Bluetooth Classic (BR/EDR) Attacks

Bluetooth Classic (BR/EDR) 攻击

Older than BLE, less commonly attacked today, but still present in cars, industrial sensors, audio gear, and legacy enterprise hardware. Many of the well-known historic attacks (BlueSnarf, BlueBug) are mitigated; KNOB and the BlueBorne family remain relevant against unpatched devices.

比 BLE 出现得早，如今遭攻击的频率较低，但仍存在于汽车、工业传感器、音频设备和旧式企业硬件中。许多知名的历史攻击（BlueSnarf、BlueBug）已得到缓解；KNOB 和 BlueBorne 系列攻击对未修补设备仍具有现实意义。

Quick Workflow

快速工作流

Discover devices with
```
hcitool
```
/
```
bluetoothctl
```
/
```
redfang
```
Enumerate exposed services via SDP
Test each service profile for unauth access
Check pairing crypto (KNOB applicability)
Proximity-physical attacks for legacy / unpatched

使用
```
hcitool
```
/
```
bluetoothctl
```
/
```
redfang
```
发现设备
通过 SDP 枚举已暴露的服务
测试每个服务 Profile 是否允许未认证访问
检查配对加密机制（是否适用 KNOB）
针对旧式/未修补设备实施近距离物理攻击

Discovery

设备发现

bash

undefined

bash

undefined

Modern adapter (built-in or USB Bluetooth 4.0+)

sudo hciconfig hci0 up sudo hcitool inq # inquiry sudo hcitool scan --length=12 # 12-second scan

bluetoothctl interactive

bluetoothctl

scan on devices

bluetoothctl

scan on devices

Discoverable-mode-only devices appear; non-discoverable need address brute

sudo redfang -r 00:00:00:00:00:00-FF:FF:FF:FF:FF:FF

(very slow — ~7 hours per OUI prefix)

undefined

undefined

Service Discovery (SDP)

服务发现 (SDP)

bash

undefined

bash

undefined

List all services on a device

sdptool browse AA:BB:CC:DD:EE:FF sdptool records AA:BB:CC:DD:EE:FF


Common profiles and their attack relevance:

| Profile | UUID | Attack |
|---|---|---|
| OBEX Object Push (OPP) | 0x1105 | BlueSnarf/BlueBug on legacy phones (mostly extinct) |
| OBEX File Transfer (FTP) | 0x1106 | Browse / write filesystem on legacy devices |
| Headset (HSP/HFP) | 0x1108 / 0x111E | Eavesdrop active call audio |
| Serial Port Profile (SPP) | 0x1101 | Industrial/IoT debug ports — often unauthenticated |
| HID | 0x1124 | Keyboard/mouse impersonation |
| Audio Sink/Source (A2DP) | 0x110B / 0x110A | Audio injection/eavesdrop |

sdptool browse AA:BB:CC:DD:EE:FF sdptool records AA:BB:CC:DD:EE:FF


常见 Profile 及其攻击相关性：

| Profile | UUID | 攻击 |
|---|---|---|
| OBEX Object Push (OPP) | 0x1105 | 旧式手机上的 BlueSnarf/BlueBug（基本已绝迹） |
| OBEX File Transfer (FTP) | 0x1106 | 浏览/写入旧式设备的文件系统 |
| Headset (HSP/HFP) | 0x1108 / 0x111E | 窃听正在进行的通话音频 |
| Serial Port Profile (SPP) | 0x1101 | 工业/IoT 调试端口——通常无需身份认证 |
| HID | 0x1124 | 键盘/鼠标冒充 |
| Audio Sink/Source (A2DP) | 0x110B / 0x110A | 音频注入/窃听 |

SPP Abuse

SPP 滥用

The Serial Port Profile (SPP) tunnels arbitrary data over Bluetooth as a virtual COM port. Industrial / IoT devices use it for debug or telemetry, often without authentication.

