6 ms·

Bit-Banging Bluetooth Low Energy

149 points by userbinator 3y ago

SV_BubbleTime 3y ago
(2013) And also, BLE is more than Bluetooth in name only. There is the L2CAP layer and radio specs taken directly from Bluetooth Classic. There is also the fact that good or bad (I’ll let you guess) it is the same Special Interest Group that develops it.
- fellerts 3y ago
  [2013] is key. The information in this article is severely outdated, but the hacking is still cool I guess.
  - dmitrygr 3y ago
    Back then, BLE-capable MCUs were rare and expensive. Now that you can get $0.10 MCUs out of china that speak BLE natively, this is no longer useful. I rarely take articles off my website, so it is still up. How it ended up on HN front page today, I am not sure.
- dmitrygr 3y ago
  > and radio specs taken directly from Bluetooth Classic False - modulations are entirely different. Channel hopping is done differently too. L2CAP is also quite cut down in many ways, having only the same 4 byte header in common. When I wrote this article (11 years ago), this was even more true than it is today (BLE did not even have the 2mbps mode yet)
  - SV_BubbleTime 3y ago
    When I wrote the radio, I meant the radio. Not the bit timing and phase which is software. The PHY . It’s the same 2.4Ghz radio and same balun.
    - dmitrygr 3y ago
      Well, fuck, so is WiFi and three dozen other things. Means nothing. That’s what any 2.4GHz thing would have… Also bit timing and phase are NOT software. They are very much hardware state machines in all implementations.
      - SV_BubbleTime 3y ago
        There weren’t hardware here were they? Yes, WiFi uses the same radio, although IDK about balun.
        dmitrygr 3y ago
        Even here bit timing is done by a hardware state machine. As is modulation.
        nomel 3y ago
        > balun Why does that coil of wire matter? It's dictated by drive and antenna characteristics. It's an RF coupling efficiency thing, not really a BT/WiFi thing.
- AshamedCaptain 3y ago
  BLE literally started from a Bluetooth competitor technology that was later given to the Bluetooth SIG and renamed to BLE. It is literally Bluetooth in name only. Anyone who has read anything about them can tell they are almost like day and night.
  - SV_BubbleTime 3y ago
    They aren’t the same people since 2009? It’s not the same L2CAP layer? TIL.
    - AshamedCaptain 3y ago
      Yes, it was given to the Bluetooth SIG in 2007ish, but it has not really evolved to be more classic/BR-like since then (or it would break compatibility). And no, it's not the same L2CAP layer -- it again shares the name and little else.
skibz 3y ago
Am I understanding what is being demonstrated here, correctly? Is this a type of beacon? Pretty neat!
- pbmonster 3y ago
  "Beacon", as in "attracts attention to a specific location"? No, not necessarily. You could use this to broadcast GPS coordinates (and you can always try to triangulate the location of a BTLE transmitter), but the author is showing what he believes to be the simplest way for an embedded project to transmit arbitrary digital data over the air - to, for example, an iPhone.
  - spaceywilly 3y ago
    Beacon has a pretty specific meaning in the BLE world. A BLE beacon sends a broadcast out every now and then* that says “hey I exist, here’s my ID”. Another device can scan for these “advertisement” and do something when a particular kind of device is detected. An example use case is a museum app displaying info to a user when they walk up to a particular exhibit. * the interval can be set from 10ms to ~10s. The radio can be turned off in between advertisements, which is where the “LE” part comes from.
- jsmith45 3y ago
  > Is this a type of beacon? Pretty much. A similar approach of only unsolicited advertisement packets is used by a number of beacons. But that is not the only use case. A decent number of BTLE sensors out there also work exclusively by periodically sending out unsolicited advertisement frames with their data. As long as you don't need to accept any incoming data, that is really easy to do, and allows completely shutting off the radio in between, so the radio may only be active for a few miliseconds once every few minutes. That helps keep power consumption very low, especially for battery powered devices. If the primary sensor functions are low power, and support an interrupt signal, and you have a microprocessor with a low power timer interrupt (to allow waking up occasionally even if the sensor state has not changed), and ability to stop the clock to the rest while waiting, you can pretty easily get multiple years on a single disposable AAA or coin cell battery.
