黑基网 首页 资讯 安全圈 查看内容

ofo 小黄车又遭黑客破解:这次只需一部手机

2017-11-10 18:38| 投稿: xiaotiger |来自: 互联网

摘要: 前段时间一篇《破解 ofo 最新款锁》的文章引起了我的注意,说的是百度安全研究员通过使用特殊的工具劫持了锁和云端通信的信号来破解单车锁(详见雷锋网报道《劲爆:OfO小黄车最新款锁被破解,影响千万共享单车|黄正 ...

前段时间一篇《破解 ofo 最新款锁》的文章引起了我的注意,说的是百度安全研究员通过使用特殊的工具劫持了锁和云端通信的信号来破解单车锁(详见雷锋网报道《劲爆:OfO小黄车最新款锁被破解,影响千万共享单车|黄正独家揭秘》)。身为同是共享单车智能锁开发的工程师,我看过文章之后也萌生了想法:能不能用更简单的方法,对 ofo 小黄车最常见的天王星锁进行一次破解?

我们最常见的 ofo 小黄车锁——天王星,是一款集合 GPRS 、密码、蓝牙模块的锁具,我尝试从这款锁蓝牙开锁的入手,使用 Android App 和常见的 Android 抓包工具达到破解的目的。

使用蓝牙开锁的原理

用户扫码后,手机 App 会向服务器发送开锁请求,随后服务器把蓝牙信息发送回手机,手机 App 通过蓝牙把这些信息发送给锁达到开锁目的。整个过程里面,用户的手机充当着一个中间人的角色,连接服务器与单车。

比说,我想传纸条给坐得比较远的同学但是又够不着,只能给隔壁的同学递过去。手机 App 扮演的就是在我们传纸条的过程中隔着的那位“中间人”的角色。

手机充当中间人的角色

破解,从官方 App 入手

要从蓝牙开锁的方式破解这款锁,第一步需要知道它的蓝牙协议,说白了是要知道设备和云端之间是怎样沟通的。我获取ofo蓝牙协议的方式,仅仅是简单地下载其官方 Android app,再用上合适的工具。

有个简单的方法:Android 4.3以上的手机都有一个记录蓝牙日志的选项,只要我们勾选,系统会记录某个接口中所有的活动记录,ofo 的蓝牙开锁所有的读写操作也会被记录下来。然后我们分析导出的日志文件,就能分析出上面 ofo 蓝牙开锁的协议。

手机上的“万能钥匙”

我们发现 app 开锁之前需要和锁进行认证才能顺利打开。这段认证码我们叫做 token。这里的 token 可以简单的理解为共享单车上每辆车的一个电子密码,手机获得这个密码之后用蓝牙发送到单车锁就可以完成开锁。

关于获取 token 我有两个思路,一是通过监听 app 和 ofo 服务器的开锁交互,进而截获出每辆单车编号相对应的 token;二是通过记录手机和锁之间的蓝牙日志,获取到开锁 token。这两个方式都可以获取单车编号对应的 token。

打个容易理解的比喻,我们传统的写信寄信,把信件送到目的地必须通过邮差把信送达,我们要想截获信件的内容必须在邮差取信或者送信之间做手脚。在这次破解的过程里面,手机 App 扮演的是邮差的角色,我们通过在“邮差”取信前截获 token,或者在“邮差”送信到达前截获 token。

每使用一辆单车,我都可以把这辆车对应的 token 截获并记录下来,以后再使用同一辆车就不再需要向服务器请求 token,做到直接解锁。不需要很长的时间,我就可以获取到某一区域所有单车的 token。更极端地,我甚至可以找不同的渠道按编号发出请求,获取 token 并记录,建一个单车锁 token 数据库,集成到一个手机 App 中。

前面提到,我们已经获取了 ofo 小黄车的蓝牙协议,加上能够获取单车编号对应的token,这样,破解就不再需要随身带什么专业的设备,现在只需要在手机上装上我集成好的破解 app ,就能破解上千万辆带天王星锁的 ofo 单车,相当于在手机上安装了 ofo 天王星锁的“万能钥匙”。