bash

undefined

Serial Port Profile (SPP) 通过 Bluetooth 将任意数据封装为虚拟 COM 端口进行传输。工业/IoT 设备经常将其用于调试或遥测，而且通常不启用身份认证。

bash

undefined

Connect to SPP service, channel typically 1

sudo rfcomm bind /dev/rfcomm0 AA:BB:CC:DD:EE:FF 1 sudo screen /dev/rfcomm0 9600

Then interact with the device's CLI / debug menu

undefined

undefined

KNOB (CVE-2019-9506)

Forces Bluetooth pairing to negotiate a 1-byte encryption key — making the link key trivially brute-forceable.

bash

undefined

强制 Bluetooth 配对协商采用 1 字节加密密钥——使 link key 可被轻易暴力破解。

bash

undefined

Test with internalblue (requires Broadcom firmware patch)

git clone https://github.com/seemoo-lab/internalblue internalblue

log keys

git clone https://github.com/seemoo-lab/internalblue internalblue

log keys

Patch firmware to allow 1-byte key; pair with target; observe weak key


Patched in firmware on most modern devices. Still works against:
- Older Broadcom-based devices (pre-2019 BCM chipsets)
- Embedded automotive Bluetooth stacks
- Cheap consumer audio gear


大多数现代设备已通过固件修补。仍适用于：
- 基于 Broadcom 的较旧设备（2019 年前的 BCM 芯片组）
- 嵌入式汽车 Bluetooth 协议栈
- 廉价消费级音频设备

BlueBorne (CVE-2017-1000251 et al.)

A family of buffer overflows / info leaks in major Bluetooth stacks (Linux BlueZ, Android, Windows, iOS). Mostly patched 2017–2018, but unpatched embedded Linux devices are common.

bash

undefined

一组存在于主流 Bluetooth 协议栈（Linux BlueZ、Android、Windows、iOS）中的缓冲区溢出/信息泄露漏洞。多数已在 2017–2018 年修补，但未修补的嵌入式 Linux 设备十分常见。

bash

undefined

Armis blueborne-scanner — checks for patch-level

git clone https://github.com/ArmisSecurity/blueborne python blueborne_scanner.py AA:BB:CC:DD:EE:FF

undefined

git clone https://github.com/ArmisSecurity/blueborne python blueborne_scanner.py AA:BB:CC:DD:EE:FF

undefined

HID Spoofing (PoC)

HID 冒充 (PoC)

If pairing succeeds via Just Works or weak PIN, you can register as a HID device — keystroke injection on an unattended Bluetooth-paired host.

bash

undefined

如果通过 Just Works 或弱 PIN 成功完成配对，就可以注册为 HID 设备——向已与 Bluetooth 配对但无人看管的主机注入按键输入。

bash

undefined

bdaddr + HID example — register custom HID on rfcomm

hcitool dev hciconfig hci0 class 0x000540 # HID device class sdptool add HID

Use a HID descriptor crafted as keyboard, send keystrokes

undefined

undefined

Audio Eavesdropping

音频窃听

If a target has Bluetooth headset paired and active, and you can re-pair (PIN brute or KNOB):

HSP/HFP profiles let you become the peer and receive audio
Some firmware allows simultaneous peer connections — eavesdrop without disrupting

如果目标设备已配对并正在使用 Bluetooth 耳机，并且你可以重新配对（暴力破解 PIN 或利用 KNOB）：

HSP/HFP Profile 允许你成为对端并接收音频
某些固件允许同时保持多个对端连接——可在不造成中断的情况下进行窃听

Engagement Cheatsheet

实战测试速查表

bash

undefined

bash

undefined

1. Discover

sudo hcitool inq

2. Enumerate services per device

sdptool browse <MAC>

3. SPP (industrial/IoT) — connect and explore

sudo rfcomm bind /dev/rfcomm0 <MAC> 1 sudo screen /dev/rfcomm0 9600

4. Patch-level scan

python blueborne_scanner.py <MAC>

5. KNOB testing (with adapter that supports internalblue)

internalblue → log keys → re-pair target

6. Document profiles, auth state, exposed commands per device

undefined

undefined

Detection

检测

No native Bluetooth Classic IDS in most environments
Active inquiry visible to nearby Bluetooth-aware monitoring (rare)
Re-pairing prompts on target devices may surface to users

