蓝牙与近场通信安全取证深度分析

BLE广播包结构（典型被动嗅探结果）:
┌─────────────────────────────────────────────┐
│ Preamble (1B) │ Access Address (4B)         │
├─────────────────────────────────────────────┤
│ PDU Header (2B) │ AdvA (6B, 可能是RPA)      │
├─────────────────────────────────────────────┤
│ AdvData:                                     │
│   Flags: 0x06 (LE General Discoverable)     │
│   Complete UUID: 0x180F (Battery Service)   │
│   Local Name: "MiBand-7" (明文泄露设备名)    │
│   TX Power: -8 dBm                          │
└─────────────────────────────────────────────┘

sudo ubertooth-util -v
sudo ubertooth-btle -f -t <target_mac_address>
sudo ubertooth-util -d

sudo btdev -c /dev/ubertooth0 -r capture.cfa
ubertooth-btle -c capture.cfa -t aa:bb:cc:dd:ee:ff

git clone https://github.com/pnaz/btlejuice
cd btlejuice
npm install
sudo node proxy.js -u

sudo btlejuice -i ubertooth0 -w

Wireshark BLE过滤器示例:
btle                       # 所有BLE包
btatt                      # ATT协议层
btgatt                     # GATT应用层
btsmp                     # SMP安全管理层
btle.access_address == 0x8e89bed6   # 广播信道Access Address
btle.advertising_address == aa:bb:cc:dd:ee:ff  # 目标设备MAC
btatt.opcode == 0x0a       # ATT Read Request
btatt.opcode == 0x12       # ATT Write Request
btatt.handle == 0x000d     # 特定Characteristic句柄

正常连接RSSI特征:
  距离0.5m: RSSI ≈ -40 dBm (稳定, 方差<3)
  距离2.0m: RSSI ≈ -55 dBm (稳定, 方差<5)
  距离10m:  RSSI ≈ -75 dBm (波动, 方差<10)

中继攻击RSSI异常特征:
  近端节点: RSSI正常范围
  远端节点: RSSI突然跳变（-55 → -40 dBm, 无物理移动）
  时间序列: RSSI变化速率超过自然移动的物理极限
  惯性数据: IMU无加速度变化但RSSI大幅变化

EMV NFC支付安全机制对比:
┌─────────────┬──────────────┬──────────────┬─────────────────┐
│ 安全机制     │ EMV 3.x      │ EMV 4.x      │ EMV Contactless  │
├─────────────┼──────────────┼──────────────┼─────────────────┤
│ 静态数据认证  │ SDA          │ SDA          │ CDA/DDA          │
│ 动态数据认证  │ DDA          │ DDA/CDA      │ CDA              │
│ 令牌化       │ 不支持        │ 可选          │ 强制（部分市场）   │
│ PIN验证      │ 明文传输      │ 加密传输      │ 联机验证          │
│ 交易限额     │ 无限制        │ 可配置        │ 地区性限额         │
│ Relay防护    │ 无           │ 有限          │ 挑战-响应+限速     │
└─────────────┴──────────────┴──────────────┴─────────────────┘

proxmark3 /dev/ttyACM0
hw tune
lf search
hf search
hf 14a reader
hf mf autopwn
hf-mf-hardnested-defaults

hf mf dump -k FFFFFFFFFFFF
hf mf restore --1k -f dump.mfd
hf mf sim -k <key> --1k --uid <target_uid>

智能门锁BLE安全评估矩阵:
┌─────────────────┬──────────┬──────────┬──────────┬──────────────┐
│ 门锁型号         │ 配对方式  │ 加密层   │ Replay防护│ 取证可行性    │
├─────────────────┼──────────┼──────────┼──────────┼──────────────┤
│ 高端品牌锁       │ Passkey  │ AES-CCM  │ Nonce递增 │ 中（需物理接触）│
│ 中端品牌锁       │ JustWorks│ 固定密钥  │ 无       │ 高           │
│ 低价通用锁       │ JustWorks│ 无       │ 无       │ 极高          │
│ OEM方案锁        │ NoAuth   │ 明文     │ 无       │ 极高          │
└─────────────────┴──────────┴──────────┴──────────┴──────────────┘

