1

I recently got a UE Megaboom Bluetooth speaker. Apart from various audio profiles, I noticed the speaker also exposes a Serial Port BT profile. I suspect this is the channel the app uses to control the speaker’s advanced features.

I have tried to connect to the port using a terminal app, using various baud rates and sending it ?<CR><LF> and AT?<CR><LF>, respectively—to no avail. The speaker will not return a single bit of data.

A web search on the most common terms did not return any useful information on the protocol used.

Is there any information out there on the protocol used by the Megaboom? Or does anyone know of any attempts at decoding it?

I now have some captured traffic from the official app. BTW, if another device is holding the serial port connection, the app will not recognize the speaker, corroborating my suspicion that SPP is the control channel.

In two captures I see that initially the app sends 02 00 06 (hex) over the SPP connection, to which the speaker responds with <CR><NUL><BEL>MEGABOOM (three control characters followed by the product name as a string).

When I connect to the speaker’s SPP and send these three characters (using moserial, sending input as hex), the speaker does not respond at all. Any ideas?

|improve this question
  • do you have an app or something that can communicate with it over Bluetooth? – Igor Skochinsky♦ Jan 7 at 8:34
  • @IgorSkochinsky There is an Android app for it, but it is proprietary and I don’t want to run it on my phone. At the most I could run it in an Android VM on my PC, but I would need the VM to establish a BT connection and capture the serial traffic. – user149408 Jan 7 at 14:24
  • Hi and welcome to RE.SE. I think Igor was trying to ascertain if there is some code out there that uses said protocol. And since you confirmed there is, it's probably a good idea to perform some static RCE on it. With static RCE you need not run the target anywhere (neither your phone nor a VM), but it has its limitations. Still, it would give a first clue as to whether that target is a worthwhile one in terms of RCE efforts. – 0xC0000022L♦ Jan 9 at 10:42
1

If the device doesn’t respond to unsolicited traffic, it probably needs some specific commands to return results. You could try bruteforcing it by sending random data but it’s a chancy business.

A more likely approach is to sniff the traffic from the official app or at least try to analyze it statically.

|improve this answer

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.