大多数环境中没有原生的 Bluetooth Classic IDS
主动 inquiry 可被附近支持 Bluetooth 感知的监控设备发现（少见）
目标设备上的重新配对提示可能会让用户察觉

Reporting

报告

Identify chipset + firmware version per device (often visible in service records)
Map CVE applicability (BlueBorne, KNOB, BlueFrag, et al.)
Document specific profile abuses (SPP exposed without auth, HID spoofing successful, etc.)

识别每台设备的芯片组和固件版本（通常可在服务记录中看到）
确定 CVE 的适用情况（BlueBorne、KNOB、BlueFrag 等）
记录具体的 Profile 滥用情况（SPP 无需认证即可访问、HID 冒充成功等）

Key References

主要参考资料

internalblue: github.com/seemoo-lab/internalblue
KNOB attack: knobattack.com
BlueBorne: armis.com/blueborne
Bluetooth Core Spec — Volume 2 (BR/EDR Controller)
Source: https://github.com/SnailSploit/offensive-checklist/blob/main/wireless.md

internalblue: github.com/seemoo-lab/internalblue
KNOB 攻击：knobattack.com
BlueBorne: armis.com/blueborne
Bluetooth Core Spec — Volume 2 (BR/EDR Controller)
来源：https://github.com/SnailSploit/offensive-checklist/blob/main/wireless.md

offensive-bluetooth-classic

Original

Translation

Bluetooth Classic (BR/EDR) Attacks

Bluetooth Classic (BR/EDR) 攻击

Quick Workflow

快速工作流

Discovery

设备发现

Modern adapter (built-in or USB Bluetooth 4.0+)

Modern adapter (built-in or USB Bluetooth 4.0+)

bluetoothctl interactive

bluetoothctl interactive

Discoverable-mode-only devices appear; non-discoverable need address brute

Discoverable-mode-only devices appear; non-discoverable need address brute

(very slow — ~7 hours per OUI prefix)

(very slow — ~7 hours per OUI prefix)

Service Discovery (SDP)

服务发现 (SDP)

List all services on a device

List all services on a device

SPP Abuse

SPP 滥用

Connect to SPP service, channel typically 1

Connect to SPP service, channel typically 1

Then interact with the device's CLI / debug menu

Then interact with the device's CLI / debug menu

KNOB (CVE-2019-9506)

KNOB (CVE-2019-9506)

Test with internalblue (requires Broadcom firmware patch)

Test with internalblue (requires Broadcom firmware patch)

Patch firmware to allow 1-byte key; pair with target; observe weak key

Patch firmware to allow 1-byte key; pair with target; observe weak key

BlueBorne (CVE-2017-1000251 et al.)

BlueBorne (CVE-2017-1000251 et al.)

Armis blueborne-scanner — checks for patch-level

Armis blueborne-scanner — checks for patch-level

HID Spoofing (PoC)

HID 冒充 (PoC)

bdaddr + HID example — register custom HID on rfcomm

bdaddr + HID example — register custom HID on rfcomm

Use a HID descriptor crafted as keyboard, send keystrokes

Use a HID descriptor crafted as keyboard, send keystrokes

Audio Eavesdropping

音频窃听

Engagement Cheatsheet

实战测试速查表

1. Discover

1. Discover

2. Enumerate services per device

2. Enumerate services per device

3. SPP (industrial/IoT) — connect and explore

3. SPP (industrial/IoT) — connect and explore

4. Patch-level scan

4. Patch-level scan

5. KNOB testing (with adapter that supports internalblue)

5. KNOB testing (with adapter that supports internalblue)

6. Document profiles, auth state, exposed commands per device

6. Document profiles, auth state, exposed commands per device

Detection

检测

Reporting

报告

Key References

主要参考资料