Dissecting Broadcom Bluetooth

Video thumbnail (Frame 0) Video thumbnail (Frame 1506) Video thumbnail (Frame 2645) Video thumbnail (Frame 4564) Video thumbnail (Frame 5844) Video thumbnail (Frame 7522) Video thumbnail (Frame 8562) Video thumbnail (Frame 9610) Video thumbnail (Frame 10609) Video thumbnail (Frame 12364) Video thumbnail (Frame 13678) Video thumbnail (Frame 14824) Video thumbnail (Frame 16762) Video thumbnail (Frame 17755) Video thumbnail (Frame 18849) Video thumbnail (Frame 20169) Video thumbnail (Frame 21567) Video thumbnail (Frame 25466) Video thumbnail (Frame 26684) Video thumbnail (Frame 27969) Video thumbnail (Frame 31984) Video thumbnail (Frame 33098) Video thumbnail (Frame 35456) Video thumbnail (Frame 37055) Video thumbnail (Frame 38180) Video thumbnail (Frame 39402) Video thumbnail (Frame 41489) Video thumbnail (Frame 43206) Video thumbnail (Frame 44482) Video thumbnail (Frame 45861) Video thumbnail (Frame 47224) Video thumbnail (Frame 49488) Video thumbnail (Frame 51509) Video thumbnail (Frame 52370) Video thumbnail (Frame 53333) Video thumbnail (Frame 55890) Video thumbnail (Frame 57012) Video thumbnail (Frame 58425) Video thumbnail (Frame 59360) Video thumbnail (Frame 60812) Video thumbnail (Frame 62307) Video thumbnail (Frame 63764)
Video in TIB AV-Portal: Dissecting Broadcom Bluetooth

Formal Metadata

Title
Dissecting Broadcom Bluetooth
Title of Series
Author
License
CC Attribution 4.0 International:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Identifiers
Publisher
Release Date
2018
Language
English

Content Metadata

Subject Area
Abstract
Broadcom's Bluetooth firmware on popular devices – such as Nexus 5, Nexus 6P, Raspberry Pi 3, and Raspberry Pi 3+ – shares the same firmware update mechanisms, which allows for local firmware modifications. With InternalBlue we published a framework to change lower Bluetooth layers. In this talk we go even further and demonstrate a remote exploit in the Broadcom firmware.
Keywords Security

