David Bombal
David Bombal
  • 1 430
  • 213 432 527
Android Bluetooth Hacking
Big thank you to Brilliant for sponsoring this video! Try Brilliant for free (for 30 days) and to get a 20% discount, visit: Brilliant.org/DavidBombal
CVE-2023-45866 allows attackers to remotely control an Android phone (and other devices) without pairing.
Details: Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue. Source: Mitre
See CVE details here:
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45866
nvd.nist.gov/vuln/detail/CVE-2023-45866
How to stop / mitigate this attack:
1) Upgrade your phone / install security patches on Android for versions 11 and later. Unfortunately earlier versions cannot be patched (Android 10 and earlier)
2) Note: For the script to discover the MAC address of the phone, the phone needs to be in pairing mode.
3) Turn off Bluetooth if not being used
// Script and instructions here //
GitHub: github.com/pentestfunctions/BlueDucky
// Occupy The Web Books //
Linux Basics for Hackers:
US: amzn.to/3wqukgC
UK: amzn.to/43PHFev
Getting Started Becoming a Master Hacker
US: amzn.to/4bmGqX2
UK: amzn.to/43JG2iA
Network Basics for hackers:
US: amzn.to/3yeYVyb
UK: amzn.to/4aInbGK
// OTW Discount //
Use the code BOMBAL to get a 20% discount off anything from OTW's website: hackers-arise.net/
// Occupy The Web SOCIAL //
X: three_cube
Website: hackers-arise.net/
// GitHub CODE //
github.com/pybluez/pybluez
// Amazon LINKS //
Rasberry Pi 5:
US: amzn.to/3JZKoZD
UK: amzn.to/3JTBixC
ASUS USB/BT-500USB
US: amzn.to/4abnPfl
UK: amzn.to/3QDsOOO
// Playlists REFERENCE //
Linux Basics for Hackers: ua-cam.com/video/YJUVNlmIO6E/v-deo.html&pp=iAQB
Mr Robot: ua-cam.com/video/3yiT_WMlosg/v-deo.html&pp=iAQB
Hackers Arise / Occupy the Web Hacks: ua-cam.com/video/GxkKszPVD1M/v-deo.html&pp=iAQB
// David's SOCIAL //
Discord: discord.com/invite/usKSyzb
X: davidbombal
Instagram: davidbombal
LinkedIn: www.linkedin.com/in/davidbombal
Facebook: davidbombal.co
TikTok: tiktok.com/@davidbombal
UA-cam: www.youtube.com/@davidbombal
// MY STUFF //
www.amazon.com/shop/davidbombal
// SPONSORS //
Interested in sponsoring my videos? Reach out to my team here: sponsors@davidbombal.com
// MENU //
Hacking Wordpress Websites with Python in seconds (using the Dark Web and Telegram data)
00:00 - Bluetooth hacking quick demo
03:05 - Brilliant sponsored segment
03:57 - The Bluetooth vulnerability explained // OccupyTheWeb
05:26 - How the vulnerability works
08:16 - Bluetooth hacking demo
09:26 - Setting up for the hack // BlueZ
12:12 - BlueZ tools demo
13:50 - Scanning for Bluetooth devices
17:58 - Other tools
23:20 - Running BlueDucky // Hacking Bluetooth demo
25:50 - The possibilities of Bluetooth hacking
28:04 - Older Android versions are at risk // Keeping devices up to date
30:17 - Bluetooth hacking for other operating systems
30:52 - Hacking Bluetooth speakers
34:04 - OTW books & plans for future videos
34:52 - Conclusion
android
iphone
bluetooth
raspberry pi
macos
windows
samsung
pixel
google
apple
microsoft
linux
ubuntu
blue tooth
flipper zero
google pixel
ble
Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel!
Disclaimer: This video is for educational purposes only.
#android #iphone #bluetooth
Переглядів: 79 158

