BLE authentication design challenges on smartphone controlled IoT devices: analyzing Gogoro Smart Scooter

No ratings

Presented at DragonCon 2016 by

Chen-yu Dai

Smartphones are commonly used as the controller and Internet gateway for BLE-enabled IoT devices. Designing a strong authentication protocol between them is the key part of IoT security. However mobile app design has many challenges such as limited input & output interfaces as well as user privacy protection features. Due to these restrictions, many vendors has given-up BLE's build-in security manager protocol and choose to build their own authentication protocols. This study focused on a generalized method to analyze these BLE authentication protocols, discovering and solving challenges mentioned above. We applied this method on commercial products, including popular Gogoro Smart Scooter from Taiwan. We will demo under some certain circumstances it is possible to dump key used to unlock your GogoroScooter and send fake BLE authentication protocol packets to steal the scooter.