Matheus-Garbelini / sweyntooth_bluetooth_low_energy_attacks

Proof of Concept of Sweyntooth Bluetooth Low Energy (BLE) vulnerabilities.
267 stars 69 forks source link

llid_deadlock.py test script hanging #16

Closed Frogclub closed 3 years ago

Frogclub commented 3 years ago

Screenshot from 2020-09-02 13-02-22 I am trying to run the llid_dealock.py test script and the program keeps hanging at the same spot. I have the nRF52840 dongle and have flashed the firmware as described by the ReadMe.txt file. After programming the dongle I tried running the test script with the command "python llid_dealock.py /dev/ttyACM0 21:A8:1F:DE:F0:E8" which didn't work due to permissions regarding ttyACM0. I ran the command "dmesg | grep tty" which returned a new port "ttyS4" which had the appropriate baud rate of the nRF dongle and only showed up after the dongle was programmed. Running "python llid_dealock.py /dev/ttyS4 21:A8:1F:DE:F0:E8" led to minor success. The script ran until it hung at the output "TX ---> BTLE_ADV / BTLE_SCAN_REQ" and continuously repeated the same output indefinitely, as seen in the image above. I have ran through the script python file and I think the error is in the /drivers/NRF_dongle.py file at line 95 in the raw_receive class function declaration. "c = self.serial.read(1)" returns " b' ' ". The following 'if' statement is not triggered so raw_receive has no value. From what I can tell data has a value of 'None' in the llid_dealock.py which is preventing the script from completing the bluetooth attack. I am running the script on a Ubuntu 18.04 machine with the nRF52840 dongle. I am using a FitBit Inspire HR to run the attack against in case that information is pertinent.

Matheus-Garbelini commented 3 years ago

hi @Frogclub generally the serial port is /dev/ttyACM0 You can run the script with sudo to bypass the permission issue with the port or add your user to dialout group: sudo adduser $USER dialout. Generally if the condition you pointed out is always returning None, it's because the serial port is always timing out which means no response is being received from the Dongle. I suggest trying again but with the correct port at ACMx.