Bluetooth Keyboards: who owns your keystrokes?

information supplemental to the presentation at ShmooCon 2010

slides

• ossmann-shmoo-2010.odp (openoffice)
• ossmann-shmoo-2010.ppt (powerpoint)

links

• gr-bluetooth passive monitoring with USRP or USRP2

  includes btaptap, Wireshark plugin, Kismet-Bluetooth plugin

• Kismet

  includes Kismet-BTSCAN plugin (active scan)

• HID Attack
• BT Audit includes psm_scan
• Reversing and Exploiting an Apple Firmware Update

checklist

checklist.txt

code

This stuff requires BlueZ. Compile with something like:

cc -o bthidproxy -lbluetooth bthidproxy.c

• bthidproxy.c proxies a Bluetooth HID connection
• aaplfwdump.c pretends to be keyboard to acquire firmware
• aaplfwpush.c pushes firmware to keyboard
• stuffkeys.c stuffs keystrokes into remote HID server (similar to hidattack)
• format-bug.patch fixes format string bug plus a minor output bug in BTCrack OSS 1.0