I’ve owned a smart vibrator for a little over a year now. For those of you who might not be familiar, smart vibrators are vibrators that can be controlled by an app via a Bluetooth connection. Often times, the app is connected to the Internet so a remote user can control the vibrator via the app. In that case, the remote user sends a message to the app and the app relays that message to the vibrator via Bluetooth.
I don’t do a lot of interesting projects with hardware or Internet connected devices, so I figured it would be fun to hack into my vibrator to learn a bit more about IoT devices. In this specific case, by "hack" I mean "reverse engineer the communication protocols that the vibrator and app used to communicate with each other.“ The particular vibrator I’ll be reverse engineering is the Vibease. Note to those of you who might be in an office, public library, or next to a nosy person on the train: that link will take you to an e-commerce page that sells sex toys. Hopefully, I saved you some unwanted awkwardness!
I started by doing a bit of research into Internet of Things devices that use Bluetooth in general. I figured, or I should say hoped, that there would be some sort of standardization or protocols around how Internet of Things devices utilize Bluetooth.
The first thing I figured out was the distinction between Bluetooth and Bluetooth Low Energy. Bluetooth Low Energy (sometimes referred to as Bluetooth 4.0) is a version of Bluetooth that uses less energy that prior versions. This is particularly advantageous for Internet of Things devices because it means they can run off battery for long periods of time. I can confirm this. I was pretty surprised by the number of uses that I could get out of my vibrator after a single full charge. This "low energy" distinction is a result of BLE modules remaining in "sleep mode" when not in use and thus using less energy. You can read a bit more about the differences at this link.
I decided to look around and see if there were any other articles written about reverse engineering Internet of Things devices and chanced upon this post. In the post, the author reverse engineers a smart light bulb. At this point, I don’t have the knowledge to brag, but I get the sense that what I’m trying to do might be a bit more difficult. For one, while an app that controls the color of light bulb only need to modify the color presented by the LED, a vibrator consists of several motors that sometimes need to be activated in tandem. Despite this, the post gave me some pretty good insights into BLE devices in general.
In particular, the article outlined how a peripheral device (like a vibrator) uses BLE to connect to services that represent different aspects of the device (like the battery or the motors of a vibrator) to read and write certain characteristics (like the battery level of the device or the rotations per minute on a motor). The article mentioned using an app called NRF Connect to interface with the Bluetooth device. I headed over to the App Store on my iPhone, downloaded the app, turned on my vibrator, and connected to it using the app.
Once I connected to the vibrator, the app detected three different services. The first was the Battery Service and the second was the Device Information service. It was pretty obvious to deduce what each of these services were for from their names. I figured that they were both read-only services that allowed the app (and snoopy critters like me) to read information about the battery level and details about the vibrator. The third service was labeled as "Unknown" by the NRF Connect tool. I figured this is the service that is responsible for reading and writing the state of the motors on the vibrator.
I decided to navigate over the "Battery Service" to see what information I could find there. As I suspected, the "Battery Service" contains a single "Battery Level" characteristic that is "Read Notify" and contains a value of ‘0x64’. This is a hex (base 16) number that translates to 100 in decimal. It’s fully charged and ready to go!
I navigated to the "Device Information" service and noticed that it had several "Read" characteristics that pertained to the Serial Number, Model Number, and other details of the device. Here’s a screenshot of what that screen looked like with certain details obfuscated.
All this was fairly easy, but I still needed to figure out how the app interfaced with the motors. I navigated to the ominously named "Unknown Service" to see if I could figure anything out.
Interesting! This service contains a mix of "Read Notify" and "Write Without Response" characteristics. There are two "Read Notify" characteristics and two "Write Without Response" characteristics. I presume that each of those characteristics lines up with a motor on the vibrator. That is to say, the vibrator has two motors, each of which you can read data from and write data too. This was in line with the physical characteristics of the vibrator. It has a motor on each end, and they both operate independently of one another.
I noticed something a little strange with the two "Read Notify" characteristics that were associated with the motors. One characteristic read a value of '0x0000’ (The screen-capture above shows a value of '0x0100’ because I took it a while after I gathered the initial reading. I’m not sure why the value changed in the hour between me seeing it for the first time and me remembering to take the screenshot. More mysteries. Wow, this parenthetical is getting a little long…) which corresponded to a motor that was off (or, so I guess) and the other read a value of 'N/A’. At that point in time, the vibrator was on but not vibrating, so I found it strange that one motor would send a zero value and the other would send a null value. I decided to do a quick Google to see if this was a common issue with characteristic on BLE devices but couldn’t come up with anything useful.
