Fails to connect and advertise together

[tautology0]

When running mac_adv it all seems to work, goes through initialising, but then falls in a great big heap with a "Command Disallowed" error when it gets to advertising. ws-slave appears to connect to the device and then immediately disconnects.

Gattacker is advertising (I can see it from my phone), but it loses its connection to the device.

Output from mac_adv:

[root@mictlan gattacker]# ./mac_adv -a devices/3ca308c1aaa3_BS01.adv.json
Advertise with cloned MAC address
Ws-slave address: 127.0.0.1
peripheralid: 3ca308c1aaa3
advertisement file: devices/3ca308c1aaa3_BS01.adv.json
EIR: 02010609ff01023ca308c1aaa30302e7fe
scanResponse: 050942533031051250002003020a00
on open
poweredOn
Noble MAC address : 3c:a3:08:c1:aa:a3
BLENO - on -> stateChange: poweredOn
initialized !
Static - start advertising
on -> advertisingStart: error Error: Command Disallowed
Adv error  Error: Command Disallowed
    at Gap.onHciLeAdvertiseEnableSet (/home/dave/node_modules/gattacker/lib/bleno/lib/hci-socket/gap.js:201:15)
    at emitOne (events.js:116:13)
    at Hci.emit (events.js:211:7)
    at Hci.processCmdCompleteEvent (/home/dave/node_modules/gattacker/lib/bleno/lib/hci-socket/hci.js:539:10)
    at Hci.onSocketData (/home/dave/node_modules/gattacker/lib/bleno/lib/hci-socket/hci.js:427:12)
    at emitOne (events.js:116:13)
    at BluetoothHciSocket.emit (events.js:211:7)

Output from ws-slave:

ws -> send: {"type":"stopScanning"}
ws -> send: {"type":"initialized","peripheralId":"3ca308c1aaa3"}
ws -> send: {"type":"connect","peripheralId":"3ca308c1aaa3"}
ws -> send: {"type":"disconnect","peripheralId":"3ca308c1aaa3"}
ws -> send: {"type":"initializeStatus","peripheralId":"3ca308c1aaa3","status":"waiting with reconnect to target device for client connection to bleno..."}

[jslawek]

Hi,
looks like you are running both ws-slave and advertise on the same box. I would not recommend such setup, the kernel mismatches interfaces at low level (haven't debugged it yet...), even if you configure them properly in config.env (bleno = adv, noble=ws-slave).
The "Command Disallowed" happens for example when you try to connect using the interface that already advertises at the same time. Also your "Noble MAC address" (the "ws-slave" one, that connects to original device) has the same MAC as the target device. Try changing the MAC of the advertising adapter, not the one used as client (ws-slave).
Could you try using separate systems for ws-slave and advertise - e.g. separate VM, or Raspberry (setup the ws-slave IP in config.env)?

[minkione]

Just to confirm that something is wrong with the very same type of lock...
Of course, my setup is:
Laptop with one supported BLE dongle, running node scan and mac_adv
VM with one supported BLE dongle, running ws-slave

./mac_adv -a devices/c8df842b90bb_BS01.adv.json -s devices/c8df842b90bb.srv.json 
Advertise with cloned MAC address
Ws-slave address: 192.168.1.2
peripheralid: c8df842b90bb
advertisement file: devices/c8df842b90bb_BS01.adv.json
EIR: 02010609ff0102c8df842b90bb0302e7fe
scanResponse: 050942533031051250002003020a00
BLENO - on -> stateChange: poweredOn
on open
poweredOn
Noble MAC address : 00:01:95:40:c8:f6
initialized !
Static - start advertising
      target device connected
on -> advertisingStart: success
setServices: success
 <<<<<<<<<<<<<<<< INITIALIZED >>>>>>>>>>>>>>>>>>>> 
Client connected: 56:b4:8b:5c:6f:27
<< Read DATA error 1800 (Generic Access) -> 2a00 (Device Name )
/root/Desktop/gattacker_default/lib/bleno/lib/hci-socket/gatt.js:828
            callbackResponse = this.errorResponse(requestType, valueHandle, result);
                                                  ^

ReferenceError: requestType is not defined
    at Gatt.<anonymous> (/root/Desktop/gattacker_default/lib/bleno/lib/hci-socket/gatt.js:828:51)
    at /root/Desktop/gattacker_default/advertise.js:440:28
    at wsClient.<anonymous> (/root/Desktop/gattacker_default/lib/ws-client.js:241:7)
    at Object.onceWrapper (events.js:325:23)
    at emitMany (events.js:152:20)
    at wsClient.emit (events.js:224:7)
    at wsClient.onMessage (/root/Desktop/gattacker_default/lib/ws-client.js:141:10)
    at emitTwo (events.js:126:13)
    at WebSocket.emit (events.js:214:7)
    at Receiver.ontext (/root/node_modules/ws/lib/WebSocket.js:841:10)

[jslawek]

Hi,
it looks like the spoofing part (advertise) correctly emulates the device and also ws-slave part connects to original one. Next, mobile phone connects to spoofed device, and tries to read device name characteristic (2a00). This request is forwarded to ws-slave which in turn tries to read the characteristic from original device, and now there is some kind of problem. The "Read DATA error" means that the ws-slave component had some trouble receiving data in response to GATT read.
Such error can happen for example when the characteristic is secured (requires pairing/bonding) - what is not currently supported by GATTacker. Is your device in "paired devices" list of Bluetooth settings of your phone by any chance?

