Cracking BLE Encryption with the 'crackle' Command (with examples)

The ‘crackle’ command is a tool designed to analyze Bluetooth Low Energy (BLE) communications, specifically focusing on cracking and decrypting BLE encryption. This tool is particularly useful for security researchers and developers who need to validate the security of BLE implementations by attempting to crack the encryption used in BLE pairing processes. More information on this tool can be found on its GitHub page .

Use case 1: Checking for Necessary Packets to Recover Temporary Keys

Code:

crackle -i path/to/input.pcap

Motivation:

When analyzing Bluetooth Low Energy communications, one of the initial tasks is to verify if the data captured contains all the necessary packets to recover temporary keys (TKs). Performing this check is essential to determine whether cracking the BLE encryption is feasible with the recorded data. It is a preparatory step before attempting any decryption, ensuring time and resources are not wasted on incomplete or insufficient data.

Explanation:

• crackle: Invokes the crackle command-line tool.
• -i path/to/input.pcap: The -i flag specifies the input file that contains the capture of the BLE communications. The file path should point to a valid Packet Capture (PCAP) format file, which is a common file format used to capture and store network traffic.

Example Output:

Crackle: Starting analysis of input.pcap
Crackle: Found pairing request/response packets
Crackle: This capture contains necessary packets to recover TKs.

Use case 2: Brute Force Recovery and Subsequent Decryption

Code:

crackle -i path/to/input.pcap -o path/to/decrypted.pcap

Motivation:

Once it’s confirmed that the recorded BLE communications contain the necessary packets, the next step is to perform a brute force attack to recover the Temporary Key (TK) used during the pairing event. Recovering this TK is crucial as it enables the decryption of all subsequent BLE communications that rely on this pairing. This process is particularly valuable in security testing to illustrate the potential vulnerabilities in BLE pairing implementations.

Explanation:

• crackle: This command runs the crackle tool once again.
• -i path/to/input.pcap: The input option specifies the file containing the recorded BLE packets.
• -o path/to/decrypted.pcap: The -o flag denotes the path where the output file containing the decrypted communications should be saved. After successful decryption, the file is in PCAP format and can be opened with network analysis tools for further inspection.

Example Output:

Crackle: Brute forcing TKs from input.pcap
Crackle: Successfully recovered TK.
Crackle: Decrypted communications saved to path/to/decrypted.pcap

Use case 3: Decryption with a Known Long-Term Key

Code:

crackle -i path/to/input.pcap -o path/to/decrypted.pcap -l 81b06facd90fe7a6e9bbd9cee59736a7

Motivation:

In scenarios where the Long-Term Key (LTK) is already known, perhaps due to prior successful cryptanalysis or a controlled testing environment, it can be directly used to decrypt the recorded communications. This use case streamlines the decryption process by bypassing the need to recover the TK. It’s beneficial in controlled environments where cryptographic key management is already understood and needs validation.

Explanation:

• crackle: Executes the crackle utility for decryption.
• -i path/to/input.pcap: Indicates the path to the file with captured data that needs decryption.
• -o path/to/decrypted.pcap: Specifies the path for the output file where decrypted data will be written.
• -l 81b06facd90fe7a6e9bbd9cee59736a7: The -l flag is used to pass a known LTK directly to crackle. This 16-byte key is used to decrypt the communication stream. The known LTK must be provided in hexadecimal format without any spaces or delimiters.

Example Output:

Crackle: Using provided LTK to decrypt communication from input.pcap
Crackle: Decrypted packets written to path/to/decrypted.pcap

Conclusion:

The ‘crackle’ command provides a powerful suite of functionalities for decrypting BLE communications, essential for assessing security levels in BLE implementations. Whether evaluating packet captures for necessary information, performing brute force decryption, or using known keys to decrypt data, ‘crackle’ serves as a critical tool in the BLE security analyst’s toolkit. With these examples, users can effectively apply ‘crackle’ to their security and testing workflows.