182 lines
12 KiB
JSON
182 lines
12 KiB
JSON
{
|
|
"timestamp": "2026-10-23 08:53:51",
|
|
"target": {
|
|
"mac": "FF:EC:EE:E7:32:E5",
|
|
"address_type": "PUBLIC",
|
|
"vendor": "Unknown",
|
|
"rssi": -56,
|
|
"connectable": true,
|
|
"name": "Loqed Inside"
|
|
},
|
|
"security_score_percentage": 65.79,
|
|
"coverage_percentage": 22.09,
|
|
"final_verdict": "CRITICAL - Device has significant vulnerabilities",
|
|
"test_summary": {
|
|
"total_tests": 22,
|
|
"passed": 3,
|
|
"failed": 2,
|
|
"skipped": 11,
|
|
"review": 6,
|
|
"pending": 0,
|
|
"errors": 0
|
|
},
|
|
"test_cases": {
|
|
"WRLS-SCAN-001": {
|
|
"name": "Advertising Data Leakage",
|
|
"description": "Parse scan responses and advertisement packets to check for leaked hardware info, serial numbers, firmware versions, or excessive manufacturer data.",
|
|
"status": "REVIEW",
|
|
"details": "Advertising carries opaque data blobs (presence alone is normal BLE behaviour): Manufacturer data present (opaque): {65535: '0000'}. Decode vendor-specific formats for a definitive judgement.",
|
|
"weight": 3
|
|
},
|
|
"WRLS-SCAN-002": {
|
|
"name": "Static MAC Device Tracking",
|
|
"description": "Analyze address type to determine if the device uses a static or non-resolvable public MAC address, enabling long-term user tracking.",
|
|
"status": "FAIL",
|
|
"details": "Device advertises with a fixed address type (PUBLIC) that does not rotate. Any passive observer within radio range can log this MAC and correlate the device's comings and goings over time (a physical-tracking / de-anonymization risk for the device's owner).",
|
|
"weight": 3
|
|
},
|
|
"WRLS-SCAN-003": {
|
|
"name": "Cleartext Passive Sniffing",
|
|
"description": "Utilize a BLE sniffer (e.g., nrfutil sniffer) during active operation to check if application-layer payload data is transmitted completely unencrypted.",
|
|
"status": "SKIPPED",
|
|
"details": "No application traffic captured during the window - cannot judge (interact with the device and re-run).",
|
|
"weight": 9
|
|
},
|
|
"WRLS-GATT-001": {
|
|
"name": "Unauthenticated GATT Enumeration",
|
|
"description": "Connect to the peripheral without pairing or bonding and attempt to fully map out all available services, characteristics, and descriptors.",
|
|
"status": "REVIEW",
|
|
"details": "Full GATT topology mapped without pairing: 3 services, 9 characteristics discovered unauthenticated. This is normal BLE behaviour by itself (discovery is not meant to be authenticated) - see WRLS-GATT-003/004 for whether privileged VALUES are actually accessible without authorization.",
|
|
"weight": 8
|
|
},
|
|
"WRLS-GATT-002": {
|
|
"name": "Exposed Debug or DFU Services",
|
|
"description": "Check the enumerated GATT database against known standard/vendor UUIDs for active Over-The-Air (OTA) updates, Device Firmware Updates (DFU), or debug interfaces.",
|
|
"status": "PASS",
|
|
"details": "No known debug/DFU/OTA services detected.",
|
|
"weight": 8
|
|
},
|
|
"WRLS-GATT-003": {
|
|
"name": "Missing Service-Level Authorization",
|
|
"description": "Attempt to read from characteristics requiring authentication or higher privilege levels while completely unauthenticated to identify privilege escalation paths.",
|
|
"status": "PASS",
|
|
"details": "Sensitive characteristics enforce authorization.",
|
|
"weight": 9
|
|
},
|
|
"WRLS-GATT-004": {
|
|
"name": "Improper Write Permissions",
|
|
"description": "Systematically issue unauthorized write requests to all accessible characteristic UUIDs (including read-only handles) to find missing backend validation.",
|
|
"status": "REVIEW",
|
|
