Repository files navigation

This repository contains the implementation of a proof of concept to record and replay audio from a bluetooth device without the legitimate user's awareness.

The PoC was demonstrated during the talkBSAM: Seguridad en Bluetooth atRootedCON 2024 in Madrid.

It's designed to raise awareness about the insecure use of Bluetooth devices, and the need of a consistent methodology for security evaluations. That's the purpose ofBSAM, the Bluetooth Security Assessment Methodology, published by Tarlogic and availablehere.

This proof of concept exploits the failure to comply with theBSAM-PA-05 control within the BSAM methodology. Consequently, the device enables the pairing procedure without requiring user interaction and exposes its functionality to any agent within the signal range.

More information on ourblog.

The code is written in Python and has been tested with Python 3.11.8, but it mainly uses widely available tools in Linux systems.

The PoC uses the following tools:

• bluetoothctl
• btmgmt
• pactl
• parecord
• paplay

In Arch Linux distributions,bluetoothctl andbtmgmt can be installed with the packagebluez-utils, whilepactl,parecord andpaplay are available in thelibpulse package.

For the PoC to work, it is necessary to have a working installation of the BlueZ Bluetooth stack, available in thebluezpackage for Arch Linux distributions. A working installation of an audio server compatible with PulseAudio, such as PipeWire, is also required to record and play audio.

Ensure that your device is capable of functioning as an audio source, meaning it has a microphone, and that it is discoverable and connectable via Bluetooth.

For instance, to be discoverable and connectable, the earbuds used during the talk must be outside of their charging case. By default, they only activate the microphone when placed in the user's ears, although this setting can be adjusted in the configuration app.

Additionally, ensure that the device is not already connected, or alternatively, that it supports multiple connections.

Firstly, the address of the device must be discovered using a tool such asbluetoothctl:

$ bluetoothctl[bluetooth]# scan on

Once the address of the device is discovered, the script can handle the rest:

$ python BlueSpy.py -a <address>

Note: The script might prompt for superuser permissions to modify the configuration of yourBlueZ instance and pair it with the remote device.

BlueSpy.py is the main script that executes every step of the process. However, if you encounter issues with any of the phases, so it might be helpful to execute them individually:

• pair.py utilizes the command-line toolbtmgmt to modify the configuration of yourBlueZ and initiate a pairing process with the remote device. The exact commands used are in thepair function insidecore.py.
• connect.py utilizes the command-line toolbluetoothctl to initiate a quick scan (necessary for BlueZ) and establish a connection to the device. The exact commands used are in theconnect function insidecore.py.
• just_record.py utilizes the command-line toolspactl andparecord to search for the device in the system's audio sources (it must function as a microphone) and initiate a recording session. The exact commands used are in therecord function insidecore.py.
• Theplayback function insidecore.py executespaplay to play back the captured audio.

If you encounter issues with any of the phases, examine the commands incore.py and try to execute them in a shell. This will provide more information on what may be failing.

If you have any questions regarding how the Bluetooth standard operates or how to assess the security of a Bluetooth device, please refer to our BSAM methodology webpage:

• BSAM: Bluetooth Security Assessment Methodology