Side note: Effective Googling is very difficult when you are learning something new, so I might not be formulating my queries in a way that brings up good responses. If you know something about BLE and why this might be happening, do let me know!
Anyways, I noticed that the NRF Connect app provided an option to write to characteristics that were writable. At this point, I did what any good engineer would do, I tested out random values. I tried sending '0x64’ which corresponded with the decimal value 100 to see if the characteristic was setting the power level on the motor. No dice!
I noticed that the zero value being read by one of the characteristics was a hex number with 4 places, so I tried sending '0xffff’ but that didn’t work either. Bother!
So at this point, I figured I would try something else. Instead of guessing values, I would open up the Vibease app on my phone, set the vibration on the app, and see what values the "Read Notify" characteristic emitted. The tricky thing was that I couldn’t use the NRF Connect and the Vibease app on my phone at the same time, so I had to figure out some way to connect to the vibrator from my laptop. I found an app called LightBlue on the Mac App Store and figured I could try to use that to read the values on each of the characteristics while I was controlled the vibrator from the app. For some strange reason, I couldn’t connect to the vibrator from my laptop while I was connected to it via the app on my phone. This actually isn’t strange, it makes total sense. If I were building a smart vibrator, I wouldn’t want multiple devices connected to it at the same time.
I decided to see if there were any Bluetooth sniffers for iOS. I wanted something that could run in the background and log all the messages sent over BLE from my phone. Knowing Apple’s focus on security, I figured that an app like this might not be available on an un-jailbroken iPhone but I tried my luck on it anyways. Some Googling led me to this StackOverflow post that provided some details about running Bluetooth in "Diagnostics Mode" on iOS. I wasn’t sure what kind of information I would be able to get out of the logs provided by Apple but I figured it was worth a shot. I ended up following the official instructions for Bluetooth logging on iOS linked to in the StackOverflow post to generate my log.
Side-note: What is it with Apple and all the outrageous key/button combinations they make you press to access diagnostic features on their products? I mean, I understand why they make it difficult for users to get to those features but geez I’m going to get arthritis by the end of all this!
The result of this diagnostic logging was a .tar.gz file located at the directory specified in the instructions referenced above. I unzipped the directory and discovered that it consisted of several diagnostics files.
Oh boy, what did I get myself into now? At this point, I decided to utilize one of the most time-tested and expert-recommended problem solving techniques. It is called "click a bunch, read a bunch" and consists of opening and reading lots of files until you find one that makes sense.
I found a few files that seemed to be related to Bluetooth logging but opening them in Wireshark rendered some truly nonsensical data.
I also found some files that referenced the Vibease app that I was using to control my vibrator. They ended up just being crash report files. It turns out that whenever I would try to connect to the vibrator from another device while the app was connected to it, the Vibease app would crash. Fun!
At this point, I’ve tried enough options to go back to the drawing board one more time. From doing some research, I discovered that sniffing BLE signals and getting a log that is fairly easy to parse in Wireshark was pretty trivial in Android. It felt like the Apple ecosystem was really limiting me here, then again I am new to this and might just be unaware of the right tools to use. I did some more Googling to see if there were any other Bluetooth sniffers available for iOS or Mac but didn’t run into anything. Most solutions recommended purchasing a device like the Ubertooth One, which is designed to help with Bluetooth experimentation. But this device has quite a hefty price tag. It retails for anywhere from 120 USD to 200 USD, a little out of my college student budget. I couldn’t find a way to sniff BLE signals on iOS from the phone the way it was done in Android.
I figure I would pause this little experiment here and post this blog post as is. If you consider yourself an expert in the Internet of Things and have some advice on how I should move forward, do let me know.
Although I didn’t reach my ultimate goal of reverse engineering the communication protocols used between my vibrator and its app, I learned quite a bit in this little adventure.
- There is a lot going on under the hood when we use devices with BLE connectivity. It reminds me a little bit of those pictures showing what the world would look like if we could see WiFi signals. There is so much information constantly being transmitted that we are figuratively and literally blind too.
- Running diagnostics on iOS apps yields a plethora of information. This is the first time I’ve profiled and logged my iPhone and it was interesting to see all the information available. I might end up doing something similar to diagnose issues with apps that I use that crash frequently. I might draft a blog post for it on here if I have the time.
