
former.
It
is
waiting
for
something
called
section.
Now
the
sender
is
going
to
send
the
particular
section
with
the
receiver
saying
that
hey
this
was
the
section
that
I
sent
to
you.
Does
this
match
with
you
with
the
high
degree
of
confidence?
If
the
answer
is
yes,
it's
gonna
accept
the
form.
Well,
if
the
answer
is
no,
it
is
not
an
accepted
form.
A
A
So
what's
the
once,
it
has
high
degree
of
confidence
is
going
to
accept
the
format
it'll
check
some
matches.
The
form
is
straight,
except
it
really
doesn't
actually
mean
it
doesn't
perform
the
error
correction,
but
only
can
perform
the
Edit
detection.
Okay,
so
beautify
point
zero.
That
is
the
new
version
of
Bluetooth.
It
has
error
correction
as
well.
The
seventh
I
should
check
some
available,
but
this
fitness
tracker
that
a
t-shirt
had
Shearer
say
sixteen.
A
Yeah,
so
this
is
how
exactly
the
checksum
is
being
sent
once
you
initiate
the
connections
by
sending
the
first
zero
one
bytes
and
then
the
file
size,
the
former
is
sent,
and
once
you
start
sending
four
bytes
at
a
time
to
the
formula
upload
service,
their
form
is
98
up
up
to
99
question.
Is
the
formulas
already
sent
to
the
you
know
fitness
tracker
now?
What
happens?
Is
it's
waiting
for
you
to
send
that
section?
A
Now
you
would
say
to
the
fitness
tracker
saying
that
hey
I'm,
sending
that
section
that
is
by
initiating
with
a
zero
for
byte.
So
now
you
have
a
section
so
now,
if
the
checksum
is
mass
with
the
receiver
as
well,
it
is
gonna
straight
except
the
form
way.
So
this
is
how
exactly
is
working
at
the
end,
if
the
former
is
being
sent,
you
can
just
send
go5
to
reboot
the
firmware
to
reboot
the
fitness
tracker
and
once
I
upload
in
the
format.
This
is
what
I
could
do.
A
I
could
say
the
device
name
from
something
so
from
some
vendor
to
the
saspa.
Just
for
my
dog,
by
the
way
so
I
could
change
the
device,
maybe
something
else,
and
then,
if
you
see
that,
is
that
something
vision,
such
a
proof
of
concept
right
so
I
could
tell
the
software
division
number
2
version
number
9.99
now.
The
funny
thing
is
that
this
fitness
tracker
is
never
gonna
connect
to
its
central
mobile
application
is
because
what
happens?
Is
it's
right
now
running?
On
the
version?
A
Nine
point:
nine
point:
nine,
eleven
nine,
but
the
fitness
tracker
mobile
application
has
the
version
number
example
one
the
2.3
and
it's
gonna,
think
that
then
it's
already
in
latest
software
running
on
the
fitness,
tracker
and
I,
don't
have
to
upload
and
I,
don't
have
to
connect
and
I.
Don't
have
my
ability
to
connect
so
once
it
change
this
device
name
and
software
vision
string,
you
could
never
connect
that
particular
fitness
tracker
to
the
mobile
application
to
the
central
mobile
application
and
whatever
they
spell
I
can
yeah.
A
This
is
what
exactly
I
was
able
to
do
by
uploading.
The
form
is
by
changing
the
former
and
then
reverse
engineering
the
resources
file.
Again,
this
is
there's
a
proof
of
concept,
but
you
could
do
a
lot
of
things.
You
could
explain
much
more
than
this
formula.
Upload
update
over
the
year
is
actually
a
really
cool
feature
that
is
found
nearly
on
all
the
embedded
devices
I
demonstrated
this
freeze
how
this
feature
could
be
expected
to
allow
attackers
to
inject
malicious
from
a
modification
to
embedded
devices.
A
The
problem
here
that
hardware
manufacturers
do
not
cryptographically
sign
the
form
is
for
these
small
devices.
So
what
happens
is
at
any
point
in
time.
This
fitness
tracker
will
accept
formal
from
anybody
that
doesn't
matter
if
there
from
the
particular
vendor
or
maybe
any
attacker
that
has
actually
injected
particular
former.
So
you
don't
have
to
be
even
have
to
physically
toss
that
fitness
tracker
to
upload
that
it
will
just
sit
here
and
send
the
farmer
to
anybody's
fitness
tracker.
A
Is
this
not
except
that
if
they
imply
the
solution,
for
this
could
be
cryptographically
signing
the
format
again,
the
same
place
same
answer:
if
they
do
all
these
sort
of
security
stuff,
the
cost
of
the
devices
is
the
main
issue
right,
yeah,
so
I'm
gonna
end
up.
My
talk
so
does
anybody
has
any
questions
for
me
if
this
tool
is
available
there
in
the
github,
maybe
because
just
download
that
this
tool
is
readily
available?
A
If
you
wanted
to
spank
your
friends,
and
maybe
anybody-
and
if
you
wanted
to
hack
in
the
fitness
tracker
Navy
base
mate
if
this
tool,
that
is
there
in
the
github
as
well
yeah,
this
particular
the
one
I
did
was
for
Emma
ban,
you
could
say
in
some
other
in
you
can
change
the
characteristics.
Actually
is
this.
That
characteristics
is
different
right,
so
could
change
the
coyote?
Second,
you
could
do
the
same
thing
on
any
other
fitness
writer
says
well.
A
Did
you
get
in
touch
with
the
manufacturers
of
his
device
to
inform
them,
but
yeah
I
got
in
touch
with
the
device
manufacturer.
I
got
in
touch
with
them,
but
the
problem
is
that
they
just
don't
want
to
implement
that
because
of
the
device
cost
issues
right.
This
is
the
problem
with
the
ble
stack,
but
you
can
snip
the
package
right.
Yes,
I
was
in
touch
with
their
man,
faxes.