Issues in finding pairing

Question

Issues in finding pairing

sgript opened this issue 7 years ago · 17 comments

Hi there,

So I've been trying to use crackle to find and decrypt a pairing between my Pebble smartwatch and iPhone. Here's the pcap attached:

capture.pcap.zip

I used Ubertooth's command to try catch a pairing: ubertooth-btle -f -c capture.pcap

However when running crackle -i capture.pcap -o foo.pcap, I get this issue:

No connect packet found
No pairing request found
No pairing response found
Not enough confirm values found (0, need 2)
Not enough random values found (0, need 2)
No LL_ENC_REQ found
No LL_ENC_RSP found
Giving up due to 7 errors

If anyone could share some insight for this as I'm still beginning, would be very helpful.

Answer 1 · 2017-08-03T07:10:54.000Z

your command is right ,but you shuld know that ubertooth default channel is 37 ，but ble default channel is 37 38 39 ,so your packet is not right .

Answer 2 · 2017-08-09T00:56:14.000Z

Kay887 commented Aug 9, 2017
Hi Mike,

I have the same issue. I am able to see the LL_ENC_REQ and the pairing messages in Wiresharl but crackle gives me the error that there are no requests found. So do I keep changing the advertising channel to a 37,38 or a 39 till I get the right packet

Answer 3 · 2017-08-09T00:57:05.000Z

I am sorry. I am relatively new to this. Would really appreciate some help.

Answer 4 · 2017-08-10T03:30:38.000Z

Hi Mike,

I have the same issue. I am able to see the LL_ENC_REQ and the pairing messages in Wiresharl but crackle gives me the error that there are no requests found. So do I keep changing the advertising channel to a 37,38 or a 39 till I get the right packet? I am sorry. I am relatively new to this. Would really appreciate some help.

Answer 5 · 2017-08-10T05:03:02.000Z

@sgript your PCAP contains no pairing packets. Refer to the FAQ entry: https://github.com/mikeryan/crackle/blob/master/FAQ.md#crackle-is-complaining-about-missing-packets-why-cant-i-crack

@Kay887 can you attach a PCAP?

Answer 6 · 2017-08-10T12:31:43.000Z

@mikeryan Ive attached six different PCAPs recorded at different channels through the command: ubertooth-btle -f -A 37 -c test1.pcap and for all channels.
Files.zip

Answer 7 · 2017-08-10T23:18:47.000Z

Using crackle master I am able to crack several of the key exchanges in your files. The following files work:

37/test12.pcap
38/test1.pcap

Make sure you're using the master branch from GitHub

Answer 8 · 2017-08-11T03:48:22.000Z

Thanks for the reply. So I should download the version on the master branch of GitHub?. Cool. Thanks. Will give it a try and let you know.

Answer 9 · 2017-08-11T03:49:17.000Z

git clone https://github.com/mikeryan/crackle.git
cd crackle
make
./crackle -i <your_file.pcap>

Answer 10 · 2017-08-11T03:56:02.000Z

Thanks for the quick reply. Will give it a try!!!! :)

Answer 11 · 2017-08-11T10:36:06.000Z

Thank you so so very much for the help. It worked!!!!!

Appreciate it!!!!

Answer 12 · 2017-08-11T23:08:14.000Z

Just wanted to ask you one question:
While I was decrypting the packets, I found different LTKs for different communication. I wanted to know does the LTK keep changing for every communication? If I unpair the device and pair them again, would there be a different LTK generated for that specific communication or will it be the same for different communication?

Sorry for silly question

Answer 13 · 2017-08-11T23:09:18.000Z

Every time you pair, a new LTK is established. After you've done that, you can use encrypted communication with a key based on that LTK without pairing again. If you do pair again, both devices get new LTKs.

Answer 14 · 2017-08-18T20:22:46.000Z

@mikeryan

I watched one of your videos I guess it was Shmoocon where in you have talked about injection using ubertooth to faux slave mode. I tried doing that, the tx led glows very lightly but when I perform hcitool lescan, for some reason the fake mac address does not reflect in the list. It does show the BLE device I am using but not the mac address created using ubertooth.

Another thing I wanted to ask you is when you talked about packet injection, is it possible to inject BLE packets into an ongoing communication between 2 BLE devices?

Thanks

Answer 15 · 2017-08-18T20:51:32.000Z

The faux slave code is very crappy and I'm not surprised it doesn't work well. It doesn't do anything useful even when it does work. We do not have any code for usefully injecting packets into BLE connections, or generating any true Bluetooth traffic to speak of.

Answer 16 · 2017-08-20T22:59:05.000Z

Thanks for the reply. Just one last thing, what is the ubertooth-tx used for?

Answer 17 · 2017-08-26T11:06:38.000Z

Hello Mike I sent you alot of Email but you didn't reply.
I have my Android App talking to my BLE (BTLC1000) I am able to light the LED on and off via BLE. Now I want to fuzz my BLE Device. You said in one of your presentation that it is possible to do that with PyBT if I got it right. But the thing is there is not documentation about PyBT. Can you please help me or give me some tipps?
Thank you