Відео

Hacking Wordpress with Python in seconds (using Dark Web and Telegram data)
Переглядів 75 тис.День тому
Big thanks to Flare for sponsoring this video. You can track down cybercrime and manage threat intelligence or your own exposed attack surface with Flare! Try a free trial and see what info is out there. try.flare.io/david-bombal/ Your usernames and passwords are out there. So many breaches are happening and passwords are being posted on the Dark Web and Telegram channels. And to make things wo...
Real World Windows Pentest Tutorial (demos of Top 5 Active Directory hacks)
Переглядів 80 тис.14 днів тому
A big shoutout to TCM Security for sponsoring this video. Register now to receive a 50% discount on your first month at the TCM Security Academy, potentially making your most significant step toward a career in ethical hacking. Go here: davidbombal.wiki/3vQsqWm // TCM Security SOCIAL// LinkedIn : www.linkedin.com/company/tcm-security-inc/ Twitter : TCMSecurity UA-cam (The Cyber Ment...
Your VPN won't protect you 😱
Переглядів 78 тис.21 день тому
Big thanks to Brilliant for sponsoring this video! Get started with a free 30 day trial and 20% discount: Brilliant.org/DavidBombal The machines are already tracking and watching you. And they're influencing you. The future looks bleak. Do you really want to live in a Skynet world? I interview Rob Braxman - the Internet Privacy Guy. He's a public interest hacker and technologist. He uses his ex...
The new AI Cyber Defense you need to know about
Переглядів 161 тис.21 день тому
Is this the beginning of a new type of firewall that will replace or augment traditional firewalls? Is AI now eating firewalls; and will we still be using them in future? Big thank you to Cisco for sponsoring this video and my trip to McLaren. // Jeetu Patel’s SOCIAL// LinkedIn: linkedin.com/in/jeetupatel X: jpatel41 Cisco Newsroom: newsroom.cisco.com/c/r/newsroom/en/us/executives/j...
Next Gen Hackers protecting our world
Переглядів 91 тис.28 днів тому
A big shoutout to TCM Security for sponsoring this video. Register now to receive a 50% discount on your first month at the TCM Security Academy, potentially making your most significant step toward a career in ethical hacking. Go here: davidbombal.wiki/3vQsqWm Farah works at Meta and shares her amazing story of going from studying mass media, to hacking and now working at Meta. Did you know th...
Black Hat Bash: Bash Scripting for Hackers and Pentesters (Bonus: GraphQL and Drone hacking)
Переглядів 49 тис.Місяць тому
Big thanks to Brilliant for sponsoring this video! To try everything Brilliant has to offer for free for a full 30 days and 20% discount visit: Brilliant.org/DavidBombal I interview Dolev Farhi and Nick Aleks - the authors of Black Hat Bash and Black Hat GraphQL. Why should you learn either of these? Good reasons including $50K bug bounties :) // Books // Black Hat Bash: USA: amzn.to/3JebZWJ UK...
You ever seen these devices? Networking for Hackers and Cybersecurity professionals.
Переглядів 63 тис.Місяць тому
How long did it take you to see something new or learn something new in this video? If you want to be an Ethical Hacker or Cybersecurity Professional, you need to understand networking. In this video I show you how to capture traffic using Wireshark and Ethereal using different scenarios: 1) Bus topology 2) Hub topology 3) Bridge topology 4) Switched topology 5) Port mirror / port span 6) Netwo...
Demo of the Microsoft Window's Hack developed by the NSA (with OTW)
Переглядів 64 тис.Місяць тому
