-
gattacker
A Node.js package for BLE (Bluetooth Low Energy) security assessment using Man-in-the-Middle and other attacks
-
SurveyJS
Open-Source JSON Form Builder to Create Dynamic Forms Right in Your App. With SurveyJS form UI libraries, you can build and style forms in a fully-integrated drag & drop form builder, render them in your JS app, and store form submission data in any backend, inc. PHP, ASP.NET Core, and Node.js.
-
Yes, it is 100% possible, because I did it as part of my Masters dissertation into smart security devices. There are lots of tutorials online; personally I would avoid the Ubertooth as I found it really flaky. If you can get hold of 3 of the BBC micro:bit v1 (v2 doesn’t work) then btlejack is nice - https://github.com/virtualabs/btlejack. Had the best results with the nRF sniffer - https://www.nordicsemi.com/Products/Development-tools/nRF-Sniffer-for-Bluetooth-LE. If you have access to a couple of Raspberry Pi’s then Gattacker is a really cool tool for capturing traffic by spoofing a target device, so that the companion smartphone app connects to that. The traffic is then relayed to the other Pi, which then transmits it to the real Bluetooth device, so essentially operates as a MITM proxy. Had some great results with this, and it will really teach you the basics of Bluetooth LE - https://github.com/securing/gattacker. Prepared to be horrified at how many devices use no encryption, or when they do, use default paring codes. IoT security is poor full stop, but BLE is the worst of the worst.
Yes, it is 100% possible, because I did it as part of my Masters dissertation into smart security devices. There are lots of tutorials online; personally I would avoid the Ubertooth as I found it really flaky. If you can get hold of 3 of the BBC micro:bit v1 (v2 doesn’t work) then btlejack is nice - https://github.com/virtualabs/btlejack. Had the best results with the nRF sniffer - https://www.nordicsemi.com/Products/Development-tools/nRF-Sniffer-for-Bluetooth-LE. If you have access to a couple of Raspberry Pi’s then Gattacker is a really cool tool for capturing traffic by spoofing a target device, so that the companion smartphone app connects to that. The traffic is then relayed to the other Pi, which then transmits it to the real Bluetooth device, so essentially operates as a MITM proxy. Had some great results with this, and it will really teach you the basics of Bluetooth LE - https://github.com/securing/gattacker. Prepared to be horrified at how many devices use no encryption, or when they do, use default paring codes. IoT security is poor full stop, but BLE is the worst of the worst.
I've seen some guys literally wardriving bluetooth making peoples cars pick up the shitty music they were listening to so everyone on the road had the same damn song on. https://github.com/DigitalSecurity/btlejuice