2

I am attempting to analyze the Bluetooth communication between a fitness tracker (GOJI ACTIVE GFITBK20 Activity Tracker) and its corresponding application (Goji Active) installed on my Android phone. My goal is to capture and analyze the health data (e.g., heart rate, calories, sleep, distance, sleep hours) transmitted over Bluetooth.

Here are the steps I've taken so far:

  1. Enabled Developer Options and Bluetooth HCI Snoop Log: Enabled "Developer options" on my Android phone. Enabled "Enable Bluetooth HCI snoop log" to gather Bluetooth logs.

  2. Captured Bluetooth Logs: Disabled and re-enabled Bluetooth on my phone. Ran the fitness tracker app and ensured it was actively communicating with the tracker. Connected the Android phone to my laptop and generated a bug report using the following ADB command, adb bugreport bluetooth

  3. Analyzed Logs with Wireshark: Used Wireshark to analyze the btsnoop_hci.log file extracted from the bug report.

Despite these steps, I am unable to see any health information such as heart rate, calories, sleep, distance, sleep hours, etc., from the Bluetooth traffic captured.

Questions:

  1. Is the method I used (enabling HCI snoop log and analyzing with Wireshark) the correct way to capture and analyze Bluetooth traffic for this purpose? If not, what should I be doing differently?
  2. Should I consider passive sniffing instead of the method I used? If so, how can I set up passive sniffing for Bluetooth LE traffic? I have a Parrot OS connected to the laptop via USB and a TP-Link Nano 5.0 Bluetooth adapter. Can I use this setup to perform passive sniffing? How do I configure and use tools like hcitool on Parrot OS to capture Bluetooth traffic?
  3. I also extracted the APK of the Goji Active app using tools like apktool. What patterns or keywords or file should I search for within the APK to understand how the app handles Bluetooth communication and encryption? Is it the correct way to find on what encryption they perform on the data?

Any guidance or recommendations on how to proceed with capturing and analyzing the Bluetooth traffic to understand the encryption and extract the health data would be greatly appreciated.

Improve this question
5
  • Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer.
    – Community Bot
    Commented Jun 15 at 14:45
  • But are you seeing Bluetooth traffic? If you are then your question isn't how to capture but rather how to decrypt which you've captured. And that's not a security question.
    – schroeder ♦
    Commented Jun 15 at 16:25
  • You might want to look into a software defined radio.
    – CaffeineAddiction
    Commented Jun 16 at 7:30
  • @CaffeineAddiction radio seriously?
    – abdul
    Commented Jun 16 at 7:44
  • Yes, SDR, seriously. Please look up things before dismissing them so quickly.
    – schroeder ♦
    Commented Jun 16 at 9:54

2 Answers 2

Reset to default
1

That's the general approach I'd use (although you could also reverse-engineer the Android APK itself if that's legal where you are). Just remember that a lot of these devices have strange encoding formats, and it might take a while to figure out where everything is. In addition to using Wireshark, I'd also consider using tshark -x -T json (see tshark(1)) on the command line to decode everything and something like Jupyter Notebook to analyze it. You might also find something useful under the bluetooth tag on the Reverse Engineering site.

For instance, with an OMRON blood pressure meter, a bunch of values were packed together into a structure. Values might be big-endian, little-endian, require calculations, or might be packed into specific bits.

"btatt.value": "18:81:00:02:88:10:6a:5e:6b:17:4f:0e:f1:1c:00:00"
                 25 + Systolic ═══╩╝ ││ ╚╩═╪╪══ Heart Rate
                        Diastolic ───┴┘    └┴─── Year - 2000

Some potentially helpful resources:

Improve this answer
1

You are attempting to capture Bluetooth communication between your fitness tracker and your phone. It seems like you are attempting this from developer mode on your phone ... which is one way to approach this (I will leave this for someone else to answer on).

The other way to approach this is from the attacker perspective in that they do not have physical access to your phone or fitness tracker. So, in order to do this you would need to sniff the wireless packets as they are transmitted. The best way that I know of to do this is with a software defined radio which allows you to sniff wireless communication on multiple different frequencies depending on the hardware you are using it with.

You might want to start with an Ubertooth One as it is newbie friendly with good documentation and out of the box support for wireshark.

Flipper Zero would be another newbie friendly SDR but is more geared towards RFC and Sub 1ghz frequencies. It does have Bluetooth support, but iirc that is only for connecting to another device ... the Bluetooth chip is not exposed to the SDR libs (third party firmware may have worked around this ... I don't know).

It is also possible to build your own but this path is not for the faint of heart as it will require a decent knowledge of electronics, radio, and FPGA programming.

Improve this answer
1
  • 1
    BLE use frequency hopping, this makes the Ubertooth One useless in practice. This project had a good documentation of the capabilities and limitations of various hardware devices: github.com/RCayre/mirage But the documentations gives 404 now, I guess you’d have to download the documentation’s source code to read it.
    – A. Hersean
    Commented Jun 17 at 8:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .