hacking ble bicycle locks for fun & a small profit con 26/def con 26... · 2020-05-16 ·...
TRANSCRIPT
![Page 1: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/1.jpg)
Hacking BLE Bicycle Locks for Fun & A Small Profit
![Page 2: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/2.jpg)
1
![Page 3: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/3.jpg)
whoami
• From Sunny Singapore
• Senior Security Consultant @ MWR
• Mobile and Wireless Geek
– BlackHat USA 2016 – Bad for Enterprise: Attacking BYOD Enterprise Mobile Security Solutions
2
![Page 4: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/4.jpg)
Bike-Sharing Economy and the BLE “Smart” Lock
1
Overview
3
Building a “Master” Key3
Demo
4
Analyzing Communications2
![Page 5: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/5.jpg)
![Page 6: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/6.jpg)
Major Players
![Page 7: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/7.jpg)
Major Players
6
Country China China SingaporeFounded 2014 2015 2017
Operations 20 Countries 16 Countries 22 CountriesValuation $2 Billion $2.7 Billion
Cost SGD$0.50/30min
![Page 8: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/8.jpg)
Bluetooth Low Energy
Generic Access Profile (GAP)• Peripheral
Small low powered devicee.g. bicycle lock
• CentralHigh powered computing devicee.g. Mobile Phone
![Page 9: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/9.jpg)
Bluetooth Low Energy
8
Generic Attribute Profile (GATT)• Services
Groups of Characteristics16/128-bit UUID
• CharacteristicsA single data point16/128-bit UUID
![Page 10: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/10.jpg)
Bluetooth Bicycle Lock
9
![Page 11: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/11.jpg)
Personal BLE Bicycle Lock
![Page 12: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/12.jpg)
Major Components
11
![Page 13: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/13.jpg)
Lock Decomposition
![Page 14: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/14.jpg)
Motor to release lock
Logic Controller /
BLE
![Page 15: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/15.jpg)
Notch
Spring Mechanism
Notch
Pin
![Page 16: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/16.jpg)
15
![Page 17: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/17.jpg)
Ubertooth One – Wireshark Capture
![Page 18: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/18.jpg)
What do I need?
1.Communication Endpoints
2.Understanding the Data
17
![Page 19: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/19.jpg)
BLEAH - Services and Characteristics
![Page 20: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/20.jpg)
frida-trace
19
![Page 21: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/21.jpg)
iOS CoreBluetooth
CBPeripheral• Remote peripheral devices that the app has discovered advertising or is currently connected
to.• -m "*[CBPeripheral readValue*]"
• -m "*[CBPeripheral writeValue*]"
• -m "*[CBPeripheral setNotifyValue*]"
CBPeripheralDelegate• Provides methods called on events relating to discovery, exploration, and interaction with a
remote peripheral.• -m "*[* *didUpdateNotificationStateForCharacteristic*]"
• -m "*[* *didUpdateValueForCharacteristic*]"
20
![Page 22: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/22.jpg)
Summary…
Scan QR Code01
02Get Lock Key From Server
04Request Encrypted Token
05Gets Encrypted Token
06Decrypt Token & Unlock!
03Server Responds with Lock Key
![Page 23: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/23.jpg)
![Page 24: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/24.jpg)
oBike
23
![Page 25: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/25.jpg)
oBike Lock
oBike lock teardown and rebuild, dockless share bike rescue: https://youtu.be/Vl3Gl8w8n-Q
![Page 26: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/26.jpg)
![Page 27: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/27.jpg)
02App Checks Lock Status. Uploads Coordinates.
04App Requests Key Source
05App Gets Key Source
06Request Unlock Key
07Server Responds with Unlock Key
08Unlock Bike Lock
03Server Responds with Lock Status
http://www.o.bike/download/app.html?m=06500206401
![Page 28: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/28.jpg)
POST /api/v2/bike/060511449/lockNo HTTP/1.1Host: mobile.o.bikeContent-Type: application/jsonversion: 3.2.4
{"deviceId":"1521828969000-8035385","dateTime":"1521984609867.631836","longitude":103.8XXXXXXXX,"latitude":1.3XXXXXXXX
}&58bc93f4ac249b829174520a5afe73
02App Checks Lock Status. Uploads Coordinates.
