undefined | Better HN

0 pointsAnimats9y ago0 comments

Bluetooth devices can do MITM attacks on anything with a wireless keyboard or mouse. This device isn't designed to do that, but it's a programmable long-range Bluetooth device designed to be unobtrusive, so it's hardware that can be repurposed for an attack.

0 comments

3 comments · 1 top-level

BHSPitMonkey9y ago· 2 in thread

I don't think the beacons are "programmable" in the sense you think they are. They have a protocol which allows for configuring a root password and changing the string that it broadcasts, but it's not like you can install a different Bluetooth stack or profile (short of some profound vulnerability, but the same could be said for a pair of Bluetooth headphones).

bigiain9y ago

They might not be intended to be, but from their dev site:

"Estimote Beacon is a small computer. Its 32-bit ARM® Cortex M0 CPU is accompanied by accelerometer, temperature sensor, and what is most important—2.4 GHz radio using Bluetooth 4.0 Smart, also known as BLE or Bluetooth low energy."

And from here: http://makezine.com/2014/01/03/reverse-engineering-the-estim...

"The Estimote is built around the Nordic Semiconductor nRF51822, which explains their presence on the Nordic booth at CES. It’s a nice chip, basically a 32-bit ARM Cortex M0 CPU with 256KB of flash and 16KB of RAM with a built-in 2.4GHz radio supporting both Bluetooth LE as well as 2.4GHz operation—where the 2.4GHz mode is on air compatible with the nRF24L series products from Nordic."

They might not be "easily programmable", but how much would you be against Travis Goodspeed being able to do something similar to what he's done here with an Estimote beacon? http://travisgoodspeed.blogspot.com.au/2011/02/promiscuity-i... (You can't see it very well in the image in the Makezine article of the board, but under the "CH3" in the label for the smaller chip is a 4 pin header that I'm 99.9% sure will be a jtag header...)

gortok9y ago

This version is based off the nRF52, which is still in preproduction as I understand it ( disclosure: I write firmware for the nRF51 for an IoT startup).

Both the 51 and 52 can have a BLE DFU programmed into the chip, allowing over the air firmware updates, so you wouldn't need a JTag. Most companies lock this down with a secure boot loader, meaning you would need to be able to flash the device using a JTag (only $500!)

j / k navigate · click thread line to collapse