title: Suspicious BLE Connection Anomaly Detection
id: 7a3b5c8d-1e2f-4a6b-9c0d-3e4f5a6b7c8d
status: stable
description: Detects suspicious Bluetooth Low Energy connection patterns indicating potential relay attack or unauthorized access
author: x7peeps蓝队
date: 2026-07-12
tags:
  - attack.initial_access
  - attack.t1557
  - attack.t1040
logsource:
  category: bluetooth
  product: bluetooth_le
detection:
  selection_rssi_anomaly:
    event_type: ble_connection
    rssi_change_rate|gt: 30
    connection_interval|lt: 15
  selection_unusual_time:
    event_type: ble_connection
    timestamp_hour|gte: 23
    timestamp_hour|lte: 5
    device_type: digital_key
  selection_key_replay:
    event_type: ble_gatt_write
    operation: write_without_response
    target_characteristic|contains:
      - unlock
      - open
      - start
      - enable
    write_frequency_1min|gt: 3
  selection_rssi_jump:
    event_type: ble_connection
    rssi_delta|gt: 25
    physical_movement_detected: false
  condition: selection_rssi_anomaly or selection_unusual_time or selection_key_replay or selection_rssi_jump
level: high
falsepositives:
  - Legitimate device relocation
  - BLE scanner polling
  - Firmware update connections
fields:
  - event_type
  - rssi
  - rssi_change_rate
  - connection_interval
  - device_address
  - timestamp_hour
  - target_characteristic

#!/bin/bash

echo "=========================================="
echo "Bluetooth & NFC Security Audit Script"
echo "=========================================="

echo "[*] Step 1: Scanning for active BLE devices..."
if command -v bluetoothctl &>/dev/null; then
    bluetoothctl --timeout 15 scan on
    bluetoothctl devices
    echo "[+] BLE scan completed"
elif command -v hcitool &>/dev/null; then
    echo "[+] Using hcitool for BLE scan..."
    timeout 15 hcitool lescan --duplicate &
    SCAN_PID=$!
    sleep 15
    kill $SCAN_PID 2>/dev/null
    hcitool lescan
else
    echo "[-] No BLE scanning tool available"
fi

echo ""
echo "[*] Step 2: Checking Bluetooth adapter security settings..."
if command -v bluetoothctl &>/dev/null; then
    bluetoothctl show | grep -E "Name|Alias|Pairable|Discoverable|Secure"
fi

echo ""
echo "[*] Step 3: Enumerating paired BLE devices..."
if command -v bluetoothctl &>/dev/null; then
    bluetoothctl paired-devices
fi

echo ""
echo "[*] Step 4: Checking for NFC reader processes..."
ps aux 2>/dev/null | grep -iE "proxmark|nfc|libnfc|mfoc|mfcuk" | grep -v grep

echo ""
echo "[*] Step 5: Scanning for suspicious BLE advertising..."
if command -v hcitool &>/dev/null; then
    timeout 10 hcitool lescan --passive --duplicates 2>/dev/null &
    SCAN_PID=$!
    sleep 10
    kill $SCAN_PID 2>/dev/null
fi

echo ""
echo "[*] Step 6: Checking Bluetooth kernel modules..."
lsmod 2>/dev/null | grep -iE "bluetooth|btusb|bnep|rfcomm"

echo ""
echo "[*] Step 7: Analyzing Bluetooth logs..."
if [ -f /var/log/syslog ]; then
    grep -iE "bluetooth|bt_|ble_" /var/log/syslog 2>/dev/null | tail -30
elif [ -f /var/log/messages ]; then
    grep -iE "bluetooth|bt_|ble_" /var/log/messages 2>/dev/null | tail -30
fi

