Extensible Bluetooth vulnerability testing framework for BR/EDR and BLE.

Docs • Installation • Usage • Exploits • Hardware • TODOs • Automotive Evaluation • Bluetooth Resources • License

BlueToolkit is a modular, black-box Bluetooth security testing framework for Bluetooth Classic (BR/EDR) and Bluetooth Low Energy (BLE). It supports semi-automated testing and has three main modules:

• Recon: gathers Bluetooth capabilities and security configuration.
• Exploit: executes tests for (currently) 43 public exploits (MitM, RCE, DoS, etc.). The vulnerability templates are in the exploits folder. Support for more can be added by TODO.
• Report: generates structured, machine- and human-readable JSON reports.

We evaluated BlueToolkit on 22 cars from different vendors (Audi, BMW, Chevrolet, Honda, Hyundai, Mercedes-Benz, Mini, Opel, Polestar, Renault, Skoda, Toyota, VW, Tesla) and uncovered 128 vulnerabilities.

In addition, we show how to Hijack online accounts via MAP for already established connections or with a MitM position.

This work led to a research paper accepted at WOOT 25': add missing link when we have it

Installation

BlueToolkit can be installed on bare metal Ubuntu/Debian systems (recommended) or using a Virtual Machine. In both cases the installer will prompt to install the specific modules for Braktooth and BluetoothAssistant, which require specific hardware devices to be available and plugged in. Standalone modules installation can also be done separately by running the installer again.

git clone https://github.com/sgxgsx/BlueToolkit
chmod +x ./BlueToolkit/install.sh
sudo ./BlueToolkit/install.sh [-dev]

git clone https://github.com/sgxgsx/BlueToolkit --recurse-submodules
cd BlueToolkit/vagrant
vagrant up

Usage

Run bluekit -h to display BlueToolkit usage information:

usage: bluekit [-h] [-t TARGET] [-l] [-c] [-ct] [-ch] [-v VERBOSITY] [-ex EXCLUDEEXPLOITS [EXCLUDEEXPLOITS ...]] [-e EXPLOITS [EXPLOITS ...]] [-r] [-re] [-rej] [-hh HARDWARE [HARDWARE ...]] ...

positional arguments:
  rest

options:
  -h, --help            show this help message and exit
  -t TARGET, --target TARGET
                        target MAC address
  -l, --listexploits    List exploits or not
  -c, --checksetup      Check whether Braktooth is available and setup
  -ct, --checktarget    Check connectivity and availability of the target
  -ch, --checkpoint     Start from a checkpoint
  -v VERBOSITY, --verbosity VERBOSITY
                        Verbosity level
  -ex EXCLUDEEXPLOITS [EXCLUDEEXPLOITS ...], --excludeexploits EXCLUDEEXPLOITS [EXCLUDEEXPLOITS ...]
                        Exclude exploits, example --exclude exploit1, exploit2
  -e EXPLOITS [EXPLOITS ...], --exploits EXPLOITS [EXPLOITS ...]
                        Scan only for provided --exploits exploit1, exploit2; --exclude is not taken into account
  -r, --recon           Run a recon script
  -re, --report         Create a report for a target device
  -rej, --reportjson    Create a report for a target device
  -hh HARDWARE [HARDWARE ...], --hardware HARDWARE [HARDWARE ...]
                        Scan only for provided exploits based on hardware --hardware hardware1 hardware2; --exclude and --exploit are not taken into account

Some usage examples are:

• List all available exploits (no root required):

  bluekit -l

• Run recon:

  sudo bluekit -t AA:BB:CC:DD:EE:FF -r

• Test connectivity:

  sudo bluekit -t AA:BB:CC:DD:EE:FF -ct

• Test one or more exploits (space separated):

  sudo bluekit -t AA:BB:CC:DD:EE:FF -e invalid_max_slot au_rand_flooding internalblue_knob

More documentation is available in our wiki

Hardware

Some attacks require specific hardware:

• ESP-WROVER-KIT-VE for Braktooth vulnerabilities
• Nexus5 phone for Internalblue. Could be replaced with a CYW20735 but two exploits won't work and it would need a new hardware profile.
• CYW920819M2EVB-01 for BIAS, BLUR and BLUFFS attacks.

Available Bluetooth Vulnerabilities and Attacks

BlueToolkit automatically downloads all vulnerability and hardware templates. BlueToolkit templates repository provides a full list of ready-to-use templates. Additionally, you can write your own templates and checks as well as add new hardware by following BlueToolkit's templating guide The YAML reference syntax is available here

We collected and classified Bluetooth vulnerabilities in an "Awesome Bluetooth Security" way. We used the following sources - ACM, IEEE SP, Blackhat, DEFCON, Car Hacking Village, NDSS, and Google Scholars. Looked for the following keywords in Search Engines such as Google, Baidu, Yandex, Bing - Bluetooth security toolkit, Bluetooth exploits github, Bluetooth security framework, bluetooth pentesting toolkit. We also parsed all Github repositories based on the following parameters - topic:bluetooth topic:exploit, topic:bluetooth topic:security.

Currently BlueToolkit check the following vulnerabilities and attacks:

For manual attacks refer to the documentation.

Novel attacks

These attacks a novel/new and are tested by the framework

Vulnerabilities to be added soon

TODO List

• Add Support for BLE (Bluetooth Low Energy)
  • Implement BLE functionality to enhance the project's connectivity capabilities.
• Continuously (Re-)Develop Proofs of Concept (PoCs)
  • Develop new PoCs to explore additional use cases or features.

Bluetooth Vulnerabilities and Attacks

Additionally, we found the following Bluetooth Classic and Bluetooth Low Energy (BLE) vulnerabilities. The table has the following information about the attacks and vulnerabilities - name, type either implementation-specific, protocol-specific or affecting a BT profile, Bluetooth Type (BLE, BT, BT + BLE), BT versions affected, number of exploits, year released, CVE if available, CVSS if available, Hardware if required, Proof of Concept if available and additional information in the comment section with additional links or explanation.

The YAML DSL reference syntax is available here.

License

Shield:

BlueToolkit is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.

For inquiries contact at https://linktr.ee/schwytz