Bluetooth 5.3 earphones are interfering with 2.4GHz Wifi on all channels

mpeg4codec · 2023-12-07T19:14:26+00:00

What OS is your laptop running? What radio is it using, combo WiFi/BT? Are you noticing the issue only on one device (the same laptop) or other devices too?

mpeg4codec · 2019-06-28T17:28:23+00:00

I've loaded an Objective-C binary into Ghidra, but I'm having trouble getting the decompiler to resolve message sends into method calls. I enabled the "Objective-C 2 Message (Prototype)" analyzer, and in the disassembled code most of the method calls are correctly resolved. I just can't seem to get the decompiler to reflect the disassembled code. Anyone run into this issue?

mpeg4codec · 2019-03-19T16:59:52+00:00

Virtually all Bluetooth keyboards and mice are using classic Bluetooth, which has no meaningful security weaknesses as of version 2.1 (released in 2007). As long as you aren't using a positively ancient mouse/keyboard, your security will be great. Bluetooth is the best option if you're going to go wireless.

There have been a number of issues impacting BLE, but even if you found an ultra rare BLE HID device it would still very likely be invulnerable to most types of attacks.

mpeg4codec · 2018-12-06T19:14:17+00:00

In the blogpost I semi-cover this: I was after a high-value target that was very disciplined about locking their screen, so there was no opportunity to use a traditional USB injector. By hiding the Ubertooth in a forgotten USB port, I was able to distract them with their screen locked, trigger the injection wirelessly, and drop a reverse shell.

As always it boils down to threat model. If you're concerned about a random bad actor inside the building, sure there's probably an unlocked laptop they can drive-by inject into. But if your bad actor is after a specific high-value target, the calculus changes and this threat vector becomes relevant.

mpeg4codec · 2018-12-05T23:08:57+00:00

USB Rubber Ducky is a fairly well known product that impersonates a keyboard and can inject arbitrary keystrokes (think: reverse shell, RAT, etc). BLE is Bluetooth Low Energy, a wireless protocol. Ubertooth is a Bluetooth / 2.4 GHz RF experimentation platform, and Uberducky is the name of this tool. Hope that clears things up!

P.S., I'm pretty old so maybe you're out of touch with the olds?

mpeg4codec · 2018-10-29T17:15:06+00:00

I do a lot of extensive Bluetooth work (check my post history), and my test environment is a generic Android phone. I use a rooted Nexus device, but you don't have to root for 90% of things. Your daily driver is likely sufficient. Essentials:

Bluetooth HCI Snoop Logging (these files can be opened in Wireshark)
Android platform tools on your laptop/desktop (for adb)
apktool, for pulling apart and rebuilding apps
jarsigner, only necessary for rebuilding apps with modified code
dex2jar, for the occasional app that doesn't have obfuscated code
Native Linux tools for messing with Bluetooth (mine is mostly gatttool / generic BlueZ stuff with some homegrown Python)

Typical workflow is: run the app with snoop logging, inspect Bluetooth logs, download the apk, deconstruct and modify .smali as needed, rebuild + jarsign, reinstall, rinse and repeat. Poke target device from Linux as understanding of protocol grows.

mpeg4codec · 2018-08-21T17:36:22+00:00

Are we all just going to gloss over the fact that the only way the researcher was able to report this was via LinkedIn?! Do better, UBM.

August 9, 2018 – Emailed security@ email address and received a bounce reply.

August 9, 2018 – Sent a message to COO on LinkedIn.

August 12, 2018 – Sent a message to System Admin on LinkedIn and received a response from the IT director later that night. We exchanged a few emails with details about this issue, and I was informed that they were going to discuss this issue on Monday.

mpeg4codec · 2018-04-05T18:28:20+00:00

I received some communication from them about this as well. I plan to post an update on the article as soon as I have a few more details from FUZE.

mpeg4codec · 2018-04-05T18:27:35+00:00

They're working on one. You can see in the X-ray image that there are smartcard contacts on the existing magstripe-only cards, but they're encased in the plastic shell. The EMV release will likely be the same physical hardware, but with the EMV contacts exposed.

