Hidden GATT Bluetooth services

BR/EDR

BLE

In Bluetooth, there are multiple mechanisms to discover the services available on a device. One of them is the Generic Attribute Profile (GATT), which enables communication through the exchange of structured attributes. GATT is mandatory in BLE compliant devices and must be correctly configured to list all available services.

Not listing a service in GATT does not prevent access to it and does not provide any security benefit. Likewise, if a service is properly secured, hiding it is unnecessary. Ensuring that GATT accurately lists all services aligns with Bluetooth specifications and improves device interoperability.

Description

In order to check if there are hidden services it is important to perform a GATT discovery. This is an standard Bluetooth procedure that can be performed with standard bluetooth tools.

After having a list of available GATT services, it is needed to perform alternative ways of discovering Bluetooth services. This can include the following procedures:

• Capturing Bluetooth communications while operating the device to discover communications with previously unknown services.
• Performing bruteforce scans of services in a device.
• Performing service scans using different service discovery protocols such as the SDP if available.

If there are services hidden to the GATT service it is not correctly configured.

Related resources

To check this control, the following resources may be useful:

Example case

The existence of hidden GATT services in a device with BLE connectivity will be tested. The tests will be carried out on a laptop. We will use Wireshark with BTVS (btvs.exe -Mode wireshark) to capture packets for analysis.

For this control it will be necessary to have python 3 installed. From a terminal it will be necessary to install the packages asyncio and bleak with the python installation wizard pip.

pip install asyncio.

pip install bleak.

To perform the search for Service exposed by GATT, the bleak script service_explorer.py will be used.

To run it it is necessary to know the MAC address of the target device and type the command:

python service_explorer.py --address XX:XX:XX:XX:XX:XX:XX:XX:XX >> gatt_explorer.txt.

A file (gatt_explorer.txt) with the traces generated by the service_explorer.py script is available and sorted for easy reading.

For each service (Service) there is one or more characteristics (Characteristic) containing one or more descriptors (Descriptor) and a value (Value). The services, characteristics and descriptors have two additional fields: the Handle and the UUID.

The Bluetooth driver internally lists the GATT services via the Handle or UUID field. The standard has limited, for a device, the number of services, features and descriptors to 65.535 (0xFFFF), equivalent to scrolling from value 1 to 65,535 in the Handle.

To check for hidden Service, a read request will be made with Scapy, or a similar tool like gatttool, for each Handle, depending on the response obtained for each query the Handle will exist or not. The possible cases of response to a read request, according to the ATT protocol, will allow to know if a Handle exists or not.

Once you have the output of the two tools, compare the results and if there are Handle that are not listed with the bleak script, it means that it is a hidden service.

The check control FAIL when more existing Handle are found than discovered in the GATT scan.