不仅如此,我还可以通过一些方法,在自己的破解软件添加一键开锁的功能,只需要一次操作就能开附近所有带天王星锁的 ofo 单车。

修复有一定难度

要想修复,现在有三种做法:一是更新 ofo 小黄车的蓝牙协议,这需要对每辆车进行动态的固件更新;二是每辆单车的开锁 token 进行每次开锁的动态变换;三是重新设计开锁逻辑,采用手机透传,在锁和服务器端加密的方式去阻止协议暴露和避免中间人攻击,这也是目前我们采用的做法。

相比之前曝光过的使用劫持信号来破解车锁的方法,这次的破解更为简单,我们在手机上装一个破解软件就能达到破解的目的,不需要昂贵的专业设备,不需要特殊的工具。我这次的破解已经向 ofo 相关职员进行反馈。

物联网有两大要素,一是连接,二是安全。市面上很多共享单车商家对连接这一部分下了不少功夫,但对其安全性方面有所欠缺,没有足够重视。

从共享单车行业发展初期,我们就一直在关注共享单车的安全性问题,除去这次的破解 ofo天王星车锁外,我也用同样的原理破解了市面上一系列的共享单车车锁,包括小鸣单车、优拜单车、酷奇单车。

不知攻,焉知防。作为同是共享单车方案商的我们,自然不是为破解而破解,而是在破解这些车锁的过程中不断学习,希望在一次次的破解中寻找更好的做法,不断提升自己产品的安全性。