Related Material

The following resource is accompanying material for the video
Video is cited by the following resource
Enterprise architecture Software Video game Software framework Musical ensemble Information security Metropolitan area network Spacetime Neuroinformatik
Source code Game controller Implementation Closed set Projective plane Code Total S.A. Mathematical analysis 2 (number) Perspective (visual) Expected value Data management Software framework Implementation Information security Reverse engineering Firmware Information security Computing platform Wireless LAN Reverse engineering
Game controller Android (robot) Game controller Link (knot theory) Interface (computing) Bit Data management Word Bit rate Blog Spherical cap Interface (computing) Physics Communications protocol Physical system
Game controller Software framework Smartphone Computing platform Firmware
Game controller Greatest element Injektivität State of matter Gamma function Local ring Family Firmware
Game controller Injektivität Crash (computing) Firmware
Context awareness Patch (Unix) Authentication Code System on a chip Device driver Firmware
Standard deviation Patch (Unix) Code Function (mathematics) String (computer science) Web page Revision control Sampling (statistics) Sequence Similarity (geometry)
Standard deviation Functional (mathematics) State of matter Solid geometry Computer icon Power (physics) Sequence Hypermedia Software Energy level Firmware Wireless LAN Software development kit Matching (graph theory) Patch (Unix) Software developer Web page Code Similarity (geometry) Symbol table Word Function (mathematics) String (computer science) Revision control MiniDisc Game theory Musical ensemble Object (grammar) Table (information) Firmware
Frame problem Android (robot) Suite (music) Asynchronous Transfer Mode Link (knot theory) Injektivität Link (knot theory) Patch (Unix) Android (robot) Data management Software Communications protocol Firmware Communications protocol Software development kit
Frame problem Asynchronous Transfer Mode Functional (mathematics) Link (knot theory) Injektivität Telecommunication Projective plane Android (robot) Communications protocol Group action Plug-in (computing) Asynchronous Transfer Mode
Interface (computing) Line (geometry) Connected space
Compact space Link (knot theory) Injektivität Perfect group Demo (music) Demo (music) Software Android (robot) Lattice (order) Communications protocol Connected space Address space
Axiom of choice Frame problem Email Multitier architecture Link (knot theory) Validity (statistics) Closed set Code Drop (liquid) Total S.A. Bit rate Control flow Exponential function Database transaction Error message Software Revision control Square number Computer worm Communications protocol Communications protocol Form (programming)
System call Pay television Instant Messaging Demo (music) Workstation <Musikinstrument> Online help Complete metric space Function (mathematics) Plastikkarte Event horizon Interprozesskommunikation Software Electronic visual display Information output Standard deviation Demo (music) Computer file Core dump Thread (computing) Function (mathematics) Video game output Musical ensemble Address space
Keyboard shortcut Mobile app Multiplication sign Code Website output Mass Coma Berenices Bit Function (mathematics) Musical ensemble Alpha (investment)
Cue sports Android (robot) Perfect group State of matter Patch (Unix) Demo (music) Set (mathematics) Parameter (computer programming) Open set Plastikkarte Software bug 2 (number) Videoconferencing Energy level Software testing output Physical system God Installation art Demo (music) Patch (Unix) Sound effect 19 (number) Cache (computing) Type theory Uniform resource locator Function (mathematics) Revision control Configuration space Smartphone
Abstract state machines Computer file Patch (Unix) Revision control Musical ensemble YouTube Twitter
Asynchronous Transfer Mode Functional (mathematics) Group action State of matter Demo (music) Range (statistics) Parameter (computer programming) Content (media) Computer icon Frequency Crash (computing) Read-only memory Software testing Extension (kinesiology) Physical system Moment (mathematics) Code Parameter (computer programming) Compiler Personal digital assistant Crash (computing) Revision control Musical ensemble Asynchronous Transfer Mode Firmware
Frame problem Email Asynchronous Transfer Mode Game controller Link (knot theory) Demo (music) Dependent and independent variables Multiplication sign Menu (computing) Control flow Database transaction Power (physics) Transmitter Frequency Error message Function (mathematics) Pattern language Computer worm Software testing Estimation Hacker (term) Communications protocol Lipschitz-Stetigkeit
Asynchronous Transfer Mode Adaptive behavior Expert system Hand fan Frequency Spring (hydrology) Frequency Core dump Video game Software testing Software testing Freeware Writing
Purchasing Point (geometry) Frame problem Core dump Stack (abstract data type) Function (mathematics) Sequence Chain Mathematics Emulator Read-only memory Semiconductor memory Function (mathematics) Whiteboard
Twin prime Service (economics) Patch (Unix) Firewall (computing) Chaos (cosmogony) Virtualization Musical ensemble Game theory Generic programming Stack (abstract data type) Connected space
Point (geometry) Vulnerability (computing) Group action Presentation of a group Service (economics) Coma Berenices Software bug Expected value Goodness of fit Object (grammar) Musical ensemble Physical system Active contour model YouTube
Software Internetworking Cuboid Web syndication
Data model Number Software Charge carrier Channel capacity Address space Firmware Address space
Computing platform
Web page Dependent and independent variables Standard deviation Service (economics) Demo (music) Extreme programming Digital photography Software Squeeze theorem Office suite Firmware Sinc function Address space Address space
Software framework Neuroinformatik
Game controller Injektivität Crash (computing) Coma Berenices Firmware
Revision control Mobile Web Internetworking Personal digital assistant Semiconductor memory Chain Device driver Firmware Sequence
Word Internetworking Universe (mathematics)
Building 5 (number) Power (physics)
Facebook Window
Mobile Web Information Computer configuration Office suite
Internetworking
Web browser Firmware Hand fan
Cartesian closed category Musical ensemble Semiconductor memory
[Music] dennis lewke i find the masters of science and security the next one space great knife base interner bluetooth experimentation ation framework for enterprise for life zwickl prove it the the center of the ting tings after sales support security software defined radio hit she's not talking about bluetooth please welcome on stage dennis man sandisk aquatop of acting on-board computers
