Lego NXT Exploitation and Vulnerabilities?

Question

First, I wasn't sure if I should post this on the Lego Stack Exchange site or here, and I decided this site had more to do with the question (I hope I don't get bad rep for this). OK, my friends and I have Lego NXT sumo bot competions for fun. Basically, you build a robot that waits five seconds and competes against a robot to stay on a board. We normally focus on the mechanical side to win against other robots (find them and push them off the board), but I had the idea to try a software attack. My idea was too:

1. Find some sort of Bluetooth vulnerability that I could exploit from another NXT (I write my programs in NXC).
2. Upload a malicious program that makes the robot drive backwards forever.
3. Somehow execute the program(and win!).

I have tried testing the NXT Bluetooth for vulnerabilities (I have knowledge of Windows/Linux exploitation and debugging) and I can't find anything. The main problem is that the NXT firmware handles Bluetooth connections, in other words you connect the devices with a pass code before running the program that requires Bluetooth. So, my questions are:

• Is this even slightly possible or a waste of time?
• If there was a NXT Bluetooth vulnerability, could I even send it from another NXT that's not connected?
• Was this the right place to post this question?
• Would NXT debugging even be possible?

Update First, thanks for all of the ideas and answers. Secondly, several of the answers note about the legality of what I am trying to do. Yes, it is legal where I live. Third, I talked with main guy and judge of the competition and he said that he would love to see a software attack like this.

Where I'm at now I have Kali Linux and the mac address has been found. I also found a paper here on the control protocols. The main dilemma I am still facing is the fact that a Bluetooth passcode has to be entered on the device I intend to connect to. Any updates will be posted here!

Answer 1

Two primary concerns: If your competition is with a formal organization/people who are "friends" but you never drank beer together, then for starters you want to see if this is even legal in your country. In the ole' US-of-A as this could be in violation of the CFAA, but I'm not a lawyer. Also, would this disqualify you from the (informal) competition?

Second, think about it: the following (cheeky) attack is notoriously hard to defend against and would require you and your friends changing your pairing codes immediately before AND after each match IN PRIVATE, which is a pain.

With that aside, there are quite a few ways to compromise the enemy team with features, not bugs :D Why go through the trouble of fuzzing the NXT's bluetooth stack and seeing if it has a JTAG port for you to debug it when you can do it the easy way? For instance, before the match starts (if they already have their NXT on and are in range) you can pair to it, browse its saved connections and control their NXT, their robot AND yours! Or just directly pair to their robot. However, you need the pairing code!

To perform this attack, you absolutely need a device that you can sniff (high-speed) bluetooth traffic with. A software defined radio like hackRF comes highly recommended because its one of the only bluetooth devices I know that can capture high speed bluetooth data packets. These are the steps I would take to exploit an enemy team's lego NXT or robot:

For Steps 1-4, try it out on your own devices first, NOT theirs. Its always best to have a "dry" run (steps 1-4) before the "live" run (against their NXT/robot in step 5).

1. get Kali linux, as most of the tools comes with the image
2. Use bluesniff/blueScanner/etc. to grab the devices' address (looks like a mac address)
3. From there, use bluesnarf to send custom ([-c]) commands. In this case, they would adhere to the Lego NXT Communication Protocol LCP specification. Or, you could use bluesniff, log/save the bluetooth packets and use crackle to crack your pairing code
4. OPTIONAL: the normal LCP commands you would send to your robot from your Lego NXT kit can probably be replayed, so I would try to sniff and replay them first using bluesnarf and a SDR.
5. Once you figure out the format of the bluetooth commands sent to the Lego NXT, now is the time to finish reconnaissance/enumeration.You'll want to go to one of your enemy team's previous matches and perform the former steps (obtain their NXT's/robot's address, sniff with your SDR, log/save the bluetooth packets) and use crackle to crack their pairing codes.

Armed with the enemy team's pairing codes, knowledge on how to send custom LCP commands via SDR and/or bluesnarf, in the next round you should be able to cheat quite a few different ways:

1. Make their robot play Frogger: Pairing with the enemy team's NXT device as a master (it being a slave) and edit the NXC script that gets pushed via bluetooth to their robot
2. Lock 'em out: Change their pairing code for their robot at the beginning of the match
3. BONUS: Use what you learned regarding LPC and the SDR to write a lightweight bluetooth fuzzer that sends bluetooth data to the NXT or robot. More than likely you'll need a JTAG debugger. Bonus points if you can find a Remote Code Execution (RCE) vulnerability in the NXT's bluetooth stack that you can leverage to to draw Pikachu to their NXT's screen

Answer 2

I don't know which version of NXT you are using, since I'm not experienced with 3.0, but if you have a 2.0 brick you are able to install a custom firmware which would allow you to code in different languages.

There are two main cfw, one allows you to program in java and the other one in C.

From here I would suggest you to install RobotC because it's quite powerful; while you can run standard lego binaries (the ones created with the block ide) you have the power of C.

From there, you should read the RobotC docs and learn the API used for bluetooth, and from there, try to implement a public exploit (if exists) or develop your own.

My opinion is that it would require lots of time and probably the bluetooth protocol is secure (not in the way it is not safe (cause it isn't and traffic can be sniffed), but I think it's difficult to achieve code execution on the remote lego)

Also, take a look at stack smash vulnerabilities.

EDIT: Also consider using those technics in a competition may be ilegal, and in your country it can be ilegal also to search for vulnerabilities.