"details": "Writes accepted unauthenticated on 2 DECLARED-writable characteristic(s): bdce0101-e90d-4685-b89d-5578cd199a9f, bdce0103-e90d-4685-b89d-5578cd199a9f. This is expected if the profile requires no authentication, but confirm manually that write content is validated (this is what makes a device actually exploitable).",
|
|
"weight": 9
|
|
},
|
|
"WRLS-PAIR-001": {
|
|
"name": "Pairing Procedure Downgrade",
|
|
"description": "Force a connection and check if the device accepts insecure Legacy Pairing methods or automated 'Just Works' authentication when MITM protection is requested.",
|
|
"status": "SKIPPED",
|
|
"details": "No SMP Pairing Request/Response captured - cannot judge. IMPORTANT: btmon only sees THIS machine's Bluetooth traffic; pairing the target with a phone is invisible to it. Pair the target with THIS machine (e.g. bluetoothctl remove + connect) during the capture window, and remove any existing bond first so a fresh SMP exchange occurs.",
|
|
"weight": 9
|
|
},
|
|
"WRLS-PAIR-002": {
|
|
"name": "Pairing Lockout & Rate Limiting",
|
|
"description": "Test whether repeated unauthenticated connection/pairing attempts are throttled or locked out (absence of a lockout enables offline passkey brute-force).",
|
|
"status": "PASS",
|
|
"details": "Device rejected all 10/10 rapid unauthenticated connection attempts (lockout or auth enforcement present).",
|
|
"weight": 8
|
|
},
|
|
"WRLS-PAIR-003": {
|
|
"name": "Encryption Key Size Verification",
|
|
"description": "Inspect the link layer encryption parameters to confirm the device negotiates and enforces a minimum cryptographic key size of 128 bits (16 bytes).",
|
|
"status": "SKIPPED",
|
|
"details": "No packets carrying a key-size negotiation field (no pairing observed) - trigger pairing (remove any existing bond first) and re-run.",
|
|
"weight": 8
|
|
},
|
|
"WRLS-PAIR-004": {
|
|
"name": "Bonding Persistence & Deletion",
|
|
"description": "Verify if Long Term Keys (LTK) are stored securely, not systematically reused across differing sessions, and can be modified or deleted without authenticating.",
|
|
"status": "SKIPPED",
|
|
"details": "No packets are Pairing Request/Response - cannot judge. Trigger pairing and re-run.",
|
|
"weight": 8
|
|
},
|
|
"WRLS-LGC-001": {
|
|
"name": "GATT Write & Notification Replay",
|
|
"description": "Capture a valid, signed/encrypted GATT write or notification sequence and attempt to replay it to the device later to trigger unauthorized state changes.",
|
|
"status": "SKIPPED",
|
|
"details": "GATT write/notification replay requires inject-capable hardware; set INJECT_INTERFACE to enable.",
|
|
"weight": 9
|
|
},
|
|
"WRLS-LGC-002": {
|
|
"name": "Race Condition & Session Hijacking",
|
|
"description": "Bombard the device with rapid disconnect/reconnect commands to attempt session hijacking, or check if active sessions can be kicked off by a third-party MAC.",
|
|
"status": "SKIPPED",
|
|
"details": "Could not establish baseline connection: device 'dev_FF_EC_EE_E7_32_E5' not found",
|
|
"weight": 8
|
|
},
|
|
"WRLS-FUZZ-001": {
|
|
"name": "MTU & Buffer Overflow Fuzzing",
|
|
"description": "Request maximal MTU exchanges and send oversized payloads during write transactions to check for buffer overflows, memory corruption, or soft resets.",
|
|
"status": "REVIEW",
|
|
"details": "Device dropped connection after oversized writes but reconnected.",
|
|
"weight": 10
|
|
},
|
|
"WRLS-FUZZ-002": {
|
|
"name": "GATT Command Injection",
|
|
"description": "Fuzz specific functional characteristics with malformed data strings, boundary parameters (0x00, 0xFF), and unexpected formatting to disrupt logic flows.",
|
|
"status": "FAIL",
|
|
"details": "Target dropped connection during fuzzing and did NOT recover.",
|
|
"weight": 10,
|
|
"legacy_mappings": [
|
|
"WRLS-INPV-002"
|
|
]
|
|
},
|
|
"WRLS-FUZZ-003": {
