- DLE = (Data Link Escape, ASCII Code 127)
- STX = (Start of TeXt, ASCII Code 2)
- ETX = (End of TeXt, ASCII Code 3)
|
0
comments
]
I was able to reverse part of the protocol this beast speaks, currently I am able to read tracks, eject card and reset device. It was a rather tedious but fun task, learned quite some new tricks. The layer 1 is R232 and what took me 4 hours to figure out is that you absolutely need to send the Data Set Ready (DSR) signal prior to sending commands.
It is a rather simple binary protocol over R232, here is a small excerpt of my debugging output :
On the left wee see the Hexadecimal representation of the protocol, on the right the ASCII display.
RESET command
Request: 2/20/2009 7:23:07 PM.01564
10 02 43 30 30 10 03 40 - ..C00..@
Answer: 2/20/2009 7:23:07 PM.01564 (+0.0000 seconds)
10 06 - ..
Request: 2/20/2009 7:23:07 PM.12564 (+0.1094 seconds)
10 05 - ..
Answer: 2/20/2009 7:23:09 PM.59364 (+2.4688 seconds)
10 02 50 30 30 30 31 10 03 52 - ..P0001..R
Interpreting :
The first command send is Hex (10 02 43 30 30 10 03 4) which interpreted stands for <DLE><STX>C00<DLE><ETX>@
The command itself sits in the middle, namely C00, which is the reset command. The protocol flow itself is a simple handshake flow, in tcpish terms : SYN | SYN ACK | SYN-ACK 2 | ACK |
The command ACK is alwas 10 06.
I then started to implement the communication protocol in C#, here is a screenshot of the current prototype, the "Omron Communicator" in C#.
After searching the web for parts of the reversed protocol I was able to find a complete specification of the device together with the protocol documentation. Since this is difficult to find without detailed knowledge I am going to mirror the pdf on this site for google to gather it under the relevant keywords.
|
0
comments
]
Got an new Hybrid card reader to play with, actually it came right out of an ATM, it's an Omron 3S4YR-MVFW.
The device can read and write
- LoCo and HoCo cards
- smartcard chip (memory and processor based)
If somebody is interested in such a device you might drop me an e-mail here
Next I am going to reverse enginner the Protocol it speaks to implement an application to comfortably use it. This device is very interesting to use for a few reasons during physical pentests, you might laugh how many poeple will swipe their company cards if you ask them or stuff it into an official looking box.


|
0
comments
]
Authors : Eric Sesterhen & Thierry Zoller
About
This is a straight forward linux port of Thierry Zollers' BTCrack. Should work with most other unixes too, code is nearly ansi clean, except for strdup(), but I guess every OS should have this by now.
Compiling was tested so far with :
- gcc version 4.1.1 (Gentoo 4.1.1-r3) on i686-pc-linux-gnu
- gcc version 4.3.0-alpha20061216 on i586-pc-linux-gnu
- gcc version 3.3.6 on i586-pc-linux-gnu
- gcc version 3.4.6 on i586-pc-linux-gnu
- gcc version 2.95.4 20011002 (Debian prerelease) on i686-pc-linux-gnu
- gcc version 4.0.3 on sparc-sun-solaris2.8
- icc Version 9.1 Build 20060706Z on i686-pc-linux-gnu
- Sun WorkShop 6 update 2 C 5.3 Patch 111679-11 2003/04/02
Test it with the provided csv file: ./btcrack 1 00:11:9F:C4:F3:AE 00:60:57:1A:6B:F1 ./Pin_654321.csv
|
0
comments
]
BTCrack is the worlds first Bluetooth Pass phrase (PIN) bruteforce tool, BTCrack will bruteforce the Passkey and the Link key from captured pairing* exchanges.
To capture the pairing data it is necessary to have a Professional Bluetooth Analyzer : FTE (BPA 100, BPA 105, others), Merlin OR to know how to flash a CSR based consumer USB dongle with special firmware.
- Attacker reconstructs BD_ADDR of both Master and Slave through passive (reconstructing through a preamble sniff, even when the device is in hidden mode) or active means (redfang)
- Attacker changes his BD_ADDR to the one of the Slave device
- Attacker asks to pair with the Master indicating it has no key, the Master will more then often trash the old pairing data and request a new link key from the genuine slave
- Attacker now captures the key (pairing) exchange taking place between the two devices as the users try to re-establish a connection
- Attacker exports data to CSV format and imports into BTCrack
- Attacker can now compromise Master and Slave Bluetooth device through usage of the cracked Linkkey and is able to decrypt the data transmitted between the bluetooth devices
- An Attacker will focus on recovering the Linkkey and not the PIN, here's why :
- The Link-key allows remote connections without the victim noticing
- The Link-key allows and attacker to connect to devices in non-pairing mode and non discoverable mode
- The Link-key allows decryption of the data
- Olly Whitehouse - 2003 -Presented theoretic weaknesses in the implementation of the Pairing exchange
- Shaked and Wool - 2005 - Present their logic to break pairing exchanges and implement it in Private
- Thierry Zoller - 2006 First implmentation and public release of the Shaked and Wool logic, breaking the encryption and recovering the LINKKEY.
- Thierry Zoller / David Hulton - 2007 - Worlds first FPGA based Implementation of the

Speed Comparison :
- P4 2Ghz - Dual Core 200.000 keys/sec
- FPGA E12 @ 50Mhz 7.600.000 keys/sec
- FPGA E12 @ 75Mhz 10.000.000 keys/sec
- FPGA E14 30.000.000 keys/sec
[+] Frontline 6.0 mixes Master & Slave Addresses
Changes :
1.0 First release
1.1 Intermediate Release
- E12 + E14 FPGA Support ( http://www.picocomputing.com)
- Speed increase (+15%)
- Download BTCrack 1.1
- Presentation at 23C3 (2006) - Bluetooth Hacking revisited (EN)
- Presentation at Heisec (2007) Scheunentor Bluetooth (DE)
Heisec 2007 Scheunentor Bluetooth Zoller





