Bluetooth: The Next Step

Somewhat less popular but still viral videos of the Flipper Zero show a user pushing some orange buttons and every cellphone in the room going haywire. Their users look about, confused by this unforeseen turn of events. Meanwhile, the perpetrator laughs to himself. So, is this real or more wannabe malarkey? Yeah, it's mostly real. 

The Flipper comes equipped with a Bluetooth module. This module can do quite a few things, but I haven't done most of them, so I'll only write about what I know. In the case of the above story, the Flipper is sending out Bluetooth pairing requests on all points on the Bluetooth spectrum. The cellphones take these requests at face value and send a notification to the user that a device (usually headphone, earbuds, airpods, etc) is trying to connect. The moment the user dismisses this popup, another takes its place, and then another, and another, until either the Flipper user has had his fun or the unfortunate victims manage to turn of their phones. 

That's a nice prank, but what about some other functionalities? Here's a good one: the Flipper can send BadUSB scripts through Bluetooth as wel as a wired  connection. Okay, but why does it matter? In some secure areas, USB ports are closed off, accessible only by the IT department. Any peripherals have to be cleared with IT before being plugged in. Bluetooth, however, can be a bit more lax with protocol, allowing a malicious hacker to execute a scripts when it would otherwise be impossible.

"Well, that's nice and all," you might say,  "but it's still no good without physical access to your target computer." On a surface level, that would be true, but you'd be forgetting the single greatest vulnerability in ANY company's system -- people. 

Computers are predictable, human being are not. In many cases, it's easier to let an ignorant target let you in than it is to break in. In the case of Bluetooth, your goal is to get a target to connect to your Flipper's Bluetooth. This would be very difficult, but getting someone to connect might not be. A bonus of the Bluetooth connection is hat BadUSB scripts can be executed on cellphones as well as desktops and laptops. 

Picture this: a man on a subway discretely reaches into his pocket and pushes a button. Suddenly, everyone wearing earbuds (which means quite a few) and everyone on their phone (quite a few more) get spammed with connection alerts from a Bluetooth speaker. They dismiss the alerts. A new one takes its place. They dismiss that one too. A new one takes its place. They turn off their phones and turn them on again. The alert persists, preventing them from even disabling Bluetooth on their phones. Eventually, in hopes that it might stop the problem, a few of them accept the connection request. Their phone screens flash around for a moment while the BadUSB script grabs their personal information from their phones and loads it to the Flipper's SD card. As quickly as it started the whole thing stops, devices behave normally again, and everyone goes about their day, unaware that they've been hacked.

That's an interesting little concept. There are problems with it, of course, like the fact that the scripts would only work on Apple OR Android phones, but not both at once. However, the concept is sound enough. 

More targeted attacks are also possible, but a bit more difficult. Let's say you know your target is using a certain kind of airpods. Wait until they're wearing them and then send an airpod connection request to the target's phone. They'll likely think that the airpods have momentarily disconnected and accept without a second thought. Immediately, your scripts execute, carrying out whatever havoc you had planned. That's called an evil twin attack, which I'll write more about later. Believe me, it gets much more interesting and much more dangerous.