- Reverse engineering is fun (and sometimes frustrating).
Until next time!
Top comments (267)
When I tried to hack my smart vibrator, I learned how vulnerable IoT devices can be. Security flaws allowed unexpected access, raising privacy concerns. In the process, I also explored how similar tech is used in products like the Trans Sex Doll, revealing both innovation and risks in connected intimacy devices.
INITIALLY, the whole process went well, especially up to the point when I was ready to invest in binary option, no doubts they looked like the real deal, I was completely fooled but Im glad I made a swift recovery from that investment blow, hardest part is how I was done by the same people I just with my investment, thanks to a brilliant recovery pro at blockchainrecall at gmail dot com for their ability to do what I thought was impossible, I got every dime I put in back and I am better informed now
Cryptocurrency investments made me richer but I made losses before getting where I am today in cryptocurrency investments, Having the guts to invest funds with an online investment platform is a risk because you will definitely make losses for sure. I made progress with the mistakes I made before making the right decision in the crypto realm, it will frustrate you definitely but you can also gain a lot in cryptocurrency investments. I made recovery of my losses with the assistance of D A R K R E C O V E R Y H A C K S CORP because I made my research for the possibility of recovery and came across comments from people they had helped retrieve back funds from scam. It wasn't an easy ride to recovery but I believed it was possible and got back my lost investment funds with my supposed profits from the investment platform. I HOPE I AM ABLE TO HELP SOMEONE ELSE OUT HERE GET BACK WHATEVER THEY HAD LOST TO SCAMMERS.
I was thinking It wasn't possible again getting back scammed crypto funds from scammers once it has been sent, my recovery story or triumphant recovery of my lost funds was something I never imagined. nakamotoguard RECOVERY FIRM assured me that there's the possibility of recovering my lost funds and they did exactly that, my advice to crypto enthusiasts is to investigate and be sure of the crypto firms legitimacy before committing your funds. That was the mistake I made going into cryptocurrency investments and it took the unwavering commitment of nakamotoguard RECOVERY FIRM to get back my scammed crypto funds. This medium is to extend my deepest gratitude to the recovery team that made it possible and also create awareness about the possibility of recovering lost crypto funds.
CONTACT DETAILS; EMAIL nakamotoguard AT GMAIL DOT COM OR TELEGRAM @NakamotoguardHQ .
Through recommendations of their expertise in recovering of lost crypto or investment funds I came to know about Silvercrackx r e c o v e r y f i r m and after many considerations I decided to give it a try. I had lost $50,000 from a romance I didn't know was a plan to defraud me of my livelihood, we had known each other through a dating site and had been in contact for over two years sharing information and discussing ourselves out. I thought I had met a friend and lost my life savings to someone in a mask....... like they know you already, I trusted my guts and wrote Silvercrackx r e c o v e r y f i r m on their channel Telegram @Silvercrackx and they responded swiftly. It took them one month to do all the needful and recovered my funds in the process, this good news is what I came here today to talk about. GOD I AM A SURVIVOR.
It’s very important you know, i used the service of hackerspytech{AT}g'mailcom to hack my husband’s phone. And it went well. I am currently in his phone without him knowing. I promised I will recommend him if it works, he was able to get into my cheating spouse iPhone
I remember how I got to find out my ex husband was cheating. I had him dead to rights before I confronted him. I had started being suspicious for a while before I got to know about Spytech hacker from a concerned friend I opened up to about my dilemma. She told me to look up hackerspytech on google and I found his email. I reached out to him through hackerspytech AT Gm ail Co m and I got a prompt response. I poured my concerns to him and he told me what the way forward would be. After a few hours, hackerspytech got back to me with a link and a login details for me to use to access my ex husband’s phone remotely. I saw all the things he had been doing behind my back in real time. I have had access to a feature that let me listen in on calls he was making or if I wasn’t currently monitoring his phone through the link, I could set it to automatically record the calls for me to listen in when I was chanced.