But the reason of this error may also be different. In order to debug what actually happens, we can try to:

1. Read this device name characteristic using other tool - e.g. gatttool, also from the same box+interface that ws-slave fails to do it in nodejs:

gatttool -I -b <target MAC> (-t random if needed)
[MAC][LE]> connect
(MAC turns blue)
[MAC][LE]> char-read-uuid 00002a00-0000-1000-8000-00805f9b34fb

2. Dump hci on the ws-slave interface during this process, and inspect the packets in Wireshark:
   hcidump -i hci0 -w dump.pcap
   For example in case there is "insufficient authentication" response it indicates the secured characteristic.

[minkione]

~/# gatttool -I -b c8:df:84:2b:90:bb -i hci0
[c8:df:84:2b:90:bb][LE]> connect 
Attempting to connect to c8:df:84:2b:90:bb
Connection successful
[c8:df:84:2b:90:bb][LE]> char-read-uuid 00002a00-0000-1000-8000-00805f9b34fb
[c8:df:84:2b:90:bb][LE]> char-read-uuid 00002a00-0000-1000-8000-00805f9b34fb
[c8:df:84:2b:90:bb][LE]> char-read-uuid 00002a00-0000-1000-8000-00805f9b34fb
[c8:df:84:2b:90:bb][LE]> exit

(gatttool:4499): GLib-WARNING **: 02:39:45.325: Invalid file descriptor.

From an initial inspection of the pcap I can't see any auth issues.
Here attached for reference:

dump.zip

[jslawek]

Your gatttool also does not read the characteristic value. How about other characteristics? In gatttool you can get list of all using characteristics command, and then char-read-hnd <handlenum>. In order to confirm it is not a problem with your Linux Bluetooth setup, can you also try to read the value of device name characteristic using e.g. nRF Connect mobile app?
There might be something wrong with device itself. If other characteristics are responding correctly, and the problem is just with this "device name", one way of circumventing it would be to create a static value hook for this characteristic. Thus when the value is read by mobile app, the gattacker does not try to get this value from original device, instead simply responds with the static one. You can configure hook in device services json file (devices/.srv.json>), for the "2a00" characteristic. In this example "test" (74657374 in hex):

            {
                "uuid": "2a00",
                "name": "Device Name",
                "properties": [
                    "read"
                ],
                "value": "74657374",
                "descriptors": [],
                "startHandle": 2,
                "valueHandle": 3,
                "asciiValue": "test",
                "hooks":{
                   "staticValue" : "74657374"
                }
            },

[minkione]

Firstly, thanks for the precious suggestions. Are very helpful for anyone that wants to debug in depth eventual issues. :)
I made some quick checks, then later, I will try also your suggestion of editing the json file too.
Interestingly the 2a00 return empty field...

[c8:df:84:2b:90:bb][LE]> char-read-hnd 0x000b
Characteristic value/descriptor: 

And NRF connect return empty response too for 2a00...

Full output of Gatttool:

:~/# gatttool -I -b c8:df:84:2b:90:bb -i hci1
[c8:df:84:2b:90:bb][LE]> connect 
Attempting to connect to c8:df:84:2b:90:bb
Connection successful  
[c8:df:84:2b:90:bb][LE]> characteristics 
handle: 0x0002, char properties: 0x08, char value handle: 0x0003, uuid: 000036f5-0000-1000-8000-00805f9b34fb
handle: 0x0005, char properties: 0x10, char value handle: 0x0006, uuid: 000036f6-0000-1000-8000-00805f9b34fb
handle: 0x000a, char properties: 0x02, char value handle: 0x000b, uuid: 00002a00-0000-1000-8000-00805f9b34fb
handle: 0x000c, char properties: 0x02, char value handle: 0x000d, uuid: 00002a01-0000-1000-8000-00805f9b34fb
handle: 0x000e, char properties: 0x0a, char value handle: 0x000f, uuid: 00002a02-0000-1000-8000-00805f9b34fb
handle: 0x0010, char properties: 0x08, char value handle: 0x0011, uuid: 00002a03-0000-1000-8000-00805f9b34fb
handle: 0x0012, char properties: 0x02, char value handle: 0x0013, uuid: 00002a04-0000-1000-8000-00805f9b34fb
handle: 0x0015, char properties: 0x20, char value handle: 0x0016, uuid: 00002a05-0000-1000-8000-00805f9b34fb
handle: 0x0019, char properties: 0x1c, char value handle: 0x001a, uuid: f000ffc1-0451-4000-b000-000000000000
handle: 0x001d, char properties: 0x1c, char value handle: 0x001e, uuid: f000ffc2-0451-4000-b000-000000000000
[c8:df:84:2b:90:bb][LE]> char-read-hnd 0x000b
Characteristic value/descriptor: 
[c8:df:84:2b:90:bb][LE]> char-read-hnd 0x000d
Characteristic value/descriptor: 00 00 
[c8:df:84:2b:90:bb][LE]> char-read-hnd 0x000f
Characteristic value/descriptor: 00 
[c8:df:84:2b:90:bb][LE]> char-read-hnd 0x0013
Characteristic value/descriptor: 50 00 a0 00 00 00 e8 03 
[c8:df:84:2b:90:bb][LE]> exit
(gatttool:2438): GLib-WARNING **: 15:07:35.211: Invalid file descriptor.