before the german swinger total.com basically wars engineered the firmware on bluetooth controller is closed manager at broadcom expectation framework around the world will be like that
is Wilhelm Seitz from security prospective second live battle of religious and working blues implementation to go vacation platform resources reverse engineering project Bad thing that causes this project are really fischl before security community so last but not least reverse engineering as well as had great experience
a first has been the host controller interface shz.de coal operated bluetooth controller and the host system prefab house system as follows apple and android phone or os or linux os operating system controller manager protocol the lmp of the word really interesting to
communicate with the rating system and the bluetooth controller is eclipse of the world from the wedding such you make it right to capture or bluetooth interface internal blog feature however in android before the controller interface
the people
working poor dad or bluetooth chips in other smartphones are platform economic policy the framework jquery introduced the framework detoxify details about it girls and works zafira
interested in montana because big brother stars of recorded a can find the bottom of the state is basically interviews wenders pacific aikens with of the instruments at broadcom in 3d
in the context of the firmware updates should the chip soc oecd fires which contains firmware updates to try to
reduce with permethrin like sample code and you
might say matches and then you have the concrete functions to offer the word Vollmann's staring at the end of the around the people of medias you as
the first is the it works and devices problem is when the next movie mendorf 2014 so excited to power will bolt development chefs from states companies here oled-display broadcom bosque at solid state disk mcadams in the table to say my command so icons till modify the firmware can expect and for games in the development kit so of levels and james freezers and objects aims [Music]
so you all okay with development kits
Let's get closer to the first days people like first link manager protocol will pair that in christink in rostock an instrument in the company win en suite from outside weekend capture the way to change the patch day of song on the wrong side firmware monastery handling ip traffic or android phone and android bluetooth debugging features completely integrated software
have plug in with the t??v project jackson mode as well as in vogue functions of communication and cancer center barry traffic.de white before last command
line interface
june is the bluetooth connection awc via devices to create connections the traffic at the motto show only so that
we compact demo axel dyck out bluetooth
more interesting features with maybe not everyone knows the surprise meeting on
the body snatchers connections the
active as before the connectivity perfect
Berlin ddp which came at minus on bluetooth is if an extra connecting network directly perfect so i can say they have traffic and the exp the protocol he knows every square the feature requests fashion week with close up to the daily quests or tv on snow official paper and the a71 you the validity total.com so the choice how come you are ampfing the pressefreiheit
[Music] in andelfingen bluetooth station of the
Possibility to pay tv business still impotent no output capabilities or can not you can not drive into that the standard for mobile phone headset as well determine can change the input output capabilities dan ju max gerth display yes no pairing bespin request events smartphone kutcher modern help demo video game of the same thing the disco
and the lift website alpha nex 5 and rider in times of iphone and a per exchange and quest in the cabin thies which is now a norway input output capabilities to you can see the right side and the iphone now ending of the year still western lately more often the same general is just the same thing as pairing want oxide of same cryptographic invited him bat
joachim lives and the iphone the bit Critics should end the not saying pries live the user to check on the from verdi also in put up and such apps [Music]
so it demands that the Council of States not to freising so the caches can find more
bacav tells a growth bluetooth leven want to find bugs in the starting tour all locations of the dealer Effect of the check on the parameter
parameter cekic end of shows as will will android kubik place is android installed, it is the dealer is the not have any check so the team is a complete movies were from audi his dearest dear the collect between two seconds august nineteen in 2004 team and at the level update or the white one type level chip countered the fcd patch dry said yeah you have a problem of ethno like do not know that does not exist a morisette yes okay it's not compliance imagine what you're doing one sorry my ex external compliance videos cash register will think it would have only perfect performance because in meyers did what does matter so much better switch off bluetooth to the needle device and the bluetooth freestyle ski opening and configuration sport comes amy much about the ice cold testing of things and mainz as well as white sex pistol helfer movie would be the effects in the broadcom chip is chalk lot like the iphone 6 macbook pro of tiffert and sixteen of course the experience on this is really nord complete that is mostly jews Scan your smart phones on the set know how crazy you are the tool is a god last week's disco want a going to demo system with btb quite know such kids bluetooth on the new song something
who loses here sony to go on twitter youtube 4
the craven would have bluetooth notarial
without that the device was here yes that could the orchestra via going to catch the nexus one i love is present and new weiland texte hilde the iphones realizing the kooks bluetooth on one play music uk looks almost or music oliver became the stop playing with stan Trainer file with that only at the iss on
because with psg nationalcoaches we like to be happy with the like so fast obese play music of music systems play offs disconnect yes that did that
happening so the crashes the best case