OTW demonstrates how to use the NSA hack with Metasploit and take control of a Windows computer remotely. // Occupy The Web Books // Linux Basics for Hackers: amzn.to/3JlAQXe US and amzn.to/43PHFev UK Getting Started Becoming a Master Hacker: amzn.to/3qCQbvh US and amzn.to/43JG2iA UK Network Basics for hackers: amzn.to/3W1iiCQ US and amzn.to/4aInbGK UK // OTW Discount // Use the code BOMBAL to ...
Mind Blowing 🤯 Reverse Shell Demo with DNS data bouncing exfiltration!
Переглядів 68 тис.Місяць тому
Mind Blowing 🤯 Reverse Shell Demo with DNS data bouncing exfiltration!
Network Chuck Hacked YouTube! Learn how RIGHT NOW!!
Переглядів 102 тис.Місяць тому
Network Chuck Hacked UA-cam! Learn how RIGHT NOW!!
AI just replaced us with Devin... seriously? Dr Chuck!
Переглядів 198 тис.Місяць тому
AI just replaced us with Devin... seriously? Dr Chuck!
Hackers remotely hack millions of cars!
Переглядів 74 тис.2 місяці тому
Hackers remotely hack millions of cars!
Should you be using WiFi 7 or WPA3? Best Wi-Fi setup?
Переглядів 67 тис.2 місяці тому
Should you be using WiFi 7 or WPA3? Best Wi-Fi setup?
Flipper Zero vs "Proper" Hacking Tools
Переглядів 177 тис.2 місяці тому
Flipper Zero vs "Proper" Hacking Tools
Top 10 FREE OSINT tools (with demos) for 2024 - And FREE OSINT course!
Переглядів 114 тис.2 місяці тому
Top 10 FREE OSINT tools (with demos) for 2024 - And FREE OSINT course!
Top 5 Wireshark tricks to troubleshoot SLOW networks
Переглядів 68 тис.2 місяці тому
Top 5 Wireshark tricks to troubleshoot SLOW networks
Free Hacking API courses (And how to use AI to help you hack)
Переглядів 91 тис.2 місяці тому
Free Hacking API courses (And how to use AI to help you hack)
Why hack in when you can just log in?
Переглядів 30 тис.2 місяці тому
Why hack in when you can just log in?
Linux for Hackers: LINUX commands you need to know (with OTW) // Ep 6
Переглядів 65 тис.3 місяці тому
Linux for Hackers: LINUX commands you need to know (with OTW) // Ep 6
AI superpowered networks? (NVIDIA and Cisco join forces)
Переглядів 48 тис.3 місяці тому
AI superpowered networks? (NVIDIA and Cisco join forces)
The AI Cybersecurity future is here
Переглядів 145 тис.3 місяці тому
The AI Cybersecurity future is here
Free Complete Course: You need to learn this programming language to be a senior developer!
Переглядів 258 тис.3 місяці тому
Free Complete Course: You need to learn this programming language to be a senior developer!
They're watching you 😱 Protect your online PRIVACY!
Переглядів 101 тис.3 місяці тому
They're watching you 😱 Protect your online PRIVACY!
Free Web Application Ethical Hacking Course (Includes Server-side request forgery SSRF)
Переглядів 50 тис.3 місяці тому
Free Web Application Ethical Hacking Course (Includes Server-side request forgery SSRF)
The best Hacking Courses & Certs? Your 2024 roadmap to Pentester success.
Переглядів 109 тис.3 місяці тому
The best Hacking Courses & Certs? Your 2024 roadmap to Pentester success.
Free OSINT course and resources: How you can get started in 2024
Переглядів 67 тис.3 місяці тому
Free OSINT course and resources: How you can get started in 2024
Mind blowing 🤯 $20 million USD bounties! (Zero to Hero Money Hacking Roadmap)
Переглядів 206 тис.4 місяці тому
Mind blowing 🤯 $20 million USD bounties! (Zero to Hero Money Hacking Roadmap)
Hack your life (with demos) and get Superpowers!
Переглядів 165 тис.4 місяці тому
Hack your life (with demos) and get Superpowers!
Is it the end? (Or can YOU do something in 2024?)
Переглядів 85 тис.4 місяці тому
Is it the end? (Or can YOU do something in 2024?)