whartung 3y ago
In the movie Blackhat, the Bad Guy communicated "anonymously" with his cronies by setting up (I think) a Bluetooth hot spot in an open mall. They all virtually crossed paths at some specific spot, where there was a radio and computer hidden in a bush. The premise is these folks have never met, and assuming that the cronies aren't familiar with the tech and told to "go to this bench, do this workflow, enter in these codes". Rather they were told to download an app to their phone, go to this area and "start chatting", or maybe they connected to the bush server, and exchanged messages without ever having to be in the same place at the same time. Can a modern phone contact a BT device without being manually paired (assuming it has cooperating software on the phone)? A non-hacked phone? Could they have been using just raw BLE for this? What kind of range does BT and BLE have?
- jareklupinski 3y ago
  https://en.wikipedia.org/wiki/Dead_drop#Modern_techniques https://en.wikipedia.org/wiki/Dead_drop#Modern_techniques depending on how good of a line-of-sight you have to the transmitter, you can receive over 50+m using a well-tuned antenna if the transmitter is hidden, range largely depends on what it's hidden inside, but even a phone at the bottom of a backpack can receive from a similarly hidden flipper zero broadcasting from another backpack at about 5-10m
- zwirbl 3y ago
  At least for BLE one could use advertising packets to transmit the data, sensor beacons tend to do this with e.g. a temperature. There is also the scan-response mode, initiated by the device scanning for others. And you can use plain GATT without any authentication, but that would be fully unencrypted iirc. Rangewise it might be possible to reach 100m in an open field under very good conditions, especially when utilizing coded PHY, but not with default power levels I think. There is a lot more to know, one place to start is 'Intro to Bluetooth low energy' by Mohammed Afaneh
- seanalltogether 3y ago
  > Can a modern phone contact a BT device without being manually paired (assuming it has cooperating software on the phone)? Yes. I manage IOT apps for android and iOS that do exactly this. You can write/read data to any bluetooth device around you that is advertising as connectable and has a GATT characteristic that supports it.
caseyf 3y ago
a fun BLE device that i have is a Furby Connect (2016) https://github.com/Jeija/bluefluff https://github.com/Jeija/bluefluff ("This project aims to reverse engineer / "hack" Furby Connect's Bluetooth Low Energy protocol, graphics and audio format and eventually find a way to execute own code on Furby")
palemoonale 3y ago
[flagged]
- palemoonale 3y ago
  [flagged]
EvanAnderson 3y ago
How easy is it to put consumer BLE chipsets into a monitor mode? It sounds like it'd be fun to "wardrive" (more likely walking around) with a BLE "scanner".
- lyu07282 3y ago
  impossible afaik, but SDR's are so cheap and available now anyway..
- invalidator 3y ago
  It's a piece of cake. BLE doesn't try to hide anything. Install "nRF Connect" on a mobile device and have fun.
- dmitrygr 3y ago
  If you only want to listen to advertising channels, it is trivial because this is the norm - this is how connections are established. If you want to listen in on data channels you'll need an SDR with a lot of bandwidth or 40 receivers to cover every channel. If you want to monitor a single connection, you can channel-hop with it in the same sequence, but if you miss out on the connection establishment message, you'll not know the channel hopping sequence and not manage. Most BLE comms are encrypted nowadays so you'll not get much out of this anyways.
- jlarocco 3y ago
  BLE is basically designed to work that way, so it’s very easy. On Linux you can start a bluetooth device scan (using “scan on” in bluetoothcl), and all of the nearby devices will show up as DBus objects under “org.bluez”. You can manipulate them and read their properties/attributes with any DBus interface. Could probably be a shell one liner.

