From 40545aef249ec176db33640d556d48ea2ee063d6 Mon Sep 17 00:00:00 2001 From: "a.edenhauser" Date: Thu, 29 Oct 2026 09:49:18 +0100 Subject: [PATCH] add: further ble infos --- Document0-Initial_Information_Gathering.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/Document0-Initial_Information_Gathering.md b/Document0-Initial_Information_Gathering.md index e279501..641e74e 100644 --- a/Document0-Initial_Information_Gathering.md +++ b/Document0-Initial_Information_Gathering.md @@ -174,10 +174,16 @@ Some playing around with Metasploit's `check` on these 2 cloud endpoints couldn' I ran ToothFairy on the lock. It's advertising name is "Loqed Inside" and it uses a fixed MAC address `FF:EC:EE:E7:32:E5`. -I obtained the [GATT table](ble/gatt_FF-EC-EE-E7-32-E5_20261023_085131.json) and a very incomplete [test report](ble/toothfairy_report_FFECEEE732E5_20261023_085351.json), due to a lack of hardware. +I obtained the [GATT table](ble/gatt_FF-EC-EE-E7-32-E5_20261023_085131.json) and a very incomplete [test report](ble/toothfairy_report_FFECEEE732E5_20261023_085351.json), due to a lack of HW. However, ToothFairy labelled `WRLS-FUZZ-002` as `FAIL`, due to the target not recovering after malformed packets were sent. +### Sniffing + +After obtaining the needed HW, I tried snifing the app connection process and sent a lock/unlock command, none of which showed ATT protocol packets. This could be due to: +- Encryption on the link layer +- The sniffer struggling with frequency hopping (nRF nordic) + ## 1.8 Collect Firmware Dump of Firmware after initial Setup ### Bridge