BLE

Bluetooth Low Energy
Now that we have read about ZigBee, the other most common
communication protocol is BLE. BLE has applications in a number of areas
in IoT, especially because it is one of the communication protocols with
which smartphones can speak.
You will find BLE in a number of smart devices including those
used for health care, smart home automation, retail, smart enterprises,
and
so on. BLE has a number of advantages over other communication
protocols, including the ability to conserve power for a longer duration of
time, extremely low usage of resources even with higher amounts of data
transfer, and so on.
Bluetooth was originally designed by Nokia with the name Wibree
in 2006, which was then later adopted by the Bluetooth Special Interest
Group (SIG) in 2010. Later on, the Bluetooth 4.0 core specification was
released with the focus on designing a radio standard with low power
consumption targeting use in devices with low resources, power, and
bandwidth.
BLE Internals and Association
Before jumping into BLE security and the various exploitation techniques,
let’s have a look at some of the BLE internals, so that we have a greater in-
depth understanding of the foundational concepts when we are working
with BLE-based IoT devices. Figure 10-19 shows the BLE stack structure.








As you can see from Figure 10-19, the BLE stack consists of two
different layers—Host and Controller—bound via the Host Controller
Interface (HCI). All the different components in various layers perform
their own functionality; for example, the Physical layer is responsible for
all the modulation and demodulation of the signals; the Link layer handles
CRC generation, encryption, and defining how devices communicate with
each other; and the Logical Link Control and Adaption Protocol (L2CAP)
takes multiple data formats from the upper layers and puts them into a
BLE packet structure.
Figure 10-19. Bluetooth Low Energy stack (Source: https://www.
bluetooth.com/specifications/bluetooth-core-specification)
Chapter 10 exploiting ZigBee and Ble
284
At the very top of the BLE stack, inside the Host layer, you will notice a
couple of more interesting components such as Attribute Protocol (ATT),
Generic Attribute Profile (GATT), and Generic Access Profile (GAP).
Let’s explore what the functionalities of GAP and GATT are, as these
are the two most important components in the BLE stack, and also
something that you will encounter very frequently during your security
research.
• GAP is responsible for all the discovery and related
aspects in any BLE network. ATT defines the client/
server protocol for data exchange, which is then
grouped together into meaningful services using the
GATT.
• GATT is responsible for the entire exchange of all user
data and profile information in a BLE connection.
So as you can imagine, it will be GATT (or ATT) that we are mostly
concerned with during our further security research journey. As we go
deep inside a BLE connection, it is also vital to understand how all of the
data are stored on a device in a BLE connection. This is better illustrated in
Figure 10-20.

part1- network pene

exploitation techniques on it. Also, the IP and MAC addresses will be
useful for us if we want to take control of the smart plug, as the commands
that the mobile application sends to the device will require both these
values.
Go ahead and connect the smart plug to your network, and connect
your laptop and the VM to the same network using a bridged networking
configuration.
Next, to find the device we can use the command arp -a, which will
give us the result shown in Figure 8-19.
We can also navigate to the IP address found in the earlier step to see
if there are any interesting web dashboards for this device. In this case, we
can see that there are no files being served over the web server and it is
merely running.
The next step, as for any other pentest, would be to perform a network
scan of the device and discover the different ports that are open and what
services are running.
To scan the smart plug, we use nmap, which is a powerful network
scanner allowing us to see open ports, running services, and also in
specific cases perform additional exploitation. We can install nmap using
sudo apt install nmap and then run a scan using this command:
sudo nmap -sS -T4 192.168.0.253
As we can see from Figure 8-20, a couple of ports are open, including
Port 22 which is running SSH.

aes decrypt python2.7

#!/usr/bin/python

import os, sys, re, socket, time, select, random ,getopt
from Crypto.Cipher import AES

aeskey="fdsl;mewjope456fds4fbvfnjwaugfo"
wiresharkpacket ="packet-data-value".decode("hex")

aesobj = AES.new(aeskey, AES.MODE_ECB)
print str(aesobj.decrypt(wiresharkpacket))

Decrypting XOR Encrypted Data

Listing 7-1. Decrypting XOR Encrypted Data
import os
import sys
key = "key-here".decode("hex")
data = sys.stdin.read()
r = ""
for i in range(len(data)):
c = chr(ord(data[i]) ^ ord(key[i % len(key)]))
r += c
sys.stdout.write(r)

Demonstration of read() , write() , and lseek()