149 points by userbinator 3y ago

(2013) And also, BLE is more than Bluetooth in name only. There is the L2CAP layer and radio specs taken directly from Bluetooth Classic. There is also the fact that good or bad (I’ll let you guess) it is the same Special Interest Group that develops it.

fellerts 3y ago
[2013] is key. The information in this article is severely outdated, but the hacking is still cool I guess.
- dmitrygr 3y ago
  Back then, BLE-capable MCUs were rare and expensive. Now that you can get $0.10 MCUs out of china that speak BLE natively, this is no longer useful. I rarely take articles off my website, so it is still up. How it ended up on HN front page today, I am not sure.
dmitrygr 3y ago
> and radio specs taken directly from Bluetooth Classic False - modulations are entirely different. Channel hopping is done differently too. L2CAP is also quite cut down in many ways, having only the same 4 byte header in common. When I wrote this article (11 years ago), this was even more true than it is today (BLE did not even have the 2mbps mode yet)
- SV_BubbleTime 3y ago
  When I wrote the radio, I meant the radio. Not the bit timing and phase which is software. The PHY . It’s the same 2.4Ghz radio and same balun.
  - dmitrygr 3y ago
    Well, fuck, so is WiFi and three dozen other things. Means nothing. That’s what any 2.4GHz thing would have… Also bit timing and phase are NOT software. They are very much hardware state machines in all implementations.
    - SV_BubbleTime 3y ago
      There weren’t hardware here were they? Yes, WiFi uses the same radio, although IDK about balun.
      - dmitrygr 3y ago
        Even here bit timing is done by a hardware state machine. As is modulation.
      - nomel 3y ago
        > balun Why does that coil of wire matter? It's dictated by drive and antenna characteristics. It's an RF coupling efficiency thing, not really a BT/WiFi thing.
AshamedCaptain 3y ago
BLE literally started from a Bluetooth competitor technology that was later given to the Bluetooth SIG and renamed to BLE. It is literally Bluetooth in name only. Anyone who has read anything about them can tell they are almost like day and night.
- SV_BubbleTime 3y ago
  They aren’t the same people since 2009? It’s not the same L2CAP layer? TIL.
  - AshamedCaptain 3y ago
    Yes, it was given to the Bluetooth SIG in 2007ish, but it has not really evolved to be more classic/BR-like since then (or it would break compatibility). And no, it's not the same L2CAP layer -- it again shares the name and little else.

skibz 3y ago

Am I understanding what is being demonstrated here, correctly? Is this a type of beacon? Pretty neat!

pbmonster 3y ago
"Beacon", as in "attracts attention to a specific location"? No, not necessarily. You could use this to broadcast GPS coordinates (and you can always try to triangulate the location of a BTLE transmitter), but the author is showing what he believes to be the simplest way for an embedded project to transmit arbitrary digital data over the air - to, for example, an iPhone.
- spaceywilly 3y ago
  Beacon has a pretty specific meaning in the BLE world. A BLE beacon sends a broadcast out every now and then* that says “hey I exist, here’s my ID”. Another device can scan for these “advertisement” and do something when a particular kind of device is detected. An example use case is a museum app displaying info to a user when they walk up to a particular exhibit. * the interval can be set from 10ms to ~10s. The radio can be turned off in between advertisements, which is where the “LE” part comes from.
jsmith45 3y ago
> Is this a type of beacon? Pretty much. A similar approach of only unsolicited advertisement packets is used by a number of beacons. But that is not the only use case. A decent number of BTLE sensors out there also work exclusively by periodically sending out unsolicited advertisement frames with their data. As long as you don't need to accept any incoming data, that is really easy to do, and allows completely shutting off the radio in between, so the radio may only be active for a few miliseconds once every few minutes. That helps keep power consumption very low, especially for battery powered devices. If the primary sensor functions are low power, and support an interrupt signal, and you have a microprocessor with a low power timer interrupt (to allow waking up occasionally even if the sensor state has not changed), and ability to stop the clock to the rest while waiting, you can pretty easily get multiple years on a single disposable AAA or coin cell battery.