, groupId: 6486274904839684621, itemId: 6486274904839684621, type: 1, subInfo: { isOriginal: false, source: 互联网科技知识, time: 2017-11-09 12:59 }, tagInfo: { tags: [{"name":"软件"},{"name":"黑客"},{"name":"蓝牙"},{"name":"自行车"},{"name":"云计算"}], groupId: 6486274904839684621, itemId: 6486274904839684621, repin: 0, } }, commentInfo: { groupId: 6486274904839684621, itemId: 6486274904839684621, comments_count: 8, ban_comment: 0 }, mediaInfo: { uid: 1274647765, name: 互联网科技知识, avatar: //p3.pstatp.com/large/12330002b21317204346, openUrl: /c/user/1274647765/, follow: false }, pgcInfo: {"media_info":{"open_url":"/c/user/1274647765/","avatar_url":"https://p3.pstatp.com/large/12330002b21317204346","media_id":1553225055029250,"name":"互联网科技知识","user_verified":false},"articles":[{"item_id":"6486274904839684621","url":"/item/6486274904839684621","title":"ofo 小黄车又遭黑客破解:这次只需一部手机"},{"item_id":"6485867897288655373","url":"/item/6485867897288655373","title":"这个应用能够让iPhone X的刘海“消失”"},{"item_id":"6485865917510058510","url":"/item/6485865917510058510","title":"受英飞凌ROCA漏洞影响 爱沙尼亚停用76万张公民身份证"},{"item_id":"6485153992241316365","url":"/item/6485153992241316365","title":"有没有想过,你的数据分析方法可能已经过时?"}]}, feedInfo: { url: /api/pc/feed/, category: __all__, initList: [{"comments_count":227,"media_avatar_url":"//p3.pstatp.com/large/433200046c3b31c913fa","is_feed_ad":false,"is_diversion_page":false,"title":"让一个黑客告诉你网络赌博有多坑!","single_mode":true,"gallary_image_count":5,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6486511600835494414/","source":"黑客与极客的世界","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":7,"image_url":"//p3.pstatp.com/list/190x124/438700040eb5b295aafc","group_id":"6486511600835494414","is_related":true,"media_url":"/c/user/73563585433/"},{"comments_count":465,"media_avatar_url":"//p1.pstatp.com/large/4338000164d26b0d0b8d","is_feed_ad":false,"is_diversion_page":false,"title":"新型手机病毒出现,支付宝,银行卡钱都不见了","single_mode":true,"gallary_image_count":6,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6485717271028171277/","source":"雨韩","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/43790003e53915c9e852","group_id":"6485717271028171277","is_related":true,"media_url":"/c/user/72350474839/"},{"comments_count":31,"media_avatar_url":"//p1.pstatp.com/large/ef6001811f6f7242068","is_feed_ad":false,"is_diversion_page":false,"title":"摩拜创新升级路赢得认可 周活跃用户量超滴滴、ofo居行业领先","single_mode":true,"gallary_image_count":3,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6486366343527399950/","source":"新IT时代","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/438900030e377b4bf4a6","group_id":"6486366343527399950","is_related":true,"media_url":"/c/user/50223792527/"},{"comments_count":61,"media_avatar_url":"//p3.pstatp.com/large/13530014660095635f39","is_feed_ad":false,"is_diversion_page":false,"title":"想双十一提前收到快递?手机百度支招请收好","single_mode":true,"gallary_image_count":8,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6486344347049525773/","source":"未来的生活","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p9.pstatp.com/list/190x124/43880002ba3b75e8f016","group_id":"6486344347049525773","is_related":true,"media_url":"/c/user/54456806787/"},{"comments_count":4,"media_avatar_url":"//p2.pstatp.com/large/1dcf0029aa0681511769","is_feed_ad":false,"is_diversion_page":false,"title":"让最好的应用程序来帮你做最棒的手机摄影!","single_mode":true,"gallary_image_count":20,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6485883591510196750/","source":"风中的摄影","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":1,"image_url":"//p1.pstatp.com/list/190x124/438100009205eaeca284","group_id":"6485883591510196750","is_related":true,"media_url":"/c/user/6354214978/"},{"comments_count":23,"media_avatar_url":"//p2.pstatp.com/large/434b00002e38b32da93d","is_feed_ad":false,"is_diversion_page":false,"title":"24小时就众筹到1千万,全球首款人工智能门锁面市,门锁界iPhoneX","single_mode":true,"gallary_image_count":12,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6485193159272825357/","source":"让科技飞","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/31c0000201152745ed00","group_id":"6485193159272825357","is_related":true,"media_url":"/c/user/53110643552/"},{"comments_count":61,"media_avatar_url":"//p2.pstatp.com/large/3e640002dc4463a96710","is_feed_ad":false,"is_diversion_page":false,"title":"ofo戴威惊艳亮相APEC大会 新兴企业成为中国创新名片","single_mode":true,"gallary_image_count":4,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6486375741242999310/","source":"电商之窗","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p9.pstatp.com/list/190x124/438b00013a783eab178f","group_id":"6486375741242999310","is_related":true,"media_url":"/c/user/3580503296/"},{"comments_count":492,"media_avatar_url":"//p3.pstatp.com/large/2b700228cef434c8ac3","is_feed_ad":false,"is_diversion_page":false,"title":"腾讯重锤出击!