|
|
"name": "Protocol Stack Malformed PDU (DoS)",
|
|
"description": "Inject malformed L2CAP frame headers, invalid ATT opcodes, or corrupted SMP handshake structures to force a complete hardware panic or deadlock.",
|
|
"status": "SKIPPED",
|
|
"details": "Malformed L2CAP/ATT/SMP PDU injection requires inject-capable hardware; set INJECT_INTERFACE to enable.",
|
|
"weight": 10
|
|
},
|
|
"WRLS-FUZZ-004": {
|
|
"name": "Connection Parameter Exhaustion",
|
|
"description": "Flood the peripheral with rapid, extreme Connection Parameter Update Requests to check if it suffers from a Denial of Service (DoS) state.",
|
|
"status": "SKIPPED",
|
|
"details": "Connection parameter update flooding requires inject-capable hardware; set INJECT_INTERFACE to enable.",
|
|
"weight": 6
|
|
},
|
|
"WRLS-SNIF-001": {
|
|
"name": "LL Privacy & Address Resolution Check",
|
|
"description": "Verify if the peripheral rotates its Resolvable Private Address (RPA) correctly during an active connection attempt, and check if identity resolution keys (IRK) are leaked over the air.",
|
|
"status": "REVIEW",
|
|
"details": "Only one address (FF:EC:EE:E7:32:E5) seen for 'Loqed Inside' across the 30s rescan window - rotation could not be confirmed one way or the other in this window (the window may simply be shorter than the device's rotation interval, which is commonly 15 minutes). Re-run with a longer window or verify IRK handling with a sniffer capture.",
|
|
"weight": 7
|
|
},
|
|
"WRLS-SNIF-002": {
|
|
"name": "Channel Map & Frequency Hopping Analysis",
|
|
"description": "Analyze if the device adheres to standard pseudo-random channel selection algorithms (CSA #2) or if its frequency hopping pattern is predictable, allowing targeted jamming.",
|
|
"status": "SKIPPED",
|
|
"details": "Requires an nRF Sniffer PCAP with an established connection captured (set NRF_SNIFFER_PCAP) - the shared capture phase found none, or only saw advertising traffic. Trigger a real connection and interact with the device during the capture window.",
|
|
"weight": 5
|
|
},
|
|
"WRLS-SNIF-003": {
|
|
"name": "SMP Just-Works Key Extraction",
|
|
"description": "Capture the raw Security Manager Protocol (SMP) pairing handshake. If 'Just Works' is negotiated, automatically extract the temporary/short-term key from the PCAP to decrypt the entire session.",
|
|
"status": "SKIPPED",
|
|
"details": "Captured 0 SMP packet(s) over the capture window (PCAP: gatt_outputs/toothfairy_sniff_1792738341.pcap), but no Pairing Request/Response - trigger pairing (remove any existing bond first) and re-run.",
|
|
"weight": 10
|
|
},
|
|
"WRLS-SNIF-004": {
|
|
"name": "Link Layer Control PDU Injection",
|
|
"description": "Inject anomalous Link Layer Control PDUs (e.g., malformed LL_LENGTH_REQ or LL_FEATURE_REQ) using the nRF hardware to bypass the OS stack and fuzz the target SoC firmware directly.",
|
|
"status": "SKIPPED",
|
|
"details": "Raw Link Layer Control PDU injection requires inject-capable hardware; set INJECT_INTERFACE to enable.",
|
|
"weight": 9
|
|
},
|
|
"WRLS-SNIF-005": {
|
|
"name": "Directed Advertisement Bypass",
|
|
"description": "Check if the peripheral responds to scanning requests or connection requests when it is theoretically configured to only accept directed advertising to a bonded master.",
|
|
"status": "REVIEW",
|
|
"details": "Device advertises as generally connectable; no directed/restricted advertising was observed to test a bypass against. Accepting connections is expected behaviour for an undirected-connectable device. (Note: the adv PDU type is not visible via bleak - populate target_device.directed_advertising from a sniffer capture to enable the active bypass probe.)",
|
|
"weight": 6
|
|
}
|
|
}
|
|
} |