Skip to content

Commit

Permalink
FIx README typos
Browse files Browse the repository at this point in the history
  • Loading branch information
beraoudabdelkhalek authored Mar 31, 2024
1 parent 678e1d5 commit 0f47e7b
Showing 1 changed file with 7 additions and 7 deletions.
14 changes: 7 additions & 7 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,9 @@ This repository contains the implementation of a proof of concept to record and

The PoC was demonstrated during the talk **BSAM: Seguridad en Bluetooth** at **RootedCON 2024** in Madrid.

It's designed to raise awareness about the insecure use of Bluetooth devices, and the need of a consistent methodology for security evaluations. That's the purspose of **BSAM, the Bluetooth Security Assessment Methodology**, published by Tarlogic and available [here](https://www.tarlogic.com/bsam/).
It's designed to raise awareness about the insecure use of Bluetooth devices, and the need of a consistent methodology for security evaluations. That's the purpose of **BSAM, the Bluetooth Security Assessment Methodology**, published by Tarlogic and available [here](https://www.tarlogic.com/bsam/).

This proof of concept exploits the failure to comply with the [**BSAM-PA-05 control**](https://www.tarlogic.com/bsam/controls/bluetooth-pairing-without-interaction/) within the BSAM methodolgy. Consequently, the device enables the pairing procedure without requiring user interaction and exposes its functionality to any agent within the signal range.
This proof of concept exploits the failure to comply with the [**BSAM-PA-05 control**](https://www.tarlogic.com/bsam/controls/bluetooth-pairing-without-interaction/) within the BSAM methodology. Consequently, the device enables the pairing procedure without requiring user interaction and exposes its functionality to any agent within the signal range.

More information on our [blog](https://www.tarlogic.com/blog/bluespy-spying-on-bluetooth-conversations/).

Expand All @@ -25,15 +25,15 @@ The PoC uses the following tools:

In Arch Linux distributions, `bluetoothctl` and `btmgmt` can be installed with the package `bluez-utils`, while `pactl`, `parecord` and `paplay` are available in the `libpulse` package.

For the PoC to work, it is necessary to have a working instalation of the BlueZ Bluetooth stack, available in the `bluez`package for Arch Linux distributions. A working instalation of an audio server compatible with PulseAudio, such as PipeWire, is also required to record and play audio.
For the PoC to work, it is necessary to have a working installation of the BlueZ Bluetooth stack, available in the `bluez`package for Arch Linux distributions. A working installation of an audio server compatible with PulseAudio, such as PipeWire, is also required to record and play audio.

## Setup

Ensure that your device is capable of functioning as an audio source, meaning it has a microphone, and that it is discoverable and connectable via Bluetooth.

For instance, to be discoverable and connectable, the earbuds used during the talk must be outside of their charging case. By default, they only activate the microphone when placed in the user's ears, although this setting can be adjusted in the configuration app.

Additionally, ensure that the device is not already connected, or alteratively, that it supports multiple connections.
Additionally, ensure that the device is not already connected, or alternatively, that it supports multiple connections.

## Execution

Expand All @@ -50,13 +50,13 @@ Once the address of the device is discovered, the script can handle the rest:
$ python BlueSpy.py -a <address>
```

Note: The script might prompt for superuser permissions to modify the configuration of your **BlueZ** instance and pair with the remote device.
Note: The script might prompt for superuser permissions to modify the configuration of your **BlueZ** instance and pair it with the remote device.

## Troubleshooting

`BlueSpy.py` is the main script that executes every step of the process. However, if you encounter issues with nay of the phases, so it might be helpful to execute them individually:
`BlueSpy.py` is the main script that executes every step of the process. However, if you encounter issues with any of the phases, so it might be helpful to execute them individually:
+ `pair.py` utilizes the command-line tool `btmgmt` to modify the configuration of your **BlueZ** and initiate a pairing process with the remote device. The exact commands used are in the `pair` function inside `core.py`.
+ `connect.py` utilizes the command-line tool `bluetoothctl` to initiate a quick scan (necesary for BlueZ) and establish a connection to the device. The exact commands used are in the `connect` function inside `core.py`.
+ `connect.py` utilizes the command-line tool `bluetoothctl` to initiate a quick scan (necessary for BlueZ) and establish a connection to the device. The exact commands used are in the `connect` function inside `core.py`.
+ `just_record.py` utilizes the command-line tools `pactl` and `parecord` to search for the device in the system's audio sources (it must function as a microphone) and initiate a recording session. The exact commands used are in the `record` function inside `core.py`.
+ The `playback` function inside `core.py` executes `paplay` to play back the captured audio.

Expand Down

0 comments on commit 0f47e7b

Please sign in to comment.