Since I’ve had it for a bit, I figured it was time for an Ubertooth One introduction.
Ubertooth One Introduction
The Ubertooth One is a 2.4GHz development platform intended for Bluetooth experimentation.
I haven’t used it a ton yet, but I wanted to get it setup and at least learn how to scan with it. In the future, I’m hoping to get some scripts working for fox hunting!
First, I installed the VirtualBox Extension Pack.
Next, I plugged in the Ubertooth and verified that it connected to the VM.
After that, I installed all the prerequisites that I could get with apt.
apt-get -y install cmake libusb-1.0-0-dev make gcc g++ libbluetooth-dev pkg-config libpcap-dev python-numpy python-pyside python-qt4
Once those were install, I built libbtbb.
wget https://github.com/greatscottgadgets/libbtbb/archive/2015-10-R1.tar.gz -O libbtbb-2015-10-R1.tar.gz tar xf libbtbb-2015-10-R1.tar.gz cd libbtbb-2015-10-R1 mkdir build cd build cmake .. make make install
Finally, I installed ubertooth tools.
wget https://github.com/greatscottgadgets/ubertooth/releases/download/2015-10-R1/ubertooth-2015-10-R1.tar.xz -O ubertooth-2015-10-R1.tar.xz tar xf ubertooth-2015-10-R1.tar.xz cd ubertooth-2015-10-R1/host mkdir build cd build cmake .. make sudo make install
Ubertooth One – Initial Traffic
First, I ran a Bluetooth scan from my phone to create some traffic.
While that ran, I ran the Spectrum Analyzer to verify that everything was working.
Next, I sniffed some traffic using ubertooth-rx.
Capturing Traffic in Wireshark
First, I setup a FIFO that I could use as a named pipe.
Next, I opened Wireshark and setup a new interface using the pipe (reference).
Afterwards, I ran the Ubertooth in low energy mode on the named pipe.
ubertooth-btle -f -c /tmp/pipe
Note that I got an error at this point regarding “User encapsulation not handled”.
Per the documentation, I followed these steps.
- Edit -> Preferences
- Click Protocols -> DLT_USER
- Edit (Encapsulations Table)
- Click New
- Under DLT, select “User 0 (DLT=147)” (adjust this selection as appropriate if the error message showed a different DLT number than 147)
- Under Payload Protocol, enter: btle
- Click OK
- Click OK
Finally, with the error resolved, I setup a filter to try and view my traffic.
btle.data_header.length > 0 || btle.advertising_header.pdu_type == 0x05
With everything configured, I was able to see the connection between my phone and FitBit!
Ubertooth One – Conclusion
While I’m still understanding what I can use it for, this was a pretty easy introduction to the Ubertooth One.
If you have any ideas, suggestions, or tutorials, then please share them with me.
I’m not sure what I’ll use this for next, but hopefully I’ll be ready to hunt some foxes before the next wCTF!