Nike+ FuelBand SE BLE Protocol Reversed

#1

Post by daw___ » Thu, Jan 29, 2015, 10:02 PM UTC

Nike+ FuelBand SE BLE Protocol Reversed
evilsocket.net

Re: Nike+ FuelBand SE BLE Protocol Reversed

#2

Post by revelation » Thu, Jan 29, 2015, 11:07 PM UTC

Hardware reverse engineering has gotten so much easier since everyone is obligated to deliver some useless Android (preferred) or iPhone app with their consumer junk. No one seems to bother with obfuscation.

Re: Nike+ FuelBand SE BLE Protocol Reversed

#3

Post by yonran » Thu, Jan 29, 2015, 11:34 PM UTC

Fun stuff. I would also recommend using some kind of packet sniffer to collect sample data which can make your static analysis easier. To do this, buy the CC2541 development kit with packet sniffer for about $25. Alternatively, you can write a BLE proxy (using two Bluetooth adapters). To Apple’s credit, the CoreBluetooth API on iOS does not let the app know the MAC address of the peripheral, so the app will never know that it is talking to your proxy vs the actual device.

Re: Nike+ FuelBand SE BLE Protocol Reversed

#4

Post by evilsocket » Thu, Jan 29, 2015, 11:58 PM UTC

yonran wrote: post #3

Fun stuff. I would also recommend using some kind of packet sniffer to collect sample data which can make your static analysis easier. To do this, buy the CC2541 development kit with packet sniffer for about $25. Alternatively, you can write a BLE proxy (using two Bluetooth adapters). To Apple’s credit, the CoreBluetooth API on iOS does not let the app know the MAC address of the peripheral, so the app will never kno…

yeah I thought about physical sniffing and wanted to buy/build a bt sniffer myself ... but you know, some Android versions have a builtin bt sniffing feature ;)

Re: Nike+ FuelBand SE BLE Protocol Reversed

#5

Post by eyeareque » Fri, Jan 30, 2015, 12:03 AM UTC

Imagine how much fun you could have with sending messages to runner's bands at Nike branded half and full marathons! :) Not that I would do that.

Re: Nike+ FuelBand SE BLE Protocol Reversed

#6

Post by eyeareque » Fri, Jan 30, 2015, 12:04 AM UTC

This might be helpful for anyone wanting to play with low level BT traffic: http://ubertooth.sourceforge.net/

Re: Nike+ FuelBand SE BLE Protocol Reversed

#7

Post by evilsocket » Fri, Jan 30, 2015, 12:11 AM UTC

eyeareque wrote: post #6

This might be helpful for anyone wanting to play with low level BT traffic: http://ubertooth.sourceforge.net/

I'm seriously thinking about buying/building one of those

Re: Nike+ FuelBand SE BLE Protocol Reversed

#8

Post by ta33 » Fri, Jan 30, 2015, 12:27 AM UTC

on a related note, is the act of decompiling jars legal if the software was obtained legally, ie bought?

Re: Nike+ FuelBand SE BLE Protocol Reversed

#9

Post by evilsocket » Fri, Jan 30, 2015, 12:37 AM UTC

ta33 wrote: post #8

on a related note, is the act of decompiling jars legal if the software was obtained legally, ie bought?

http://reverseengineering.stackexchange.com/questions/60/is-...

Re: Nike+ FuelBand SE BLE Protocol Reversed

#10

Post by fredkelly » Fri, Jan 30, 2015, 1:06 AM UTC

This is awesome!

For what it's worth, I spent a little time playing with their Fuel API when the first band was released: http://fredkelly.net/articles/2012/12/21/nike_fuel.html