echo ""
echo "[*] Step 8: Checking for known BLE attack tool artifacts..."
KNOWN_ARTIFACTS=(
    "/usr/bin/btlejuice"
    "/usr/bin/bettercap"
    "/opt/ubertooth"
    "/usr/bin/hciconfig"
    "/tmp/btlejuice*"
    "/tmp/proxmark*"
)
for artifact in "${KNOWN_ARTIFACTS[@]}"; do
    if ls $artifact 2>/dev/null; then
        echo "[!] Found BLE/NFC attack tool: $artifact"
    fi
done

echo ""
echo "[*] Step 9: Bluetooth device vulnerability check..."
if command -v bluetoothctl &>/dev/null; then
    bluetoothctl info 2>/dev/null | grep -E "UUID|Name|Icon|Class"
fi

echo ""
echo "=========================================="
echo "Audit completed"
echo "=========================================="

import subprocess
import json
import re
import sys
import datetime
from collections import defaultdict

class BluetoothNFCSecurityAuditor:
    def __init__(self):
        self.findings = []
        self.ble_devices = {}
        self.suspicious_patterns = []

    def scan_ble_devices(self):
        print("[*] Scanning for BLE devices...")
        try:
            result = subprocess.run(
                ['hcitool', 'lescan', '--duplicates'],
                timeout=15, capture_output=True, text=True
            )
            output = subprocess.run(
                ['hcitool', 'lescan'],
                timeout=5, capture_output=True, text=True
            )
            for line in output.stdout.splitlines():
                match = re.match(r'([\w:]{17})\s+(.*)', line)
                if match:
                    mac = match.group(1)
                    name = match.group(2).strip()
                    if mac not in self.ble_devices:
                        self.ble_devices[mac] = {
                            'name': name,
                            'first_seen': datetime.datetime.now(),
                            'count': 1
                        }
                    else:
                        self.ble_devices[mac]['count'] += 1
        except (subprocess.TimeoutExpired, FileNotFoundError) as e:
            print(f"[-] BLE scan error: {e}")
        return self.ble_devices

    def detect_rssi_anomalies(self, connection_log):
        print("[*] Analyzing RSSI anomalies...")
        anomalies = []
        if not connection_log:
            return anomalies
        rssi_values = [entry.get('rssi', 0) for entry in connection_log]
        for i in range(1, len(rssi_values)):
            delta = abs(rssi_values[i] - rssi_values[i-1])
            if delta > 25:
                anomalies.append({
                    'index': i,
                    'rssi_before': rssi_values[i-1],
                    'rssi_after': rssi_values[i],
                    'delta': delta,
                    'timestamp': connection_log[i].get('timestamp', 'unknown')
                })
                self.findings.append({
                    'severity': 'high',
                    'type': 'rssi_anomaly',
                    'detail': f'RSSI jumped {delta} dBm at index {i}'
                })
        return anomalies

    def analyze_ble_broadcast_patterns(self, scan_results):
        print("[*] Analyzing BLE broadcast patterns...")
        patterns = {
            'high_frequency': [],
            'suspicious_names': [],
            'unknown_manufacturers': []
        }
        suspicious_name_keywords = [
            'sniffer', 'proxy', 'relay', 'hack',
            'ble_', 'test', 'debug', 'ubertooth',
            'btlejuice', 'nrf'
        ]
        for mac, info in scan_results.items():
            name = info.get('name', '').lower()
            for keyword in suspicious_name_keywords:
                if keyword in name:
                    patterns['suspicious_names'].append({
                        'mac': mac,
                        'name': info['name'],
                        'keyword': keyword
                    })
                    self.findings.append({
                        'severity': 'high',
                        'type': 'suspicious_device_name',
                        'detail': f'Device {mac} ({info["name"]}) matches suspicious keyword'
                    })
            if info.get('count', 0) > 100:
                patterns['high_frequency'].append({
                    'mac': mac,
                    'name': info['name'],
                    'count': info['count']
                })
        return patterns

