This document discusses three topics related to Bluetooth hacking: 1. Finding visible and invisible Bluetooth devices along with their specifications using tools like hcitool and btscanner. 2. Cloning Bluetooth devices by changing the Bluetooth address and class of a dongle to match another device. 3. Remotely injecting audio into Bluetooth headsets and recording audio from them using a tool called carwhisperer.

1. By
Swaroop YermalkaR

2. 1. Finding Visible & Invisible
Bluetooth Devices along with their
specifications
2. Cloning Bluetooth Devices
3. Remotely Inject audio in
Bluetooth headsets and record
audio from it.

3. BT5 r3 laptop Nokia Bluetooth Bluetooth Dongle Galaxy
Headset
pop

5. 79 channels 2.4-GHz ISM band
Devices hop across these channels at a rate of 1600 times per second
Bluetooth Device Address (BD_ADDR)

6. Source: www.techtree.com

7. Initial Setup

8. 1. Everything is in visible
Android Settings Ubuntu Settings

9. Find a target First
#hcitool scan
#hcitool inq

11. btscanner

12. Bluemaho

13. 2. Let’s Find the Invisible Devices…
Source: http://hwaddress.com/

14. Let’s Find the Invisible Devices…

15. Android Settings

16. Start sniffing
Sniff on
mon0

17. SAMSUNG

18. It is Samsung device

19. We have:
00:07:AB:ff:CF:88
~MAC address plus one
~ MAC address minus 1
~MAC address minus one
FOUND!!!

20. #hcitool inq <bd_addr>

21. Enumerate the services for further attack

22. Recall Previous
Information…

24. #hcitool scan
#bdaddr -i hci1 <new_bd_addr>

25. #hciconfig hci1 name “android”
#hciconfig hci0 class 0x58020c

26. Observe the Fields

27. Laptop

28. Why to Clone the bluetooth device?
In certain premises, some bluetooth type device may be
restricted. Does it still bother you? 
For many attacks such as attacks on bluetooth headset it is
necessary to make our device headset compatible.

29. Is our bluetooth
dongle headset
compatible?
No? change its
class.

30. Device conforms to the Headset Profile

31. Find your victim

32. Download url:
http://trifinite.org/Downloads/carwhispe
rer-0.2.tar.gz

33. #./carwhisperer <interface> <injecting audio file> <Output
file> <victim BD_ADDR>

34. Built on AIRcable XR™ long-range
technology
1 km external antenna included
Extended range for up to 30 km***
No external power needed
Aluminum case for reduced interference
and increased sensitivity

35. 1. Bluetooth Hacking: The state of art by
trifinite.org
2. Bluetooth Wiki
Yi-Bing Lin

37. Oct-2012 Sep-2012 Nov-2012
www.chmag.in

38. Feedback, questions and
suggestions:
swaroop.wireless@gmail.com