whartung 3y ago

In the movie Blackhat, the Bad Guy communicated "anonymously" with his cronies by setting up (I think) a Bluetooth hot spot in an open mall. They all virtually crossed paths at some specific spot, where there was a radio and computer hidden in a bush. The premise is these folks have never met, and assuming that the cronies aren't familiar with the tech and told to "go to this bench, do this workflow, enter in these codes". Rather they were told to download an app to their phone, go to this area and "start chatting", or maybe they connected to the bush server, and exchanged messages without ever having to be in the same place at the same time. Can a modern phone contact a BT device without being manually paired (assuming it has cooperating software on the phone)? A non-hacked phone? Could they have been using just raw BLE for this? What kind of range does BT and BLE have?

jareklupinski 3y ago
https://en.wikipedia.org/wiki/Dead_drop#Modern_techniques https://en.wikipedia.org/wiki/Dead_drop#Modern_techniques depending on how good of a line-of-sight you have to the transmitter, you can receive over 50+m using a well-tuned antenna if the transmitter is hidden, range largely depends on what it's hidden inside, but even a phone at the bottom of a backpack can receive from a similarly hidden flipper zero broadcasting from another backpack at about 5-10m
zwirbl 3y ago
At least for BLE one could use advertising packets to transmit the data, sensor beacons tend to do this with e.g. a temperature. There is also the scan-response mode, initiated by the device scanning for others. And you can use plain GATT without any authentication, but that would be fully unencrypted iirc. Rangewise it might be possible to reach 100m in an open field under very good conditions, especially when utilizing coded PHY, but not with default power levels I think. There is a lot more to know, one place to start is 'Intro to Bluetooth low energy' by Mohammed Afaneh
seanalltogether 3y ago
> Can a modern phone contact a BT device without being manually paired (assuming it has cooperating software on the phone)? Yes. I manage IOT apps for android and iOS that do exactly this. You can write/read data to any bluetooth device around you that is advertising as connectable and has a GATT characteristic that supports it.

caseyf 3y ago

a fun BLE device that i have is a Furby Connect (2016) https://github.com/Jeija/bluefluff https://github.com/Jeija/bluefluff ("This project aims to reverse engineer / "hack" Furby Connect's Bluetooth Low Energy protocol, graphics and audio format and eventually find a way to execute own code on Furby")

palemoonale 3y ago

[flagged]

palemoonale 3y ago
[flagged]

EvanAnderson 3y ago

How easy is it to put consumer BLE chipsets into a monitor mode? It sounds like it'd be fun to "wardrive" (more likely walking around) with a BLE "scanner".

lyu07282 3y ago
impossible afaik, but SDR's are so cheap and available now anyway..
invalidator 3y ago
It's a piece of cake. BLE doesn't try to hide anything. Install "nRF Connect" on a mobile device and have fun.
dmitrygr 3y ago
If you only want to listen to advertising channels, it is trivial because this is the norm - this is how connections are established. If you want to listen in on data channels you'll need an SDR with a lot of bandwidth or 40 receivers to cover every channel. If you want to monitor a single connection, you can channel-hop with it in the same sequence, but if you miss out on the connection establishment message, you'll not know the channel hopping sequence and not manage. Most BLE comms are encrypted nowadays so you'll not get much out of this anyways.
jlarocco 3y ago
BLE is basically designed to work that way, so it’s very easy. On Linux you can start a bluetooth device scan (using “scan on” in bluetoothcl), and all of the nearby devices will show up as DBus objects under “org.bluez”. You can manipulate them and read their properties/attributes with any DBus interface. Could probably be a shell one liner.