Added an activity for bluetooth replay attack

README.md

@@ -32,6 +32,7 @@ I tried to put as much vulnerabilities as possible in a short period of time. I
 11. Access Control Issues – Part 3
 12. Hardcoding Issues – Part 2
 13. Input Validation Issues – Part 3
+14. Bluetooth Replay Issues
 
 ## Can I contribute?
 Yes, you can help by sending us the details of vulnerabilities that we can implement in future versions of Diva. Please send an email to info [at] payatu.com with subject “DIVA Contribution”.

app/src/main/AndroidManifest.xml

@@ -5,6 +5,7 @@
     <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
     <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" />
     <uses-permission android:name="android.permission.INTERNET" />
+    <uses-permission android:name="android.permission.BLUETOOTH" />
 
     <application
         android:allowBackup="true"
@@ -103,6 +104,10 @@
         <activity android:name=".InputValidation3Activity"
             android:label="@string/d13" >
         </activity>
+        <activity
+            android:name=".BluetoothReplayActivity"
+            android:label="@string/d14" >
+        </activity>
     </application>
 
 </manifest>

app/src/main/java/jakhar/aseem/diva/BluetoothReplayActivity.java

@@ -0,0 +1,130 @@
+/*
+ * DIVA Android - Damn Insecure and Vulnerable App for Android
+ *
+ * Copyright 2017 © Payatu
+ * Author: Sudhakar Verma sudhakar[at]payatu[dot]com
+ * Websites: www.payatu.com  www.nullcon.net  www.hardwear.io www.null.co.in
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING,
+ * BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+package jakhar.aseem.diva;
+
+import java.io.IOException;
+import java.io.OutputStream;
+import java.util.Set;
+import java.util.UUID;
+
+import android.os.Bundle;
+import android.view.View;
+import android.support.v7.app.AppCompatActivity;
+import android.widget.RadioGroup;
+import android.widget.Toast;
+import android.content.Intent;
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothSocket;
+
+public class BluetoothReplayActivity extends AppCompatActivity {
+
+    BluetoothSocket mmSocket;
+    BluetoothDevice mmDevice = null;
+
+    final class senderThread implements Runnable {
+
+        private String btMsg;
+
+        public senderThread(String msg) {
+            btMsg = msg;
+        }
+
+        public void run()
+        {
+            sendBtMsg(btMsg);
+        }
+
+    }
+    public void sendBtMsg(String message){
+        UUID uuid = UUID.fromString("94f39d29-7d6d-437d-973b-fba39e49d4ee"); //Standard SerialPortService ID
+        try {
+
+            mmSocket = mmDevice.createRfcommSocketToServiceRecord(uuid);
+            if (!mmSocket.isConnected()){
+                mmSocket.connect();
+            }
+
+            String msg = message;
+            OutputStream mmOutputStream = mmSocket.getOutputStream();
+            mmOutputStream.write(msg.getBytes());
+
+        } catch (IOException e) {
+            e.printStackTrace();
+        }
+
+    }
+
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        setContentView(R.layout.activity_bluetooth_replay);
+        BluetoothAdapter mBluetoothAdapter = BluetoothAdapter.getDefaultAdapter();
+
+        if(!mBluetoothAdapter.isEnabled())
+        {
+            Intent enableBluetooth = new Intent(BluetoothAdapter.ACTION_REQUEST_ENABLE);
+            startActivityForResult(enableBluetooth, 0);
+        }
+
+        Set<BluetoothDevice> pairedDevices = mBluetoothAdapter.getBondedDevices();
+        boolean found_diva = false;
+        if(pairedDevices.size() > 0)
+        {
+            for(BluetoothDevice device : pairedDevices)
+            {
+                if(device.getName().equals("diva"))
+                {
+                    found_diva = true;
+                    Toast.makeText(this, "Found diva", Toast.LENGTH_SHORT).show();
+                    mmDevice = device;
+                    break;
+                }
+            }
+        }
+        if(!found_diva){
+            Toast.makeText(this, "Pair with diva first", Toast.LENGTH_SHORT).show();
+        }
+    }
+
+    public void doIt(View view){
+        RadioGroup radioGroup = (RadioGroup) findViewById(R.id.brgroup);
+        int selectedId = radioGroup.getCheckedRadioButtonId();
+        if (selectedId == R.id.br_on){
+            (new Thread(new senderThread("ON+17"))).start();
+        }
+        else{
+            (new Thread(new senderThread("OFF+17"))).start();
+        }
+        Toast.makeText(this, "Done!!", Toast.LENGTH_SHORT).show();
+    }
+}

