by Mark Baseggio and Eric Evenchick

BLEKey is a tool designed to demonstrate the risks of using the Wiegand protocol.

Here's a video of us talking about the BLEKey at Blackhat USA 2015.

###Firmware Over the Air (FOTA) We've included a file in the /firmware folder called super.hex. This firmware has a bootloader included that allows the BLEKey to be flashed from a cell phone by shorting the first and last pins of the P2 port, and inserting a battery. The firmware update has been tested on the Android platform using the Nordic Master Control Panel tool.

We've created a video to demonstrate the process.

###MacOS or Linux

To flash the softdevice and BLEKey firmware from the CLI you can use JLinkExe which is provided in the Segger Software

The BLEKey requires a softdevice (for BLE) and the blekey firmware. These can be flashed using the commands below:

$ /usr/bin/JLinkExe -device nrf51822_xxaa -if swd -speed 4000

J-Link>loadbin s110_nrf51822_7.0.0_softdevice.bin 0
J-Link>loadbin blekey_s110_xxaa.hex 0x16000
J-Link>r
J-Link>g

Erasing:

J-Link>w4 4001e504 2
J-Link>w4 4001e50c 1

If you prefer a GUI you can always use rknrfgo

The cheatsheet above is ripped from Nordic's blog

###Windows

Use tools from Nordic.

###TODO ADD CHARACTERISTIC INFO HERE.

###Client

There is a BLEKey client in the client/ directory of the git repo. See readme.md and requirements.txt for more information on its use.

###Phones/Tablets

A client is planned. Until then download any BLE utility that can read/write BLE characteristics. See below for more information on specific characteristics.

###CLI (Linux)

Find your Bluetooth device with hcitool dev scan for BLEKey with hcitool -i <dev> lescan

Start an interactive connection to BLEKey

Last three Wiegand cards are stored in the 0x000b handle. Currently to cause BLEKey to send out the last read card on the Wiegand lines write to 0x000d

[blark@archvm blekey]$ sudo gatttool -t random -b D4:34:E8:CA:6F:6A -I
[D4:34:E8:CA:6F:6A][LE]> connect
Attempting to connect to D4:34:E8:CA:6F:6A
Connection successful
[D4:34:E8:CA:6F:6A][LE]> characteristics
handle: 0x0002, char properties: 0x0a, char value handle: 0x0003, uuid: 00002a00-0000-1000-8000-00805f9b34fb
handle: 0x0004, char properties: 0x02, char value handle: 0x0005, uuid: 00002a01-0000-1000-8000-00805f9b34fb
handle: 0x0006, char properties: 0x02, char value handle: 0x0007, uuid: 00002a04-0000-1000-8000-00805f9b34fb
handle: 0x000a, char properties: 0x02, char value handle: 0x000b, uuid: 0000aaaa-0000-1000-8000-00805f9b34fb
handle: 0x000c, char properties: 0x08, char value handle: 0x000d, uuid: 0000bbbb-0000-1000-8000-00805f9b34fb
handle: 0x000e, char properties: 0x08, char value handle: 0x000f, uuid: 0000cccc-0000-1000-8000-00805f9b34fb
handle: 0x0010, char properties: 0x0a, char value handle: 0x0011, uuid: 0000dddd-0000-1000-8000-00805f9b34fb
handle: 0x0013, char properties: 0x12, char value handle: 0x0014, uuid: 00002a19-0000-1000-8000-00805f9b34fb
handle: 0x0017, char properties: 0x02, char value handle: 0x0018, uuid: 00002a29-0000-1000-8000-00805f9b34fb
[D4:34:E8:CA:6F:6A][LE]> char-write-req d 01
Characteristic value was written successfully
[D4:34:E8:CA:6F:6A][LE]> char-read-hnd b
Characteristic value/descriptor: 22 bd 58 60 7c 26 00 24 47 60 85 08 37 00 24 47 60 85 08 37 00 00 
[D4:34:E8:CA:6F:6A][LE]>

You can also just use gatttool from the command line to yell BLEKey to send Wiegand data (replace with the address of your device):

sudo gatttool -t random -b D4:34:E8:CA:6F:6A --char-write-req -a 0x000d -n 01

###Notes:

• Bluetooth Explorer is in the Hardware IO Tools from Apple it's probably the best BLE utility for Mac.

###Harware rev. 0 code name Acamas

###Hardware rev. 1 Agapenor

Pinouts are identical to Acamas unless otherwise noted.

####P1 - Programming port (square solder mask pin 0)

####P2 - Serial/GPIO port (square solder mask pin 0)