Snoop Version 2 Packet Capture File Format

Callaghan, Brent; Gilligan, Robert

doi:10.17487/rfc1761

Cited by 6 publications

(2 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It is interesting to note that using this feature does not even require rooting the phone.) The HCI snoop log captures all Bluetooth HCI packets to a binary-encoded file, which it writes to an SD card; the log format resembles the Snoop Version 2 Packet Capture File Format described in RFC 1761 [15].…”

Section: Capturing Hci Tracesmentioning

confidence: 99%

Recurring verification of interaction authenticity within bluetooth networks

Peters

Pierson

Sen

et al. 2021

Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks

View full text Add to dashboard Cite

Although user authentication has been well explored, device-todevice authentication -specifically in Bluetooth networks -has not seen the same attention. We propose Verification of Interaction Authenticity (VIA) -a recurring authentication scheme based on evaluating characteristics of the communications (interactions) between devices. We adapt techniques from wireless traffic analysis and intrusion-detection systems to develop behavioral models that capture typical, authentic device interactions (behavior); these models enable recurring verification of device behavior. To evaluate our approach we produced a new dataset consisting of more than 300 Bluetooth network traces collected from 20 Bluetooth-enabled smart-health and smart-home devices. In our evaluation, we found that devices can be correctly verified at a variety of granularities, achieving an F1-score of 0.86 or better in most cases. CCS CONCEPTS• Security and privacy → Mobile and wireless security; Intrusion detection systems; Multi-factor authentication.

show abstract

Section: Capturing Hci Tracesmentioning

confidence: 99%

Recurring verification of interaction authenticity within bluetooth networks

Peters

Pierson

Sen

et al. 2021

Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks

View full text Add to dashboard Cite

show abstract

“…Once HCI Snoop Log has been enabled through the Android developer settings, a capture file is written to the internal memory of the Android device. It uses the Snoop Packet Capture format which is specified in RFC 1761 [11]. Each HCI packet is encapsulated in a Snoop Record which also stores length and time information in a Record Header.…”

Section: Architecturementioning

confidence: 99%

InternalBlue - Bluetooth Binary Patching and Experimentation Framework

Mantz

Classen

Schulz

et al. 2019

Proceedings of the 17th Annual International Conference on Mobile Systems, Applications, and Services

View full text Add to dashboard Cite

Bluetooth is one of the most established technologies for short range digital wireless data transmission. With the advent of wearables and the Internet of Things (IoT), Bluetooth has again gained importance, which makes security research and protocol optimizations imperative. Surprisingly, there is a lack of openly available tools and experimental platforms to scrutinize Bluetooth. In particular, system aspects and close to hardware protocol layers are mostly uncovered.We reverse engineer multiple Broadcom Bluetooth chipsets that are widespread in off-the-shelf devices. Thus, we offer deep insights into the internal architecture of a popular commercial family of Bluetooth controllers used in smartphones, wearables, and IoT platforms. Reverse engineered functions can then be altered with our InternalBlue Python framework-outperforming evaluation kits, which are limited to documented and vendor-defined functions. The modified Bluetooth stack remains fully functional and highperformance. Hence, it provides a portable low-cost research platform.InternalBlue is a versatile framework and we demonstrate its abilities by implementing tests and demos for known Bluetooth vulnerabilities. Moreover, we discover a novel critical security issue affecting a large selection of Broadcom chipsets that allows executing code within the attacked Bluetooth firmware. We further show how to use our framework to fix bugs in chipsets out of vendor support and how to add new security features to Bluetooth firmware. CCS CONCEPTS• Security and privacy → Mobile and wireless security; • Networks → Link-layer protocols.

show abstract