http://www.o.bike/download/app.html?m=06500206401
![Page 29: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/29.jpg)
03Server Responds with Lock Status
HTTP/1.1 200Content-Type: application/json;charset=UTF-8Connection: closeVary: Accept-EncodingContent-Length: 93
{"data":{"lockNo":"639BADF22","lockType":2,"faultBike":false},
"success":true,"errorCode":100}
![Page 30: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/30.jpg)
]16506 ms | -[CBPeripheral setNotifyValue:0x1 forCharacteristic:
CBCharacteristic: 0x1704ae100 UUID = FFF6,
16519 ms | | | | | | -[CBPeripheral writeValue:0x17483f980 forCharacteristic:0x1704ae100
04App Requests Key Source
![Page 31: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/31.jpg)
16774 ms -[BluetoothManager peripheral:0x1742f6080 didUpdateValueForCharacteristic:0x1704ae100
bikeId":"060511449","deviceId":“XXXXXXXXXX","dateTime":"1521984617263.854980","keySource":"c4f1dc24"}
05App Gets Key Source
![Page 32: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/32.jpg)
POST /api/v2/bike/unlockPass HTTP/1.1Host: mobile.o.bikeContent-Type: application/jsonversion: 3.2.4
{"bikeId":"060511449","deviceId":"1521828969000-8035385","dateTime":"1521984617263.854980","keySource":"c4f1dc24"
}&ad6dad370f01782adfe200584ff63be31af29069
HTTP/1.1 200Content-Type: application/json;charset=UTF-8Connection: closeVary: Accept-EncodingContent-Length: 130
{"data":{"encryptionKey":180,"keys":"8be1be17d41e8fdff1ae1c82e4500fec","serverTime":1521984619298
},"success":true,"errorCode":100}
06Request Unlock Key
07Server Responds with Unlock Key
![Page 33: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/33.jpg)
19108 ms | | | | | +[BluetoothSendMessage Index:0xb4Key:8be1be17d41e8fdff1ae1c82e4500fec]
19118 ms | | | | | -[CBPeripheral writeValue:0x174a54340 forCharacteristic:0x1704ae100
19127 ms | | | | | -[CBPeripheral writeValue:0x174a53ef0 forCharacteristic:0x1704ae100
08Unlock Bike Lock
![Page 34: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/34.jpg)
Unlock Algorithm
Message 1??? Static Message Length Command67 74 18 82
Message 2AES Key (Truncated) BCC8b e1 be 17 d4 1e 8f df f1 ae 1c 82 ff
Index:0xb4Key:8be1be17d41e8fdff1ae1c82e4500fec
Key Index ??? Static Date Timeb4 00 00 02 79 40 48 00 6b a4 b7 5a
BCC Calculation:
for i in bytearr {x ^= i
}return x
bytearr = Command … AES Key
![Page 35: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/35.jpg)
HTTP Message Encryption
POST /api/v2/bike/060511449/lockNo HTTP/1.1Host: mobile.o.bikeContent-Type: application/jsonversion: 3.2.4Authorization: Bearer *****
{"value":"68693cfa10579681d81837350843342d99f0ba4373f9926c53c1f1c88576304d0b936e7003888288fe949e73eb1d3267b713d2b261829ee0498523423d6965db28e8b99854bf2adf592e51fb9da3b77068f647b29caa5f22473ad01ec1011270a9d3a73100292b0fdf331b17b37564556df790a58489d8cad3f4dd276d5ae68a95fc7effefc998de151eeb0983ddc7216345e7682df8cf2de0d2cbf3a8b7e7c1c8f8604016c377b0195b0ab9e83c604d"}
POST /api/v2/bike/unlockPass HTTP/1.1Host: mobile.o.bikeContent-Type: application/jsonversion: 3.2.4Authorization: Bearer *****
{"value":"aa47e49f01cc740fdaa87973966799f94bf02ced7416b15f1cc7f63bf52f50f928e76c5d7f911a054188751f7243d68daef4b69b22432ec2166dc823f29de811e21f4adbfdb826748b9e2573912422b0a51f6a07a5c7be2bf7d41b56d69945c3ecf3ec94444db5abb26b8c771fe8eba91cb1a5d336cc2130bde9bcb25350250bb92c5aa880b2e6c0b3c0004c11ab0f14eb1182b78fb3dcb5eb68e61205ae5048"}
![Page 36: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/36.jpg)
HTTP Message Encryption - AES
35
9386 ms | | +[OBikeEncrypt aesEncryptString:{"deviceId":"1521828969000-8035385","dateTime":"1521984609867.631836","longitude":103.8331503422035,"latitude":1.381631386467611}&58bc93f4ac249b829174520a5afe733503f371f8]