so the dealer Call it dealer forever on his darling the action the current problem here threatens to be fixed kontigent that handshake to check the parameter range the compiler likes to put wine merchant if the nobility is liable then s going to the extent to have something like to run will be 50 functions of how can call from the next day from parameter is so with buggy and sometimes i expect to get a the parameters of the crashes a device like no execute functions nex-5 the people With moments this icon enabled it does it is not to be something only rock it to able to phone much heartblood access to try and new state drive with a logo test your frequency is a song psk and test mode remotely
In addition, this brings live demo one Helper had to consider how can not think you because the problem is the current has exciting spectrum here in the were goals test fashion styling anyway so one casting the a tec violently fought
test and so the ship delivered est Mort hopping around in wood shakespeare will be out of order because of the interview you sent this question market parodic pjsc test control and test activate and for the get north accepted after this market what you can not do the accepted fc Chelsea the first test with going on some really blogs wings for long time is accepted magic
much comes to life with me same
frequency hopping you can even for the device will do it except test not to stop shopping before because of because the theme selected frequency so you thought the german select two frequency of the devices could use the core chips so what be on the same internal weekend conference on nexus fan expert set free cubicos tale warcraft is so far early spring a chip is said rosberg and all the white writing is the chip it is so bitterly removed in the EU not on an animal and sensors as well
a fine back we started developing toolchain should dennis edit feature netrace point of purchase the colt once and technology center are deep inside november to june contra the itu world race is nice to look at some have an idea what s going on board is change memory of the king from hervest and working on to i motogp star david that fastweb Producing the car almost never fish and lives there on output devil and able to comply or alive now so the republic mauritius amulets news most often
knows the problem of one expands and excel or chaos because they are still
the fcb celebrates plain text has been designed and install directly of the trade fog exactly disposition 1 on the path in white june twins great thing is the virtual city ??????where you have the wheel so you should now together eric fix the planned to Do not have a dynamic filter filtering some pictures of you on replay games Connection establishment to touched devices in the christmas dying at one [Music] Stop service motto and sensors in one bar ok chef jason beckett and the Weapons has been expected to throw away Texting bluetooth stack on the white skin rise to connect to me is going to crash so would have extra fx wolbeck annoyed extra kick and release and any Fix the courses like buy out of the milk of the next parkinson apartment like that
bak beer and for the republic of education from which we put it together the white one Snake getting if three updates it needs to be in transition update needs to be a special lake city fire and Sword Out Away delivers that possible for the world that the good news butt will probably never be one fischl update possibly updates wants objective labile ti should send account of the bug the tobi present in the White City will team for the 2006 team nico mendt youtube bluetooth special four helper broadcom chip set will be 2010 in genesis , the problem often occurs save.tv nordeck w all devices violently soffin directly to three point rottweiler tasted that feature we used and expectations of device services
[Applause] [Music]
dgf crashen suisseid mikrofons in the Riester pension microphone syndication
stranger means fresh cherries from the like internet software guests because
bluetooth mac-address wifi mac-address knows the chamberlain and agent of magic box here is the prospect a lot of gold or
Does the setting builds up because it cheers her
wifi bluetooth mac address software [Applause]
1/6 smart connected the traffic platform dr so people end up there so left what click here
none of the on whether the aesthetics of the most of the things global office page movie the wild things places like you would you think you were expecting you do not have to the extreme of rehab i hesse virgin requests between response service and so i can not give you the wall firmware sandwich virgin in the get to know the exploit of the company philips standard is recognized the address of a photo session firmware okay the next crash since
Michael of the relationship of the agenda 21
june so the attack.de day is not working and iphones ex-general framework lay patching exchange yng the movie wants will obviously work on any broadcom chip board computers of madison in front of how chips or bluetooth chips i can use framework for every broadcom chip by michael von
critical so many people from
Internet
texas memory addressee reads in the next follow were nothing tuifly condor films was discovered in the final version viola the found out something is only you have old pettersson should the hsg with what is the worst Case of the worst case would be what to say that you can read in the bluetooth in the bluetooth 11 because first must case would be is the wutb??rger mobility with driver the jsg firmware would be the next step sequencer exploited chain saw the worst case would be something seminar that was that were the has been Realities in the Waldorf Broadcom Chip set the possibility to the rest exploit chain will bleed the white jenzer sp make you can do it The cherries are okay
Internet giant fnb or what words that
white macbooks dependent can do s and detector we know the place presented the surfer how does that cost from the safe than you could be sure but yes only on that the university of jena christians of
Michael 106 ps became possible to increase bluetooth
radio transmission power by cinq bluetooth workcentre buildings and then write down in the nati
before the de interface is the old one
facebook windows live into the cockpit on
the encounter with christ in the discos of mobility for example bsi federal office for safety in the information technology bsi watkins title the obligation to inform general public license when we are publishing let the agriturismo problem to publish with in samedan edward b public for everyone barth yes we and an option if the
ok is the course already from the internet this is already becoming a microphone for the internet hello you exploit it timocom
to film the del is welcome here
implemented oh well then extracts firmware on the other songs along browsers was the dear valerie politician of the Magdeburger cinema is huge fan
of portfolio escapades and denis
Moschitto [Applause] [Music] [Music]
Feedback