Slashdot Mirror
Sniffing and Decoding NRF24L01+ and Bluetooth LE Packets For Under $30
An anonymous reader writes "I was able to decode NRF24L01+ and Bluetooth Low Energy protocols using RTL-SDR. As far as I can see, this is the first time NRF24L01+ is being decoded, especially considering the low entry price for the hardware. Given the extreme popularity of this transceiver, we are likely to see a wave of hackers attacking the security of many wireless gadgets, and they are likely to succeed as security is usually the last priority for hardware designers of such cheap gadgets. A lot of work has been done to decode bluetooth using dedicated hardware, and I am sure this software can be adapted to output the right format as input to existing Bluetooth decoders such as Wireshark."
Who needs a keylogger when you can just pipe their output to your local machine directly?
As we all know, we can 3D print any hardware we want. Can't someone just 3D print a new transceiver and we can download a new one?
As far as I can see, this is the first time NRF24L01+ is being decoded, especially considering the low entry price for the hardware.
begin sarcasm:: It is either the first time or it is not the first time. There is nothing that makes it "especially" so. Your violation has been noted. You will be watched for further grammar/logic errors in the future. Tread carefully on Slashdot.
We should learn what we need to know about issues, before we decide what we need to feel about them.
1) dig a hole 30 feet deep, say, 10x10 feet.
2) drop computer in.
3) no wires, dammit, take those out.
4) fill with concrete.
5) place crew-served weapons on top 24x7 for eternity.
that's the only way. it would also help to nuke the machine in a microwave for a minute first so all the chips are back to sand.
if this is supposed to be a new economy, how come they still want my old fashioned money?
I've always suspected pretty much none at all, which is why I keep it turned off unless I really specifically need it -- that and it sucks battery life.
So, what do the people who know the protocols say? Is Bluetooth a protocol with any actual security, or is it just a lame, wide-open security hole written by lazy people who don't care?
Lost at C:>. Found at C.
Uh, Nordic documents its over the air protocols...
https://devzone.nordicsemi.com...
why so much complexity to decode a standardized protocol.
Just to be clear. This is no security breach this is just a very complicated way to set up a demodulator. All that happens is that this guy pulls out the bits from the on-air datastream. Any reasonably configurable 2.4GHz band RF device capable of 1Mbit GFSK would be able to do this.
BLE uses AES to encrypt the channel, so to compromise security you need to extract the key. You either need to compromise the initial key exchange, or you need to perform a successful side channel attack. Both options are certanly viable technically. However in practice. BLE devices pair once at the start of their life and never again limiting the practical scope of a key extractioppn by key exchange comprtomise. Side channel attacks require physical access and as BLE devices tend to be in physical control of their user this is also a bit challenging.
He isn't decrypting the traffic; he's just able to pull the raw packets from the air and express then, still encrypted, as data. And for BTLE, he isn't even able to do that, as he can't manage the frequency agility. So he isn't even seeing the encrypted data, just the BT advertisements...which you can already do with a variety of tools (bluetoothscan, bluelog, etc.) and a cheap BT dongle with greater range than the setup he has put together.
It's a clever kluge for capturing and reading 2.4 GHz traffic with a sub-2.2 GHz device on the cheap but it's not really meaningful from a security perspective.
For your security, this post has been encrypted with ROT-13, twice.
This is not a hack. This is a kludge that is more expensive and way more complicated than any competent person could have done by reading the datasheet and using the device as it was intended. I know this because I use it this way on a project I'm working on right now.
There is no security on the nRF24l01+. It transmits in the clear and describes how it does so in it's publicly and freely available datasheet.
The nRF24l01+ data has been decoded millions of times - by other nRF24l01+ devices. If you just buy one of their modules (Under $3, about $1 in bulk) and set it as a receiver with no ACK packets, you can decode whatever you like by selecting one of the 3 speed options and scanning the 128 frequency channels until you see a 1 in the Recieved Power Detector register. Then it's a matter of selecting one of the 32 addresses so it will accept the data. In all, should take less than an hour to program and set up on an Arduino, a little longer but cheaper on a TI MSP430f2012 (Under $7 total).
The RTLSDR is a receiver ONLY! To actually transmit, it would require a USRP or similar, costing 100s of dollars.
This reminds me of a 2600 article I saw way back in the day. The authors had painstakingly reverse engineered the analog cellular system control channel. I read the article, saw the trouble they went through and where they drew the wrong conclusions, and thought to myself, "Guys, you know you can just go buy the actual spec, right?"
Chelloveck
I give up on debugging. From now on, SIGSEGV is a feature.
This is a nice hack, but in the end, he just build a receiver for the 2.4Ghz band. Big deal.
There has been a much nicer hack to convert a nRF24L01 into a promiscuous listening device:
http://travisgoodspeed.blogspo...
This achieves a very similar goal, but much cheaper.
If you can intercept the traffic, you can also take over control over the peripheral and write. Once you control someones mousepointer, you suddenly have a lot more power, no?
I was promised a flying car. Where is my flying car?
Microsoft keyboards use XOR with the 5-byte MAC address.
http://travisgoodspeed.blogspot.de/2011/02/promiscuity-is-nrf24l01s-duty.html