Listing 4-3: Demonstration of read() , write() , and lseek()
––––––––––––––––––––––––––––––––––––––––––––––––––––––––– fileio/seek_io.c
#include <sys/stat.h>
#include <fcntl.h>
#include <ctype.h>
#include "tlpi_hdr.h"
int
main(int argc, char *argv[])
{
size_t len;
off_t offset;
int fd, ap, j;
char *buf;
ssize_t numRead, numWritten;
if (argc < 3 || strcmp(argv[1], "--help") == 0)
usageErr("%s file {r<length>|R<length>|w<string>|s<offset>}...\n",
argv[0]);
fd = open(argv[1], O_RDWR | O_CREAT,
S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP |
S_IROTH | S_IWOTH); /* rw-rw-rw- */
if (fd == -1)
errExit("open");
for (ap = 2; ap < argc; ap++) {
switch (argv[ap][0]) {
case 'r': /* Display bytes at current offset, as text */
case 'R': /* Display bytes at current offset, in hex */
len = getLong(&argv[ap][1], GN_ANY_BASE, argv[ap]);
File I/O: The Universal I/O Model 85
buf = malloc(len);
if (buf == NULL)
errExit("malloc");
numRead = read(fd, buf, len);
if (numRead == -1)
errExit("read");
if (numRead == 0) {
printf("%s: end-of-file\n", argv[ap]);
} else {
printf("%s: ", argv[ap]);
for (j = 0; j < numRead; j++) {
if (argv[ap][0] == 'r')
printf("%c", isprint((unsigned char) buf[j]) ?
buf[j] : '?');
else
printf("%02x ", (unsigned int) buf[j]);
}
printf("\n");
}
free(buf);
break;
case 'w': /* Write string at current offset */
numWritten = write(fd, &argv[ap][1], strlen(&argv[ap][1]));
if (numWritten == -1)
errExit("write");
printf("%s: wrote %ld bytes\n", argv[ap], (long) numWritten);
break;
case 's': /* Change file offset */
offset = getLong(&argv[ap][1], GN_ANY_BASE, argv[ap]);
if (lseek(fd, offset, SEEK_SET) == -1)
errExit("lseek");
printf("%s: seek succeeded\n", argv[ap]);
break;
default:
cmdLineErr("Argument must start with [rRws]: %s\n", argv[ap]);
}
}
exit(EXIT_SUCCESS);
}
––––––––––––––––––––––––––––––––––––––––––––––––––––––––– fileio/seek_io.c

list all the
components   ------------> prepare an architecture diagram------------>Label the components and                                                                                                                          communication
                                                                                                                         |                                                                                                                                                                   |                                                                                                                                                                   |                                                                                                                                                                  \/                                                                                                                                                  Identify attack vectors
                                                          Rate the attack    <-------------for each component                                                                                     vectors                                                                                     

The following are the steps required to create an attack surface map of
any given IoT device:
• List all the components present in the target product.
• Prepare an architecture diagram.
• Label the components and the communication flows
between them.
• Identify attack vectors for each component and the
communication channel or protocol used.
• Categorize the attack vectors based on the varying
criticality.

These components involve many vulnerabilities

These components involve many vulnerabilities, some of which are
listed here.
• Firmware
• Ability to modify firmware.
• Insecure signature and integrity verification.
• Hard-coded sensitive values in the firmware—API
keys, passwords, staging URLs, and so on.
• Private certificates.
• Ability to understand the entire functionality of the
device through the firmware.
• File system extraction from the firmware.
• Outdated components with known vulnerabilities.
• Mobile applications
• Reverse engineering the mobile app.
• Dumping source code of the mobile app.
• Insecure authentication and authorization checks.
• Business and logic flaws.
• Side channel data leakage.
• Runtime manipulation attacks.
• Insecure network communication.
• Outdated third-party libraries and software
development kits (SDKs).

Web application
• Client-side injection.
• Insecure direct object reference.
• Insecure authentication and authorization.
• Sensitive data leakage.
• Business logic flaws.
• Cross-site request forgery.
• Cross-site scripting.
That list is just a sample of some of the vulnerabilities present in these
components, which should give you an idea of the kind of vulnerabilities
that affect these components.

不上班的理想人生与不下班的理想人生。

今天看到一本书的书名叫《不上班的理想人生》，
心里一念，理想人生都不上班， 那么人生有多无精打采。

于是乎，临时起意，应该写上一本不下班的理想人生。

在戴尔的时候， 有的同事很厌世， 有言论说“做哪行厌倦哪行”， 我想说对，其实也不对。
看完了了动机的分析，才知道， 其实并不是厌倦， 而是失去了前进的动力。

失去动力的原因有很多因素，但是最重要的因素就是失去了推进的力量，为什么失去了推进的力量，

这里又可以摊开来说， 中国人的恶性竞争？ 人的劣根性， 抑或上升到全人类的劣根性？

首先内卷化已经让我们疲惫不堪，中国人口红利已经被榨干，人的价值是无限的，但是到了这里就被单一衡量，价值无比低下。

在外企，总是感慨鬼佬生活优越， 人人大house， 我们仅仅为了一套小破房就要摇尾乞怜，低三下四，50岁之前兢兢业业，恐怕不得善终。

再对比他人的30岁，40多岁， 不禁感慨自己的地狱模式，今天想到这里，一个小时的思考， 一万个小时的重复思考。 每个人都成为了厌世的专家？

人人平等，有些人比别人更加平等。 不患寡而患不均。

理想生活就是， 物有所值， 等价交换吗？

实际上， 无论是姓社还是姓资， 制度就是让你吃不饱，然后去追求饱暖。

实际操作没有下限， 导致了没有理想生活的悲剧。

更悲惨的是，东亚社会的内卷性质，导致加大一万倍的非理想社会诞生。

难道真的等到像黑客帝国描述的那样，人机一体化， 所有理想生活都是虚拟出来的。 大家才满足得了吗？

可怕。

参与在这个过程中， 每时每刻都在关注， 投入自己的一份力量，变得更理想，才是重点吗？


宗教和鸦片， 没有这两种麻醉剂的中国社会， 如何清醒的走下去。

我还是吃我今天的酸菜鱼吧，美团调了好久，还是吃酸菜鱼。

2019年3月17日杭州
滨江亚朵。