如果你还在这样,将遭到封号处理","single_mode":true,"gallary_image_count":5,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6486418564281532941/","source":"科技之窗","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":3,"image_url":"//p9.pstatp.com/list/190x124/43880003bea3b8546177","group_id":"6486418564281532941","is_related":true,"media_url":"/c/user/1747489223/"},{"comments_count":35,"media_avatar_url":"//p1.pstatp.com/large/11455/736374640","is_feed_ad":false,"is_diversion_page":false,"title":"Trustdata报告:小玩家渐渐退场 ofo稳居第一用户增速远甩摩拜150%","single_mode":true,"gallary_image_count":2,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6486338639264481805/","source":"科技怪咖","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/438b0000a197d89a5547","group_id":"6486338639264481805","is_related":true,"media_url":"/c/user/5862389361/"},{"comments_count":25,"media_avatar_url":"//p10.pstatp.com/large/39fa000446817cd87c98","is_feed_ad":false,"is_diversion_page":false,"title":"绝地求生服务器又炸了!19分钟修复了!这次有大团队在后台支持?","single_mode":true,"gallary_image_count":3,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6486335785267102221/","source":"游戏精彩分享中心","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":1,"image_url":"//p9.pstatp.com/list/190x124/43860002819235c998ca","group_id":"6486335785267102221","is_related":true,"media_url":"/c/user/5466191184/"},{"comments_count":0,"media_avatar_url":"//p8.pstatp.com/large/3b120003d240a678f54b","is_feed_ad":false,"is_diversion_page":false,"title":"Android蓝牙开发遇到问题?不伤心,本文为你提供了详细解决方法","single_mode":true,"gallary_image_count":2,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6485192066476278286/","source":"昇润科技","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/4371000197b52cba3343","group_id":"6485192066476278286","is_related":true,"media_url":"/c/user/6251877949/"},{"media_avatar_url":"//p3.pstatp.com/large/d2a000b0a735ac9aae7","is_feed_ad":false,"is_diversion_page":false,"title":"Spring Cloud中如何保证各个微服务之间调用的安全性","single_mode":false,"gallary_image_count":0,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6485974016023593486/","source":"猿天地","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"comments_count":4,"group_id":"6485974016023593486","is_related":true,"media_url":"/c/user/6157848926/"},{"comments_count":15,"media_avatar_url":"//p6.pstatp.com/large/2c68001087e0ac87f0bf","is_feed_ad":false,"is_diversion_page":false,"title":"快速学会使用Fiddler抓包 截包伪造提交包","single_mode":true,"gallary_image_count":16,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6485869846524330510/","source":"David","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":1,"image_url":"//p1.pstatp.com/list/190x124/4381000075f4796ce57e","group_id":"6485869846524330510","is_related":true,"media_url":"/c/user/6264582379/"},{"comments_count":20,"media_avatar_url":"//p1.pstatp.com/large/3b04000049e432723355","is_feed_ad":false,"is_diversion_page":false,"title":"大型局域网一步到位的网络管理方案","single_mode":true,"gallary_image_count":12,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6485959142337937934/","source":"笨驴技术","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/438200020fa700eb8446","group_id":"6485959142337937934","is_related":true,"media_url":"/c/user/69616059031/"},{"comments_count":1,"media_avatar_url":"//p1.pstatp.com/large/382d000af44fcdb68087","is_feed_ad":false,"is_diversion_page":false,"title":"大数据时代,身份问题到底有多么严重","single_mode":true,"gallary_image_count":4,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6485229313640628749/","source":"互联大数据","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/43710002788aa65d3d7e","group_id":"6485229313640628749","is_related":true,"media_url":"/c/user/51017016484/"},{"comments_count":26,"is_related":true,"is_feed_ad":false,"is_diversion_page":false,"title":"iOS 11.2 beta1蓝牙连接配件提醒是怎么回事?","single_mode":true,"gallary_image_count":7,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6484094357115765006/","source":"头条问答","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/435d000035c90437721b","group_id":"6484094357115765006"}] }, shareInfo: { shareUrl: https://m.toutiao.com/a6486274904839684621/, abstract: 前段时间一篇《破解 ofo 最新款锁》的文章引起了我的注意,说的是百度安全研究员通过使用特殊的工具劫持了锁和云端通信的信号来破解单车锁(详见雷锋网报道《劲爆:OfO小黄车最新款锁被破解,影响千万共享单车|黄正独家揭秘》)。
小编推荐:欲学习电脑技术、系统维护、网络管理、编程开发和安全攻防等高端IT技术,请 点击这里 注册黑基账号,公开课频道价值万元IT培训教程免费学,让您少走弯路、事半功倍,好工作升职加薪!



免责声明:本文由投稿者转载自互联网,版权归原作者所有,文中所述不代表本站观点,若有侵权或转载等不当之处请联系我们处理,让我们一起为维护良好的互联网秩序而努力!联系方式见网站首页右下角。


鲜花

握手

雷人

路过

鸡蛋

相关阅读

最新评论


新出炉

返回顶部