    def check_nfc_activity(self):
        print("[*] Checking NFC activity...")
        nfc_processes = []
        try:
            result = subprocess.run(
                ['ps', 'aux'], capture_output=True, text=True
            )
            nfc_keywords = ['proxmark', 'nfc', 'libnfc', 'mfoc', 'mfcuk', 'nfcutils']
            for line in result.stdout.splitlines():
                for keyword in nfc_keywords:
                    if keyword.lower() in line.lower():
                        nfc_processes.append(line.strip())
                        self.findings.append({
                            'severity': 'medium',
                            'type': 'nfc_process_detected',
                            'detail': f'NFC-related process found: {line.strip()}'
                        })
        except FileNotFoundError:
            pass
        return nfc_processes

    def detect_replay_indicators(self, gatt_operations):
        print("[*] Detecting Replay attack indicators...")
        replay_indicators = []
        if not gatt_operations:
            return replay_indicators
        op_groups = defaultdict(list)
        for op in gatt_operations:
            key = (op.get('characteristic'), op.get('value'))
            op_groups[key].append(op)
        for key, ops in op_groups.items():
            if len(ops) > 3:
                timestamps = [op.get('timestamp') for op in ops]
                replay_indicators.append({
                    'characteristic': key[0],
                    'value': key[1],
                    'count': len(ops),
                    'timestamps': timestamps
                })
                self.findings.append({
                    'severity': 'critical',
                    'type': 'replay_attack_suspected',
                    'detail': f'GATT operation repeated {len(ops)} times on {key[0]}'
                })
        return replay_indicators

    def generate_report(self):
        print("\n" + "=" * 60)
        print("BLUETOOTH & NFC SECURITY AUDIT REPORT")
        print("=" * 60)
        print(f"Scan time: {datetime.datetime.now()}")
        print(f"Devices found: {len(self.ble_devices)}")
        print(f"Total findings: {len(self.findings)}")
        print("-" * 60)
        severity_counts = defaultdict(int)
        for f in self.findings:
            severity_counts[f['severity']] += 1
        for sev in ['critical', 'high', 'medium', 'low']:
            if severity_counts[sev] > 0:
                print(f"  [{sev.upper()}] {severity_counts[sev]} findings")
        print("-" * 60)
        for f in sorted(self.findings, key=lambda x: {'critical': 0, 'high': 1, 'medium': 2, 'low': 3}.get(x['severity'], 4)):
            print(f"[{f['severity'].upper()}] {f['type']}: {f['detail']}")
        print("=" * 60)
        return self.findings

def main():
    auditor = BluetoothNFCSecurityAuditor()
    devices = auditor.scan_ble_devices()
    broadcast_patterns = auditor.analyze_ble_broadcast_patterns(devices)
    nfc_processes = auditor.check_nfc_activity()
    replay_indicators = auditor.detect_replay_indicators([])
    report = auditor.generate_report()
    sys.exit(1 if any(f['severity'] == 'critical' for f in report) else 0)

if __name__ == '__main__':
    main()

阶段1: 侦察与准备 (T1595 Active Scanning)
  → 确认目标车辆的蓝牙钥匙系统型号
  → 构建两个BLE中继节点（近端 + 远端）
  → 近端节点放置在车主钥匙附近（如家中）

阶段2: 中继建立 (T1557 Adversary-in-the-Middle)
  → 近端节点扫描钥匙的BLE广播信号
  → 近端节点通过WiFi回程将信号转发到远端节点
  → 远端节点向车辆发送伪造的BLE连接请求

阶段3: 距离欺骗 (T1098 Account Manipulation)
  → 远端节点的BLE信号强度模拟钥匙的近距离信号
  → 车辆RSSI验证通过，建立加密连接
  → 钥匙的加密凭证通过中继链路透传

阶段4: 非授权操作
  → 攻击者通过远端节点发送Unlock指令
  → 车辆解锁并允许启动引擎
  → 整个攻击过程约10秒完成

蓝牙层IOC:
  - 异常RSSI变化速率: >20dBm/秒
  - 蓝牙连接延迟异常: >10ms（正常应<5ms）
  - 非预期时间（凌晨）的BLE连接请求
  - 同一BD_ADDR在不同物理位置的快速切换
  - BLE广播包中Manufacturer Specific Data字段异常