9388 ms | | | +[OBikeEncrypt aesEncryptData:<7b226465 76696365 4964223a 22313532 31383238 39363930 30302d38 30333533 3835222c 22646174 6554696d 65223a22 31353231 39383436 30393836 372e3633 31383336 222c226c 6f6e6769 74756465 223a3130 332e3833 33313530 33343232 3033352c 226c6174 69747564 65223a31 2e333831 36333133 38363436 37363131 7d263538 62633933 66346163 32343962 38323931 37343532 30613561 66653733 33353033 66333731 6638> keyData:<6f42694f 534d5946 557a4c65 64333234>]
keyData:<6f42694f 534d5946 557a4c65 64333234> = oBiOSMYFUzLed324
oBiOSMYFUzLed 324AES Key
![Page 37: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/37.jpg)
HTTP Message Encryption – SHA1Sum
36
POST /api/v2/bike/unlockPass HTTP/1.1Host: mobile.o.bikeContent-Type: application/jsonversion: 3.2.4
{"bikeId":"060511449","deviceId":"1521828969000-8035385","dateTime":"1521984617263.854980","keySource":"c4f1dc24"
}&ad6dad370f01782adfe200584ff63be31af29069
{"bikeId":"060511449","deviceId":"1521828969000-8035385","dateTime":"1521984617263.854980","keySource":"c4f1dc24"
}&
oBiOSX4buhBMG 324
![Page 38: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/38.jpg)
08Unlock Bike Lock
09Lock Status & Start Timer
10Lock Status & End Timer
… continued …
11You have been billed $$$
![Page 39: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/39.jpg)
oBike Demo
38
![Page 40: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/40.jpg)
Retrieving Firmware… /
40
![Page 41: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/41.jpg)
MoBike
41
![Page 42: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/42.jpg)
![Page 43: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/43.jpg)
02App Checks Lock Status. Uploads Coordinates.
04Server Responds with Unlock Key
03Server Responds with Lock Status
http://www.mobike.com/download/app.html?b=A1234567
01
05Unlock Bike Lock
![Page 44: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/44.jpg)
05Unlock Bike Lock
06Lock Status & Start Timer
07Lock Status & End Timer
08You have been billed $$$
… continued …
![Page 45: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/45.jpg)
HTTP Message Integrity Check
45
POST /api/v2/rentmgr/unlockBike.do?sign=b9441790c2e3c42a57b439b51995f546 HTTP/1.1Host: app.mobike.comtime: 1530100847000mobileNo: +6512345678accesstoken: XXXXXXXXXXXXXXXXplatform: 0Content-Type: application/x-www-form-urlencodedConnection: closeContent-Length: 445
accesstoken=XXXXXXXXXXXXXXXX&bikecode=A0000XXXXX&biketype=0&btEnabled=1&channel=1&client_id=ios&epdata=Es7dCTkXiZ1IV3H6z%2BS9R%2BYzRjFby0T4ADUNKh0aXm6wfZzfJtQEQ5IC%2By5lZYGKFVy8I9vP6wwvkKCEqxNSMMCM3WespduyU8Svj7qyadFV4pN/nbC1behZa7ew3V0G8ofy6udhTkjbWLcjWeWvioJwrELB24aALccUKxCoMds%3D&latitude=1.3XXX&longitude=103.8XXX&mobileNo=+6512345678&time=1530100847000×tamp=1530100847.123456&userid=XXXXXXXXX
![Page 46: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/46.jpg)
HTTP Message Encryption
46
30714 ms | +[RSA encryptString:XXXXXXXXXXuseridXXXXXXX#1530031691.737942
]
enter mbk_lowercaseMd5 -> accesstoken=XXXXXXXXXX&bikecode=A0000XXXXX&biketype=0&btEnabled=1&channel=1&client_id=ios&epdata=Es7dCTkXiZ1IV3H6z+S9R+YzRjFby0T4ADUNKh0aXm6wfZzfJtQEQ5IC+y5lZYGKFVy8I9vP6wwvkKCEqxNSMMCM3WespduyU8Svj7qyadFV4pN/nbC1behZa7ew3V0G8ofy6udhTkjbWLcjWeWvioJwrELB24aALccUKxCoMds=&latitude=1.381585998461937&longitude=103.8330852148159&mobileNo=+65XXXXXXXX&time=1530031691000×tamp=1530031691.737942&userid=XXXXXXXXX@iossecret
leave mbk_lowercaseMd5 -> b9441790c2e3c42a57b439b51995f546
![Page 47: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/47.jpg)
02App Checks Lock Status. Uploads Coordinates.
