Cyber security

BlueSpy – PoC To Record Audio From A Bluetooth Device

This repository contains the implementation of a proof of concept to record and replay audio from a bluetooth device without the legitimate user’s awareness.

The PoC was demonstrated during the talk BSAM: Seguridad en Bluetooth at RootedCON 2024 in Madrid.

It’s designed to raise awareness about the insecure use of Bluetooth devices, and the need of a consistent methodology for security evaluations.

That’s the purspose of BSAM, the Bluetooth Security Assessment Methodology, published by Tarlogic and available here.

This proof of concept exploits the failure to comply with the BSAM-PA-05 control within the BSAM methodolgy.

Consequently, the device enables the pairing procedure without requiring user interaction and exposes its functionality to any agent within the signal range.

More information on our blog.

Requirements

The code is written in Python and has been tested with Python 3.11.8, but it mainly uses widely available tools in Linux systems.

The PoC uses the following tools:

  • bluetoothctl
  • btmgmt
  • pactl
  • parecord
  • paplay

In Arch Linux distributions, bluetoothctl and btmgmt can be installed with the package bluez-utils, while pactlparecord and paplay are available in the libpulse package.

For the PoC to work, it is necessary to have a working instalation of the BlueZ Bluetooth stack, available in the bluezpackage for Arch Linux distributions. A working instalation of an audio server compatible with PulseAudio, such as PipeWire, is also required to record and play audio.

Setup

Ensure that your device is capable of functioning as an audio source, meaning it has a microphone, and that it is discoverable and connectable via Bluetooth.

For instance, to be discoverable and connectable, the earbuds used during the talk must be outside of their charging case.

By default, they only activate the microphone when placed in the user’s ears, although this setting can be adjusted in the configuration app.

Additionally, ensure that the device is not already connected, or alteratively, that it supports multiple connections.

Execution

Firstly, the address of the device must be discovered using a tool such as bluetoothctl:

$ bluetoothctl
[bluetooth]# scan on

Once the address of the device is discovered, the script can handle the rest:

$ python BlueSpy.py -a <address>

Note: The script might prompt for superuser permissions to modify the configuration of your BlueZ instance and pair with the remote device.

Troubleshooting

BlueSpy.py is the main script that executes every step of the process. However, if you encounter issues with nay of the phases, so it might be helpful to execute them individually:

  • pair.py utilizes the command-line tool btmgmt to modify the configuration of your BlueZ and initiate a pairing process with the remote device. The exact commands used are in the pair function inside core.py.
  • connect.py utilizes the command-line tool bluetoothctl to initiate a quick scan (necesary for BlueZ) and establish a connection to the device. The exact commands used are in the connect function inside core.py.
  • just_record.py utilizes the command-line tools pactl and parecord to search for the device in the system’s audio sources (it must function as a microphone) and initiate a recording session. The exact commands used are in the record function inside core.py.
  • The playback function inside core.py executes paplay to play back the captured audio.

If you encounter issues with any of the phases, examine the commands in core.py and try to execute them in a shell. This will provide more information on what may be failing.

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

Admin Panel Dorks : A Complete List of Google Dorks

Introduction Google Dorking is a technique where advanced search operators are used to uncover information…

19 hours ago

Log Analysis Fundamentals

Introduction In cybersecurity and IT operations, logging fundamentals form the backbone of monitoring, forensics, and…

2 days ago

Networking Devices 101: Understanding Routers, Switches, Hubs, and More

What is Networking? Networking brings together devices like computers, servers, routers, and switches so they…

2 days ago

Sock Puppets in OSINT: How to Build and Use Research Accounts

Introduction In the world of Open Source Intelligence (OSINT), anonymity and operational security (OPSEC) are…

3 days ago

What is SIEM? Complete Guide to Security Information and Event Management

Introduction As cyber threats grow more sophisticated, organizations need more than just firewalls and antivirus…

3 days ago

Website OSINT: Tools and Techniques for Reconnaissance

Introduction When it comes to cybersecurity and ethical hacking, one of the most effective ways…

3 days ago