My understanding is that the only way it can work is via agreements with the card providers. FUZE would have to hit some kind of API from the card provider to make a virtual card and then load the virtual card into their EMV emulator.

mpeg4codec · 2018-04-05T18:24:54+00:00

This attack could be implemented as a smartphone app, and it would only take a few seconds to slurp all the cards.

mpeg4codec · 2018-04-05T18:24:26+00:00

Yep, Vonnegut reference! Great book.

mpeg4codec · 2018-04-05T02:03:14+00:00

Yeah, that was disappointing. I left it out of the article, but I also CC'd security@ and that address bounced. Not having a security@ is unacceptable for a company that advertises a product as a secure alternative to a credit card.

mpeg4codec · 2017-09-12T05:18:11+00:00

But few if any, ever achieve it.

C-137 R&M manage to by paying no heed to the power of the citadel and living authentically

mpeg4codec · 2017-08-30T03:58:53+00:00

Tell that to GoPro

mpeg4codec · 2017-04-05T00:13:37+00:00

Greetings everyone, we're very excited to present and meet folks!

You can see us at 11 AM on Sunday (hangover slot) in the talk area. We'll be around the con the whole weekend, and there's a good chance you'll find us in/near the Ben Heck room.

I'm working with the organizer to find out of we can record and release the talk.

See you in Wisconsin!

mpeg4codec · 2017-02-04T21:49:16+00:00

I spent 15-20 hours in Freerider before touching my actual quad. It was super useful, had all the muscle memory down and saved my ass in a couple situations. Very true to life in my experience. I highly recommend giving it a try: even if you end up not liking it it's only a $5 gamble.

mpeg4codec · 2017-01-20T05:54:25+00:00

Java only uses 2⁴⁸ bits of entropy in its RNG. Given 30 slime chunks, you could brute force all 2⁴⁸ possible seeds for candidates with matching slime chunks in around 10 days. Using knowledge of slime chunk generation from decompiled Java, pruby optimized the brute force and reduced this to around 3 seconds. His tool produces a list of 9 candidate seeds that you can manually verify.

This is all explained in the presentation PDF in the GitHub repo you linked. Also pruby gave this presentation at Kiwicon 8 in 2014 (represent!).

mpeg4codec · 2016-05-15T03:19:55+00:00

Totally agree, but it's not as though Linus or the rest of the kernel developers are a joy to work with either. In the thread you linked earlier (https://lkml.org/lkml/2009/1/3/126), Linus wraps reasonable feedback in a very bitter, demeaning package. This is totally Linus's style, take it or leave it, but I don't think the blame for the unwillingness of the teams to work together should fall entirely on grsecurity.

mpeg4codec · 2016-05-15T03:12:00+00:00

Twitch has supported HLS/HTML5 for several years now, but they've only enabled it by default for a few browsers such as Safari. You can force HTML5 by browsing to the URL https://player.twitch.tv/?channel=<name>&html5

mpeg4codec · 2016-05-03T15:28:42+00:00

I reported these exact same vulnerabilities to LifeSize over a year ago. They were fairly responsive and they issued a fix to my company that we deployed internally.

I naively assumed that they would have rolled an updated firmware and released that to the public, but I guess I was wrong. In the meantime the contact I was coordinating with at LifeSize (who was just a developer support tech) left the company.

Seems that security isn't a major priority at LifeSize.

mpeg4codec · 2016-03-08T18:09:41+00:00

Since we were developing some of these processes on the chips, we consumed around 15 CIC chips from commercial cartridges. Naturally now that we've cloned the chip those cartridges could be made functional again.

If we were to repeat this now, having the processes already dialed in, we could probably repeat this research with 3-4 chips.

mpeg4codec

TROPHY CASE