Setting Up Ubertooth on macOS for Bluetooth Hacking

Summary

This is a step-by-step guide on how to sniff Bluetooth Low Energy (BLE) packets between a Polar Vantage Smartwatch and a phone using the Ubertooth One. It will go into detail on the setup on a MacBook Air with MacOS using a python environment for the libraries that are used for the setup. Additionally every step of the actual sniff will be outlined. This guide is based on the seminar paper "Smartwatch Hacking Attack" that was written within the FH-course "Selected IT-Security Chapters".

Requirements

• Hardware tools: Ubertooth One: Firmware version: 2020-12-R1 (API:1.07)
• Smartwatch: Polar Vantage M
• Phone: Samsung Galaxy J3
• Unix-based Operating System: macOS (macOS Sequoia 15.1.1), on a MacBook Air with an Apple M1 chip.
• Virtual Environment: Python Environment: Python 3.12
• Packages: libusb, wget, cmake, pkg-config, setuptools, pyqt5, numpy
• Libraries: libbtbb, bleak
• Software Tools: Crackle

These setup steps for the Ubertooth tool are also summarized here Ubertooth - Build Guide - https://ubertooth.readthedocs.io/en/latest/build_guide.html.

Description

Step 1 - Install homebrew

Enter these commands in the shell

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
echo bar
echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> ~/.zshrc
eval "$(/opt/homebrew/bin/brew shellenv)"

Step 2 - Install Python Environment

Enter these commands in the shell

python3.12 -m venv myenv
source myenv/bin/activate

Step 3 - Install libusb, wget, cmake, pkg-config

Enter these commands in the shell

brew install libusb wget cmake pkg-config

Step 4 - Install the Bluetooth baseband library

Enter these commands in the shell

wget https://github.com/greatscottgadgets/libbtbb/archive/2020-12-R1.tar.gz -O libbtbb-2020-12-R1.tar.gz
tar -xf libbtbb-2020-12-R1.tar.gz
cd libbtbb-2020-12-R1
mkdir build
cd build
cmake ..
make

If errors occur with installing distutils switch to setuptools instead.

pip install setuptools

After installing the setuptools also change the "from distutils import setup" line in the the libbtbb-2020-12-R1/build/python/pcaptools/setup.py file to this:

from setuptools import setup

Also update the version in that same file to this:

version = '2020.12.R1'

Then retry:

make

sudo make install

Step 5 - Install the Ubertooth repository

Enter these commands in the shell

wget https://github.com/greatscottgadgets/ubertooth/releases/download/2020-12-R1/ubertooth-2020-12-R1.tar.xz
tar -xf ubertooth-2020-12-R1.tar.xz
cd ubertooth-2020-12-R1/host
mkdir build
cd build
cmake ..
make

If errors occur go to ubertooth-2020-12-R1/host/CMakeLists.txt an change:

cmake_minimum_required(VERSION 3.10)

include_directories(/opt/homebrew/include)
link_directories(/opt/homebrew/lib)

if(POLICY CMP0042)
    cmake_policy(SET CMP0042 NEW)
endif()

set(MAJOR_VERSION "1" CACHE INT "libUbertooth major version number")
set(MINOR_VERSION "1" CACHE INT "libUbertooth minor version number")

if(NOT APPLE)
    find_package(PkgConfig REQUIRED)
    pkg_check_modules(LIBBLUETOOTH REQUIRED bluez)
endif()

Additionally again change the "from distutils import setup" line in the the ubertooth-2020-12-R1/host/build/python/specan_ui/setup.py file to this:

from setuptools import setup

Also update the version in that same file to this:

version = '2020.12.R1'

Then retry:

make

sudo make install

If you get errors regarding the environment variables showing that your library wasnt found you need to set the library path via the MacOs's dynamic linker.

(export DYLD_LIBRARY_PATH=/usr/local/lib:$DYLD_LIBRARY_PATH)??

export DYLD_LIBRARY_PATH="/usr/local/lib:$DYLD_LIBRARY_PATH" '''''''' new

or make it persistent in shell configurations:

~/.zshrc

Afterwards confirm the ubertooth library is working correctly:

ubertooth-util

Step 6 - Test Ubertooth One commands

Enter these commands in the shell

ubertooth-util -H
ubertooth-util -v
ubertooth-util -p
ubertooth-util -s

Update Ubertooth firmware in ubertooth-2020-12-R1/ubertooth-one-firmware-bin:

sudo ubertooth-dfu -d bluetooth_rxtx.dfu -r

In ubertooth-2020-12-R1/host the following command leads to getting a list of sniffed Bluetooth packets with their Lower Address Parts (LAP):

ubertooth-rx

For collecting Upper Address Parts (UAP) from the captured packets add -z:

ubertooth-rx -z

Let it run for a while and look at the output. It will be summarized as Survey Results at the end of the output. There you can see the significant part of Bluetooth addresses of devices that were scanned.

Step 7 - Install Crackle

Enter these commands in the shell

python3.12 -m venv myenv
source myenv/bin/activate

Step 8 - Install bleak library

Enter these commands in the shell

python3.12 -m venv myenv
source myenv/bin/activate

Step 9 - Test Ubertooth One

Enter these commands in the shell

python3.12 -m venv myenv
source myenv/bin/activate

Step 10 - Read characteristics

Enter these commands in the shell

python3.12 -m venv myenv
source myenv/bin/activate

Step 11 - Subscribe to characteristics

Enter these commands in the shell

python3.12 -m venv myenv
source myenv/bin/activate

Step 12 - Manipulate characteristics

Enter these commands in the shell

python3.12 -m venv myenv
source myenv/bin/activate

Used Hardware

Device to be used with this documentation Maybe another device to be used with this documentation

Courses

• A course where this documentation was used (2017, 2018)
• Another one (2018)

References

• https://wikipedia.org
• https://google.com