POST /api/v2/rentmgr/unlockBike.do?sign=9623f419340536f95c314d81c4c2b548 HTTP/1.1
bikecode=A0000XXXXX&biketype=0&btEnabled=1&channel=1&client_id=ios&epdata=ML1G%2BNjHnhzQPMoRZwtBx5k3c0yOBpBFZKePvb3WsR0%2BWBvtT7saxcwIwbI6JAkG27HGjWKMGjeCwUyvw1zOgOA17Lybmbv30ltfBwUkeFmpgklpG2YMEgFEEdCjYxhskfMtoLKWCz3WFBriiZ5S6yHnH5aT1yKe/YB7mMo1f0U%3D&latitude=1.3XXX&longitude=103.8XXXX×tamp=1530096030.920647&userid=XXXXX
http://www.mobike.com/download/app.html?b=A1234567
01
![Page 48: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/48.jpg)
03Server Responds with Lock Status
Faulty
HTTP/1.1 200Content-Type: application/json;charset=UTF-8Connection: close{
..."message": "Our apologies, this bike needs
maintenance, please use another one",...}
Good
HTTP/1.1 200Content-Type: application/json;charset=UTF-8
Connection: close
{...
"authkey": "","data":
"001BB441CB88B4034565E1C7BE448CD4B3D9F5CAA8452A23235201",
...}
04Server Responds with Unlock Key
![Page 49: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/49.jpg)
05Unlock Bike Lock
32484 ms -[MBKUnlockBikeData setData:001BB441CB88B4034565E1C7BE448CD4B3D9F5CAA8452A23235201]
35449 ms | -[CBPeripheral setNotifyValue:0x1 forCharacteristic , UUID = A000FEE1-0047-005A-0052-6D6F62696B65,
35452 ms | -[CBPeripheral setNotifyValue:0x1 forCharacteristic , UUID = A000FEE0-0047-005A-0052-6D6F62696B65,
![Page 50: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/50.jpg)
05Unlock Bike Lock
35591 ms | -[MBKPeripheral writeString:30001BB441CB88B40345]35592 ms | | -[CBPeripheral writeValue:0x17525e1b0 forCharacteristic:0x174aa46e0 type:0x0]
35666 ms | -[MBKPeripheral writeString:3165E1C7BE448CD4B3D9]35667 ms | | -[CBPeripheral writeValue:0x17145c410 forCharacteristic:0x174aa46e0 type:0x0]
35739 ms | -[MBKPeripheral writeString:32F5CAA8452A23235201]35741 ms | | -[CBPeripheral writeValue:0x17125e720 forCharacteristic:0x174aa46e0 type:0x0]
![Page 51: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/51.jpg)
Unlock Algorithm
Message 1Index ? Message33 30 001BB441CB88B40345
32484 ms -[MBKUnlockBikeData setData:001BB441CB88B4034565E1C7BE448CD4B3D9F5CAA8452A23235201]
Message 2Index ? Message33 31 65E1C7BE448CD4B3D9
Message 3Index ? Message33 32 F5CAA8452A23235201
![Page 52: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/52.jpg)
MoBike Demo
55
![Page 53: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/53.jpg)
In Summary…
57
![Page 54: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/54.jpg)
2 Types of Lock Schemes
Challenge Response1. Poll Lock for a Token
2. Send Token to Server to Request Key
3. Receive Key
4. Unlock!
58
Direct1. Request Key from Server
2. Receive Key
3. Unlock!
![Page 55: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/55.jpg)
Repeatable Process
1. Enumerate Services and Characteristics - BLEAH
2. Capture Characteristics Settings-m "*[CBPeripheral setNotifyValue*]"
3. Capture BLE Reads & BLE Writes-m "*[CBPeripheral readValue*]"-m "*[CBPeripheral writeValue*]"-m "*[* *didUpdateNotificationStateForCharacteristic*]"-m "*[* *didUpdateValueForCharacteristic*]"
59
![Page 56: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/56.jpg)
Tools Used
60
![Page 57: Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON](https://reader033.vdocument.in/reader033/viewer/2022042420/5f370263ebcb8963f6055811/html5/thumbnails/57.jpg)
61
Thank you for listening!
@Vincent_tky