app/src/main/java/jakhar/aseem/diva/MainActivity.java

@@ -128,5 +128,9 @@ else if (view == findViewById(R.id.d13button)) {
             Intent i = new Intent(this, InputValidation3Activity.class);
             startActivity(i);
         }
+        else if (view == findViewById(R.id.d14button)) {
+            Intent i = new Intent(this, BluetoothReplayActivity.class);
+            startActivity(i);
+        }
     }
 }

app/src/main/res/layout/activity_bluetooth_replay.xml

@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="utf-8"?>
+<RelativeLayout xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools" android:layout_width="match_parent"
+    android:layout_height="match_parent" android:paddingLeft="@dimen/activity_horizontal_margin"
+    android:paddingRight="@dimen/activity_horizontal_margin"
+    android:paddingTop="@dimen/activity_vertical_margin"
+    android:paddingBottom="@dimen/activity_vertical_margin"
+    tools:context="jakhar.aseem.diva.BluetoothReplayActivity">
+
+    <TextView
+        android:layout_width="wrap_content"
+        android:layout_height="wrap_content"
+        android:text="@string/br_intro"
+        android:id="@+id/brtextView"
+        android:layout_alignParentTop="true"
+        android:layout_alignParentLeft="true"
+        android:layout_alignParentStart="true"
+        android:textColor="@color/material_grey_600"
+        android:gravity="fill_horizontal|fill_vertical"
+        android:textAlignment="gravity" />
+
+    <RadioGroup
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:id="@+id/brgroup"
+        android:orientation="horizontal"
+        android:layout_below="@+id/brtextView"
+        android:layout_alignParentLeft="true"
+        android:layout_alignParentStart="true"
+        android:layout_marginTop="31dp">
+
+     <RadioButton
+        android:layout_width="wrap_content"
+        android:layout_height="48dp"
+        android:text="@string/br_off"
+        android:id="@+id/br_off"
+         />
+
+    <RadioButton
+        android:layout_width="wrap_content"
+        android:layout_height="wrap_content"
+        android:text="@string/br_on"
+        android:id="@+id/br_on"
+         />
+    </RadioGroup>
+    <Button
+        android:layout_width="wrap_content"
+        android:layout_height="wrap_content"
+        android:text="@string/br_view"
+        android:id="@+id/br_button"
+        android:onClick="doIt"
+        android:layout_below="@id/brgroup"
+        android:layout_centerHorizontal="true" />
+
+</RelativeLayout>

app/src/main/res/layout/content_main.xml

@@ -169,6 +169,16 @@
             android:layout_alignParentLeft="true"
             android:layout_alignParentStart="true" />
 
+        <Button
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:text="@string/d14"
+            android:id="@+id/d14button"
+            android:onClick="startChallenge"
+            android:layout_below="@+id/d13button"
+            android:layout_alignParentLeft="true"
+            android:layout_alignParentStart="true" />
+
     </RelativeLayout>
 </ScrollView>
 </RelativeLayout>

app/src/main/res/values/strings.xml

@@ -23,6 +23,7 @@
     <string name="d11">11. Access Control Issues - Part 3</string>
     <string name="d12">12. Hardcoding Issues - Part 2</string>
     <string name="d13">13. Input Validation Issues - Part 3</string>
+    <string name="d14">14. Bluetooth Replay Issues</string>
     <string name="log_intro"><b>Objective</b>: Find out what is being logged where/how and the vulnerable code.\n
                              <b>Hint</b>: Insecure logging occurs when developers intentionally
                              or unintentionally log sensitive information such as
@@ -97,4 +98,11 @@
                              from you. I dont expect anyone to go that far though.</string>
     <string name="ivi3_enter">Enter Launch Code for WOMD</string>
     <string name="ivi3_stop">PUSH THE RED BUTTON</string>
+    <string name="br_intro"><b>Objective</b>: With properly paired Bluetooth device, this app lets you talk to the device and
+                              control some appliances. Implement a similar app in your favourite language.\n
+                              <b>Hint:</b>Reverse the protocol used here and look for libraries in your favourite language
+                               to implement a replay attack.</string>
+    <string name="br_off">OFF</string>
+    <string name="br_on">ON</string>
+    <string name="br_view">GO!</string>
 </resources>