网络层IOC:
  - 两个BLE设备间存在持续WiFi回程流量
  - WiFi路由器日志中出现未知MAC地址的连接
  - BLE连接时间段内的异常WiFi数据流
  - 车辆WiFi模块检测到非授权BLE连接请求

设备层IOC:
  - 车辆蓝牙模块固件日志中的异常连接事件
  - 钥匙端BLE活动日志与车辆端响应的时间戳不匹配
  - 车辆控制命令序列中的异常命令频率
  - 车辆解锁日志中的非物理接近解锁记录

阶段1: 侦察 (T1595 Active Scanning)
  → 使用BLE扫描工具（如Bettercap）发现周围开启蓝牙的设备
  → 识别目标设备的蓝牙协议栈类型（BlueZ/Android/iOS/Windows）
  → 通过SDP查询获取目标设备的详细信息

阶段2: 漏洞利用 (T1203 Exploitation for Client Execution)
  → 根据目标平台选择对应的CVE:
    - Linux: CVE-2017-1000250 (SDP堆溢出)
    - Android: CVE-2017-0785 (L2CAP堆溢出)
    - iOS: CVE-2017-14312 (Apple蓝牙逻辑漏洞)
    - Windows: CVE-2017-8628 (Windows蓝牙逻辑漏洞)
  → 构造特制蓝牙数据包发送到目标
  → 触发缓冲区溢出或逻辑漏洞

阶段3: 代码执行 (T1059 Command and Scripting Interpreter)
  → 利用溢出获得shellcode执行能力
  → 在目标设备上获得与蓝牙服务相同权限的代码执行
  → Android: bluetooth用户权限 (uid 1002)
  → Linux: 蓝牙守护进程权限

阶段4: 持久化与横向 (T1078 Valid Accounts)
  → 安装持久化后门（取决于目标平台能力）
  → 利用已获取的蓝牙连接能力攻击周边设备
  → 无需配对即可继续渗透其他设备

BlueBorne漏洞利用IOC:
  内核日志特征:
    - "Bluetooth: sdp" 关联的内核oops/panic
    - 堆损坏警告: "BUG: bad page state" 或 "heap corruption"
    - 异常的蓝牙驱动错误: "hci0: unexpected event" 后紧跟内存错误

  网络层特征:
    - L2CAP通道0x0001上的异常大数据包（>1024字节）
    - SDP响应包大小异常（正常<256字节）
    - 蓝牙设备IP地址的非预期网络连接

  进程层特征:
    - bluetooth用户(uid=1002)的异常进程创建
    - /data/local/tmp/ 或 /tmp/ 下的新增可执行文件
    - 蓝牙相关进程打开了非标准的网络socket

  漏洞指纹:
    - CVE-2017-1000250: SDP ServiceSearchAttributeResponse overflow
    - CVE-2017-0785: L2CAP Information Response overflow
    - CVE-2017-8628: Windows Bluetooth Service logic flaw
    - CVE-2017-14312: iOS Apple Bluetooth stack UAF

cat > /etc/bluetooth/main.conf << 'EOF'
[General]
Name = Bluetooth Device
DiscoverableTimeout = 0
PairableTimeout = 30
AutoEnable = false

[Policy]
AutoEnable = false
ReconnectUUIDs = 00001101-0000-1000-8000-00805f9b34fb
ReconnectAttempts = 3
ReconnectIntervals = 1, 2, 4

[Security]
JustWorksRepairing = no
HogpiSecurity = encryption

sudo bluetoothctl
power off
discoverable off
pairable off
agent off
power on

sudo systemctl disable bluetooth
sudo systemctl stop bluetooth
echo "blacklist btusb" | sudo tee /etc/modprobe.d/bluetooth-blacklist.conf
sudo update-initramfs -u

sudo systemctl disable pcscd
sudo systemctl stop pcscd
echo "blacklist nfc" | sudo tee /etc/modprobe.d/nfc-blacklist.conf

if command -v nfc-list &>/dev/null; then
    nfc-list -v
    echo "[!] NFC reader detected - review configuration"
fi