КОМЕНТАРІ

  • @Z28videogates
    @Z28videogates 10 годин тому

    RG58 and RG8 coax - after you are done with it, you can use the coax for your CB or Ham Radio instead.

  • @shazzz_land
    @shazzz_land 10 годин тому

    Good one a few days back )))) when my phone rang people without me doing anything

  • @milire2668
    @milire2668 10 годин тому

    longer n in more detail pls :D

  • @hemanthreddytetali4622
    @hemanthreddytetali4622 10 годин тому

    Even this is possible for samsung flagship mobiles

  • @cedrickcaindoy
    @cedrickcaindoy 11 годин тому

    What i put in password

  • @user-ye4mz7ni5g
    @user-ye4mz7ni5g 11 годин тому

    Hi David.. Can I run this on a chromebook?

  • @crazygermanviper
    @crazygermanviper 11 годин тому

    I tried this with my Kali Linux and it doesn't work. The deauth method does not deauthenticate the stations, so without this there is not reconnect thus not allowing for the capture of a 4 way handshake.

  • @MAITREESEE023
    @MAITREESEE023 11 годин тому

    That’s a narley apple monitor? Which Mac is that? Btw you have a sweet setup!

  • @CatHead-pq1yi
    @CatHead-pq1yi 11 годин тому

    i was installing the app when i saw this video

  • @ghostfpdoom4059
    @ghostfpdoom4059 11 годин тому

    Can i on secure boot option again after complete all these process

  • @JamarHotep
    @JamarHotep 11 годин тому

    I am using a DooGee Mix that has DooGeeOS an Android 7 version and I am using windows 10 but don't see any of that. Any ways to update so I can use more apps as I just use it as a small tablet on wifi.

  • @Iconic_MiHiR
    @Iconic_MiHiR 12 годин тому

    But why the linux automatically off in a minute

  • @user-in2jf7tx1q
    @user-in2jf7tx1q 13 годин тому

    i love these history podcasts, something you don't easily hear

  • @allantidalgo4651
    @allantidalgo4651 13 годин тому

    I appreciate very much

  • @m.imraniqbaal6912
    @m.imraniqbaal6912 13 годин тому

    Hi David, I came here to see if we can achieve Zero touch provisioning for Cisco Devices, like literally out of the box. Can you please recommend this piece if you've already made it. Thanks!

  • @demonx7735
    @demonx7735 13 годин тому

    It works I tested it

  • @ggelosstavrou9117
    @ggelosstavrou9117 14 годин тому

    Hey the ASU’s adaptor you suggest doesn’t work with Kali . Should I install drivers or something? Can you do a tutorial about this ?

  • @hagbard72
    @hagbard72 14 годин тому

    I despise smartphones. Every bank I deal with is starting to demand it, you can't set up an online account without one. Every business seems to be pushing it. I think the entire thing is nefarious but then I think all cars being various shades of gray or black is too.

  • @jaycestauffer46
    @jaycestauffer46 15 годин тому

    Now fb and Google are trying to get me into stuff I don't like but my roomates do. So I know my phone is listening. I also get my messages blocked and emails blocked by Google as well.

  • @oneaboveall3374
    @oneaboveall3374 15 годин тому

    True, even many different things can generate same hash code, though It's really rare in a good hash function.

  • @rifi8706
    @rifi8706 15 годин тому

    I love this channel!

  • @familiamayor-pm1fp
    @familiamayor-pm1fp 16 годин тому

    ❤❤❤

  • @lordoftheautism8597
    @lordoftheautism8597 16 годин тому

    WIndows 11 is so trash that i have to do dual boot w11 keep crashing so often that is irratating

  • @hodayfa000h
    @hodayfa000h 16 годин тому

    No thanks, i can already do that from my router's configuration.

  • @rishi00018
    @rishi00018 16 годин тому

    Does it require a rooted device?

  • @Khaled.003
    @Khaled.003 17 годин тому

    Well its more dangerous for iOS cause in android when you turn off Bluetooth or wifi its off. But in ios it just disconnects the connected devices and don't turn it off. If you want to turn off you have to fo it in settings that most people don't do most of the time

  • @questionsfrog1918
    @questionsfrog1918 17 годин тому

    As if random people gain access to your Wifi,duuuuh

  • @allantidalgo4651
    @allantidalgo4651 17 годин тому

    Thanks sir, very informative and concise, I learn a lot.

