Totally Pwning the Tapplock (the API way)

An awesome researcher contacted us on the back of our recent Tapplock pwnage. We had been looking at the local BLE unlock mechanism, however he focussed instead on the mobile app API. Vangelis Stykas @evstykas has found a way to unlock any lock, plus scrape users PII and home addresses. Read his...

CVE-2018-11631

Rondaful M1 Wristband Smart Band 1 devices allow remote attackers to send an arbitrary number of call or SMS notifications via crafted Bluetooth Low Energy BLE traffic...

CVE-2018-11631

Technical details about CVE-2018-11631 are not publicly provided in the supplied documents. No concrete information on affected versions, root cause, or fixes is available here. Monitor for updates from official sources.

CVE-2018-10825

CVE-2018-10825 concerns Mimo Baby 2 devices, where BLE communications between the Turtle and Lilypad do not use authentication or encryption. This enables replay or spoofing attacks to inject false baby position and temperature data. The vulnerability description clearly identifies the affected c...

Norton Core Secure WiFi Router - BLE Command Injection (PoC)

Norton Core Secure WiFi Router - BLE Command Injection PoC PoC command injection in BLE service of Norton Core Secure WiFi Router CVE-2018-5234 For more information read paper. To demonstrate the exploitation, we will use: - OS GNU/Linux; - Bluetooth dongle adapter; - BlueZ utility for testing...

Norton Core Secure WiFi Router - 'BLE' Command Injection (PoC)

PoC command injection in BLE service of Norton Core Secure WiFi Router CVE-2018-5234 For more information read paper. To demonstrate the exploitation, we will use: - OS GNU/Linux; - Bluetooth dongle adapter; - BlueZ utility for testing Bluetooth connection. In order to use the script, we will nee...

CVE-2018-9119

An attacker with physical access to a BrilliantTS FUZE card MCU firmware 0.1.73, BLE firmware 0.7.4 can unlock the card, extract credit card numbers, and tamper with data on the card via Bluetooth because no authentication is needed, as demonstrated by gatttool...

CVE-2018-9119

CVE-2018-9119 affects BrilliantTS FUZE card (MCU firmware 0.1.73, BLE firmware 0.7.4). The root cause is lack of authentication for Bluetooth; after pairing, an attacker with physical access can bypass the lock screen, read credit card numbers (including expiration and CVV), and tamper with card ...

Advanced Network Monitoring & MITM Attack Framework: Bettercap

Evil socket just announced the release of the second generation of bettercap , a complete re-implementation of the most complete and advanced Man-in-the-Middle attack framework. This release not only brings MITM attacks to the next level, but it aims to be the reference framework for network...

CVE-2017-13211

In btascanresultscbimpl of btifblescanner.cc, there is possible resource exhaustion if a large number of repeated BLE scan results are received. This could lead to a remote denial of service of a critical system process with no additional execution privileges needed. User interaction is not neede...

Design/Logic Flaw

In btascanresultscbimpl of btifblescanner.cc, there is possible resource exhaustion if a large number of repeated BLE scan results are received. This could lead to a remote denial of service of a critical system process with no additional execution privileges needed. User interaction is not neede...

CVE-2017-13211

In btascanresultscbimpl of btifblescanner.cc, there is possible resource exhaustion if a large number of repeated BLE scan results are received. This could lead to a remote denial of service of a critical system process with no additional execution privileges needed. User interaction is not neede...

Code injection

An issue was discovered in the software on Vaultek Gun Safe VT20i products. There is no encryption of the session between the Android application and the safe. The website and marketing materials advertise that this communication channel is encrypted with "Highest Level Bluetooth Encryption" and...

CVE-2017-17435

An issue was discovered in the software on Vaultek Gun Safe VT20i products, aka BlueSteal. An attacker can remotely unlock any safe in this product line without a valid PIN code. Even though the phone application requires it and there is a field to supply the PIN code in an authorization request,...

CVE-2017-17435

An issue was discovered in the software on Vaultek Gun Safe VT20i products, aka BlueSteal. An attacker can remotely unlock any safe in this product line without a valid PIN code. Even though the phone application requires it and there is a field to supply the PIN code in an authorization request,...

CVE-2017-17435

CVE-2017-17435 (Vaultek VT20i / BlueSteal) : A vulnerability in Vaultek Gun Safe VT20i products allows remote unlocking without a valid PIN. An attacker who observes the BLE advertisement can write a BLE characteristic to enable notifications, craft a getAuthor packet that returns a temporary key...

BLE Scanner for Smart Devices Hacking: BLEAH

A BLE scanner for “smart” devices hacking based on the bluepy library, dead easy to use because retarded devices should be dead easy to hack. How to Install Install bluepy from source: git clone https://github.com/IanHarvey/bluepy.git cd bluepy python setup.py build sudo python setup.py install...

Based on BLE IoT smart bulb security vulnerability exploit-vulnerability warning-the black bar safety net

Currently the IOT and intelligent devices has become increasingly popular, and when we talk about the Internet of things, the first thought is often the smart home. Smart home usually involves a variety of devices, including smart refrigerators, smart light bulbs, a power adapter, a kettle, a...

Komfy Switch with Camera DKZ-201S/W - Wifi Password Disclosure Exploit

Exploit for hardware platform in category remote exploits !/usr/bin/python Exploit Title: Komfy Switch with Camera Wifi Password Disclosure via Bluetooth BLE Date: Oct 13, 2016 Exploit Author: Jason Doyle @jasondoyle Vendor Homepage:...

Komfy Switch With Camera DKZ-201S/W Password Disclosure

!/usr/bin/python Exploit Title: Komfy Switch with Camera Wifi Password Disclosure via Bluetooth BLE Date: Oct 13, 2016 Exploit Author: Jason Doyle @jasondoyle Vendor Homepage: http://us.dlink.com/products/connected-home/komfy-switch-with-camera/ HW Model: DKZ-201S/W SW Version: 1.0 Tested on:...