Bluetooth honeypot - hci socket that reads package problem -

Bluetooth honeypot - hci socket that reads package problem -

[Vincenzo Ampolo]

[-- Attachment #1: Type: text/plain, Size: 1206 bytes --]

Hi,

For my thesis, i'm trying to write a bluez based honeypot.
The basic concept is to listen at the hci level and perform actions. (switch 
on sockets in rfcomm or l2cap channels or addresses to audit the data)

I started studying the hcidump code and the hci socket. The main problem i'm 
having is that the hci socket which is created in this way

	sk = socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI);

does not "pop" the package from the bluez stack, it just reads but the package 
will continue to be processed by the stack. So if there is an attempt for a 
connection it will find a closed socket. Is there a way to "pop" the package 
from the stack, so i can read the destination channel or address of the 
package and turn on a socket on that specified channel or address and then 
"push" again the package into the stack?

If it's not possible, the only way to set my bluetooth honeypot up is to open 
a socket for each rfcomm and l2cap channel and address and wait for data to 
audit.

Thanks.  
-- 
Vincenzo Ampolo
http://goshawknest.wordpress.com/
http://vincenzo-ampolo.net

GnuPG Key: 
http://keyserver.ubuntu.com:11371/pks/lookup?op=get&search=0x9BF47CA71E506DE9

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 197 bytes --]

Re: Bluetooth honeypot - hci socket that reads package problem -

[Marcel Holtmann]

Hi Vincenzo,

> For my thesis, i'm trying to write a bluez based honeypot.
> The basic concept is to listen at the hci level and perform actions. (switch 
> on sockets in rfcomm or l2cap channels or addresses to audit the data)
> 
> I started studying the hcidump code and the hci socket. The main problem i'm 
> having is that the hci socket which is created in this way
> 
> 	sk = socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI);
> 
> does not "pop" the package from the bluez stack, it just reads but the package 
> will continue to be processed by the stack. So if there is an attempt for a 
> connection it will find a closed socket. Is there a way to "pop" the package 
> from the stack, so i can read the destination channel or address of the 
> package and turn on a socket on that specified channel or address and then 
> "push" again the package into the stack?
> 
> If it's not possible, the only way to set my bluetooth honeypot up is to open 
> a socket for each rfcomm and l2cap channel and address and wait for data to 
> audit.

what you are planning is to write a whole Bluetooth stack in userspace,
but wanna have the kernel do the hardware abstraction :)

You need to set the device into RAW mode. Otherwise the kernel will keep
processing the HCI packets.

Regards

Marcel

Re: Bluetooth honeypot - hci socket that reads package problem -

[Vincenzo Ampolo]

[-- Attachment #1: Type: text/plain, Size: 620 bytes --]

On Monday 20 July 2009 09:45:28 am Marcel Holtmann wrote:
> You need to set the device into RAW mode. Otherwise the kernel will keep
> processing the HCI packets.

Do you mean that i've to use a special device that supports RAW mode or that i 
can open a socket in RAW mode?

if it's the latter,i'm googlin for a while and i don't find any useful 
information. How should i call the socket C function to accomplish it?

Thanks.

-- 
Vincenzo Ampolo
http://goshawknest.wordpress.com/
http://vincenzo-ampolo.net

GnuPG Key: 
http://keyserver.ubuntu.com:11371/pks/lookup?op=get&search=0x9BF47CA71E506DE9

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 197 bytes --]

Re: Bluetooth honeypot - hci socket that reads package problem -

[Marcel Holtmann]

Hi Vincenzo,

> > You need to set the device into RAW mode. Otherwise the kernel will keep
> > processing the HCI packets.
> 
> Do you mean that i've to use a special device that supports RAW mode or that i 
> can open a socket in RAW mode?
> 
> if it's the latter,i'm googlin for a while and i don't find any useful 
> information. How should i call the socket C function to accomplish it?

you have to turn the Bluetooth HCI device into RAW mode. And also
hciconfig will tell you if the device is in that mode. Otherwise you
will have the kernel interfere and act as it is suppose to.

	dd = hci_open_dev(dev_id);
	ioctl(dd, HCISETRAW, 1);
	hci_close_dev(dd);

Regards

Marcel