  • @ratchtex1037
    @ratchtex1037 17 годин тому

    Tp link users can use the factory app by tp link

  • @thongtranlequoc688
    @thongtranlequoc688 18 годин тому

    He said: "This is just scratching the surface" 😭😭😭

  • @timsmith5754
    @timsmith5754 19 годин тому

    Get off your arse❤

  • @timsmith5754
    @timsmith5754 19 годин тому

    PUT YOUR PC'S IN THE BIN START LIVING WALKING COOKING PLAYING MUSICAL INSTRUMENTS HOLIDAYS START A FAMILY❤

  • @runebel
    @runebel 20 годин тому

    Is it so that if you do hash the whole book and I match your hash I have written the whole same text, al of it? Or can something be missing?

  • @ratnoize
    @ratnoize 20 годин тому

    so hard to watch the laggy VM

  • @mrpuranas
    @mrpuranas 20 годин тому

    Manage to use the OTW Discount. Thank you David.

  • @gh05thunter
    @gh05thunter 21 годину тому

    How to use torspy package?

  • @itenthusiast5988
    @itenthusiast5988 21 годину тому

    7 years of learning about IT networking and various topics like these but nobody explained it simply amazing like you did in a minute thank you it will help me for my interview.🎉❤

  • @IFUKYK
    @IFUKYK 21 годину тому

    You need a fing box for this

  • @kichini275
    @kichini275 21 годину тому

    Custom roms are brilliant. The only issue I ran into was that banking apps didn't work.

  • @StijnHommes
    @StijnHommes 21 годину тому

    And that is why you turn bluetooth off.

  • @CentralBase
    @CentralBase 22 години тому

    I have been using Fing for awhile now. Good stuff!

  • @ProfessorLinux
    @ProfessorLinux 22 години тому

    Love this content. 🔥🔥

  • @Securiosity
    @Securiosity 22 години тому

    You didn’t have to change the default adapter value in the script, you could have just used the argument -adapter …I was the one that submitted the PR (pull 21) to specify adapter it haha

    • @Securiosity
      @Securiosity 22 години тому

      If curious: pull/21 on BlueDucky Repo...

  • @dalefernandez19
    @dalefernandez19 23 години тому

    I started watching the show after seeing your videos with OTW.Really loved it so far.

  • @dinkaboutit4228
    @dinkaboutit4228 День тому

    The information is good, but "be invisible online" is pretty misleading. The truth is more like "be on a list that your ISP provides to the FBI."

  • @Arvinthhh
    @Arvinthhh День тому

    What about randomised MAC

  • @JoshuaHall-jp4jb
    @JoshuaHall-jp4jb День тому

    How do I get access to that on a s10

  • @smzaman111
    @smzaman111 День тому

    Hello, David, Like to see type1 vs type2 hypervisor pros and cons for home hacking lab.

  • @asksearchknock
    @asksearchknock День тому

    I know it’s a paid video but I’m afraid it doesn’t work the way you said and you just lost a lot of credibility. Their own FAQ says that you can’t block devices with the phone app and you need the desktop version and a paid subscription. You also need to leave the app/computer running 24x7 for it to work and it’s just a basic wireshark monitor that then uses ARP poisoning and DNS Spoofing to block devices. They used to sell an always on physical device that did the same thing and any half decent router should guard against using arp spoofing - it also only works on ip4 They suggest disabling the iOS and android privacy features because this stops them from identifying you phone based on its MAC address.. Their website has placeholders for the t&c in some places and I would not trust these guys with my network! They are trying to charge for things that are easily available for free - maybe back when they were selling the physical always on fingbox device but I’m honestly disappointed that you would promote this.

  • @JuanLopez-xc3bl
    @JuanLopez-xc3bl День тому

    Didnt Work, Failed no such directory...