InjectaBLE: Injecting malicious traffic into established Bluetooth Low Energy connections

Abstract

Bluetooth Low Energy (BLE) is nowadays one of the most popular wireless communication protocols for Internet of Things (IoT) devices. As a result, several attacks have targeted this protocol or its implementations in recent years, illustrating the growing interest for this technology. However, some major challenges remain from an offensive perspective, such as injecting arbitrary frames, hijacking the Slave role or performing a Manin-The-Middle in an already established connection. In this paper, we describe a novel attack called InjectaBLE, allowing to inject malicious traffic into an existing connection. This attack is highly critical as the vulnerability exploited is inherent to the BLE specification itself, which means that any BLE connection can be possibly vulnerable, regardless of the BLE devices involved in the connection. We describe the theoretical foundations of the attack, how to implement it in practice, and we explore four critical attack scenarios allowing to maliciously trigger a specific feature of the target device, hijack the Slave and Master role or to perform a Man-in-the-Middle attack. Finally, we discuss the impact of this attack and outline some mitigation measures.

A Lightweight Intrusion Detection System against IoT Memory Corruption Attacks

“…Attacks that exploit LoRaWAN MAC and physical layer vulnerabilities to perform DoS, packet injection and replay attacks have also been reported [3], [7], [8]. Similar attacks are possible for the BLE stack [9]- [12]. IoT protocols are often subject to packet injection based attacks resulting in exploits such as DoS, MITM, RCE and privilege escalation.…”

Bluetooth Vulnerabilities in General and Intimate Health IoT Devices and Apps: the Case of Female-oriented Technologies

“…The Connection Hijack attacks target a pre-existing BLE connection. In 2021, researchers identified a flaw in the BLE specification itself that allowed this attack to be implemented on any device using BLE version 4.0-5.2 [8]. Implementation of this attack has a catastrophic impact on the BLE connection as it hands in strong controls to the attacker.…”

“…The BLE device and phone are then connected using their respective app and the packets exchanged are saved. The captured pcap files can then be examined using the Crackle BLE utility tool 8 . Crackle is designed to decrypt BLE traffic from BLE versions 4.0 -4.2 and is able to determine if the packets captured is encrypted or unencrypted.…”

ESPwn32: Hacking with ESP32 System-on-Chips

“…For example, the repurposing of a hardware register on Nordic Semiconductor's nRF24L01 chip by Travis Goodspeed to allow passive eavesdropping on proprietary protocols in the 2.4 GHz band [20] was a decisive step, allowing the development of a dedicated analysis firmware [27] and the discovery of multiple vulnerabilities targeting various wireless keyboards and mice [26]. Many works have extended this hack to nRF51 and nRF52 chips, allowing the development of offensive tools on various platforms [7], [8], [13] and the discovery of critical low-level attacks targeting the BLE protocol [9], [11]. Another example is modification of ATMEL's RZUSBStick firmware by Joshua Wright to provide injection capabilities as part of his work on the security of the ZigBee [40] protocol.…”