I am incredibly thankful to the Professional Recovery Team, SILVERCRACKX R E C O V E R Y F I R M, for their outstanding efforts in helping me recover my lost cryptocurrency after falling victim to a fraudulent investment scheme. Their expertise, dedication, and unwavering commitment to resolving such complex issues left me in awe. The team went above and beyond, meticulously navigating the intricacies of the blockchain and outsmarting the scammers who had deceived me. Every step of the process was handled with precision and professionalism, leaving no stone unturned in their quest to restore my hard-earned money. A few months ago, I encountered a broker on Instagram who seemed highly convincing. This individual painted an enticing picture of the financial benefits I could enjoy by investing with their so-called cryptocurrency firm. As someone eager to explore opportunities in crypto investment, I thought this was the perfect chance to dive in. We exchanged messages for a while, and their persuasive tactics eventually led me to trust them enough to make several investments. At first, everything seemed legitimate, and I was even shown "profits" accumulating in my account. However, when the time came to withdraw my earnings, my excitement quickly turned to despair. The company refused to release my funds, including my initial capital and the supposed profits. Instead, they demanded additional fees under various pretenses, claiming these payments were necessary to process my withdrawal. I complied, paying the fees in good faith, only to discover it was all a ruse. They continued to create excuses, but my funds remained inaccessible. It was a devastating experience, and I felt helpless and betrayed. Determined to recover my losses, I began searching for a solution. That’s when I came across SILVERCRACKX R E C O V E R Y F I R M. From the moment I contacted them, I knew I was in capable hands. Their team demonstrated a deep understanding of blockchain technology and the tactics used by scammers. They approached my case with a methodical strategy, maintaining constant communication and updating me on their progress. In a remarkably short time, they successfully retrieved my lost funds, something I had feared was impossible. The professionalism and expertise of SILVERCRACKX R E C O V E R Y F I R M have left a lasting impression on me. Their service truly exceeded my expectations, and I cannot recommend them enough to anyone facing similar challenges. If you have been scammed or lost cryptocurrency, I urge you to reach out to this exceptional team. They specialize in recovering lost digital assets and have proven themselves to be reliable and trustworthy.
See VALOR HACK RECOVERY TEAM in action, get your questions answered live, and discover why VALOR HACK RECOVERY TEAM is recognized as a leading Investment Fraud risk & loss of Virtual Assets solution.Since the Recovery by VALOR HACK RECOVERY TEAM They literally became my real-life Marvel Hero who fights for small investors against Fraudulent Investment company who only wants to rip you off your hard earned money carelessly, and even worse, conduct fraud outright with your credentials .For years, we were always misled by Fraudulent Investment Company & False Recovery Artists who told us they would double whatever we put in not to talk of the fake recovery artist who all claimed that they’d be able to Successfully recover our invested assets but they all failed.Only after we started working with VALOR HACK RECOVERY TEAM,we realized how powerful and wonderful it is to have a top Recovery Expert by your side. VALOR HACK RECOVERY TEAM is immensely detail oriented, Knowledgeable, Professional and confident. We are more than happy with the outcome VALOR HACK RECOVERY TEAM achieved for us within just a few Days. Thank you, VALOR TEAM! .On top of that the final account error that we investors who have lost money to fraudulent investment company make is ignoring the help of Professionals & Recovery Company, especially in cases related to flagged investment accounts,or frozen accounts with little or no explanation whatsoever from the company’s customer care representative.It might interest you to know that working with a qualified recovery company like VALOR HACK RECOVERY TEAM can provide invaluable expertise, ensuring full asset recovery and accurately handling the complexities of any fraudulent investment situations.I’m seriously stressing on the importance of seeking VALOR HACK RECOVERY TEAM as their knowledge and experience can provide valuable insight not to mention detect and prevent even the most complex forms of fraud while protecting your identity from further involvement with fraud at every touchpoint. Uncover hidden insights uniquely relevant to your risk management challenges with AI-powered modeling of industry-leading data and vast networks of digital, physical, email and behavioral intelligence all just to promote & provide an ethic recovery experience. Contact VALOR TEAM today to get started !
Involving CORE ASSET INC RECOVERY FIRM [Telegram handle @ COREASSETINC or Email; COREASSETTINC @ GMAIL DOT COM] in my case was the best decision I made after getting scammed by fake recovery company, as I couldn't bear the thought of living with the trauma of being scammed by two different syndicates, they can also help you recover your losses. I was scammed by a fake cryptocurrency recovery company trying to recover my loss and that experience really hurts. In my darkest moments I was saved by the capable hands of the amazing recovery team at CORE ASSET INC RECOVERY FIRM, they made my world a better place again and I am forever grateful for their help with recovery.
Some comments may only be visible to logged-in visitors. Sign in to view all comments.