InternalBlue - Bluetooth Binary Patching and Experimentation Framework

Abstract

Bluetooth is one of the most established technologies for short range digital wireless data transmission. With the advent of wearables and the Internet of Things (IoT), Bluetooth has again gained importance, which makes security research and protocol optimizations imperative. Surprisingly, there is a lack of openly available tools and experimental platforms to scrutinize Bluetooth. In particular, system aspects and close to hardware protocol layers are mostly uncovered.We reverse engineer multiple Broadcom Bluetooth chipsets that are widespread in off-the-shelf devices. Thus, we offer deep insights into the internal architecture of a popular commercial family of Bluetooth controllers used in smartphones, wearables, and IoT platforms. Reverse engineered functions can then be altered with our InternalBlue Python framework-outperforming evaluation kits, which are limited to documented and vendor-defined functions. The modified Bluetooth stack remains fully functional and highperformance. Hence, it provides a portable low-cost research platform.InternalBlue is a versatile framework and we demonstrate its abilities by implementing tests and demos for known Bluetooth vulnerabilities. Moreover, we discover a novel critical security issue affecting a large selection of Broadcom chipsets that allows executing code within the attacked Bluetooth firmware. We further show how to use our framework to fix bugs in chipsets out of vendor support and how to add new security features to Bluetooth firmware. CCS CONCEPTS• Security and privacy → Mobile and wireless security; • Networks → Link-layer protocols.

Revisiting Adaptive Frequency Hopping Map Prediction in Bluetooth with Machine Learning Classifiers

“…To this end, there have been various research efforts [9,[13][14][15][16][17] working on simple and low-cost Bluetooth sniffing systems and their applications. These efforts are boosted with the introduction of an open source Bluetooth sniffing platform called Ubertooth [10].…”

“…Among several options, we utilize InternalBlue which can be used for the collection. InternalBlue [17] is a Bluetooth research and analysis framework that can analyze Link Management Protocol (LMP) packets by modifying the firmware of Broadcom Bluetooth chipset. Since AFH maps in Bluetooth Classic connections can be extracted through LMP packets with InternalBlue, we can successfully collect the actual AFH maps using InternalBlue.…”

Happy MitM

“…Note that it is not possible to use the original version of Internal-Blue [19] for injecting different keys into the controller, because the controller would ask the host for a key belonging to a specific address, expecting a single response. Prior to the hooks we published along with this paper, InternalBlue only supported injecting commands but could not replace contents of existing commands.…”

“…We further analyze this by connecting the Samsung Galaxy Note20 5G to a Google Nexus 5. The Nexus 5 is rather old, but supports Link Management Protocol (LMP) sniffing via InternalBlue [19] and features SSP with BT 4.1. During the secure authentication phase, the initiator and responder can both end the connection with an LMP_DETACH packet containing the error code Authentication Failure [7, p. 622].…”

Cross-protocol attacks

“…The InternalBlue framework [4] takes advantage of some vendorspecific commands and allows to easily dump, analyse and patch firmware embedded in Bluetooth controllers from Broadcom and Cypress, which are common in the wild. First, it allowed us to dynamically instrument the firmware to understand its internals.…”