Bluetooth Hacks

Alexander Tolstoy — Wed, 23 Sep 2015 19:52:39 +0000

Connect to the Internet, work with your files, lock your workspace, listen to music and do so much more with the help of Bluetooth technology.

In an effort to bring more comfort and security to listening to music via headphones while cycling, Swedish telecom vendor Ericsson invented Bluetooth—a wireless connectivity technology, which dates back to 1994. Since then, the standards behind Bluetooth have greatly evolved, but it still remains a niche technology, not widely used outside traditional business applications.

How can you benefit from using Linux on a Bluetooth-equipped PC? There are many use cases, some of which are unconventional and even mind-blowing.

Friendly Recon

Bluetooth in Linux is powered by the BlueZ software stack. It includes basic tools for remote device discovery and setup. Using it, you can collect some helpful information about the devices and people around you.

To start, let's see what devices are reachable for local discovery:


hcitool scan

You'll get a list of devices with their BD_ADDR values (similar to MAC) and possibly text descriptions. These descriptions are optional, and some users advisedly leave them blank. But still there's a way to find some information on such devices. You can find the class code of a device if you run the hcitool inq command. After that, you can analyze it with the Bclassify utility, which accepts class code as an input parameter and gives back class disentanglement. Here is the example 0x5a020c code:


atolstoy@linux:~/Downloads/btclassify-master> ./btclassify.py 
 ↪0x5a020c
0x5a020c: Phone (Smartphone): Telephony, Object Transfer, 
 ↪Capturing, Networking

Then you can find what services are supported by the device. Here is the sample output:


atolstoy@linux:~> sdptool browse 11:22:33:44:55:66 | 
 ↪grep Service\ Name
Service Name: Headset Gateway
Service Name: Handsfree Gateway
Service Name: Sim Access Server
Service Name: AV Remote Control Target
Service Name: Advanced Audio
Service Name: Android Network Access Point
Service Name: Android Network User
Service Name: OBEX Phonebook Access Server
Service Name: SMS Message Access
Service Name: OBEX Object Push

Note that sdptool works even when the device is not discoverable, but is somewhere nearby. Using that technique, you can discover smartphones, headsets, printers, wearable gadgets and, of course, desktops and laptops. On many Mac OS X systems, Bluetooth is set in discoverable mode silently and forever, plus it carries the owner's name in the device's description, which is perfect for amateur social engineering.

Go to Full Article