Slides used by Chema Alonso at RootedCON 2017 to present DirtyTooth Hack. More info at: - http://www.dirtytooth.com - http://www.elladodelmal.com/2017/03/dirtytooth-hack-its-only-rockn-roll-but.html

1. It’is only rock and roll
but I like it
@CHEMAALONSO

2. Win a spotify premium quemandospotify
• Rules
• Play a song in spotify
• Need to have an iphone
• Get the biggest applause
• Be part of a real live demo
• Be a rock and roll star
• Accept all consequences
• No reggaeton allowed
• Hashtag quemandospotify

3. Connected iphone “the final countdouwn
GSM/GPRS/UMTS/EDGE
/3G/4G
WiFI/BlueTooth/NFC*
Apps
Voice Control & Siri
iTunes at
Windows/OSX/Linux
Jailbreak
iCloud Physical Access /
Juice Jacking

4. Planet domination world tour
Versión Año aparición
Bluetooth v1.0 1999
Bluetooth v1.1 2002
Bluetooth v1.2 2003
Bluetooth v2.0 + EDR 2004
Bluetooth v2.1 + EDR 2007
Bluetooth v3.0 + HS 2009
Bluetooth v4.0 2010
Bluetooth v5.0 2016-2017

5. Bluetooth Profiles?born to be my baby

6. Bluetooth Profiles?life loves a tragedy
• Audio:
• A2dp ( advanced audio distribution profile
• Avrcp audio video remote control profile
• HSP headset profile
• HFP Hand free profile
• others
• PBAP Phone book access profile
• Pan Personal area network
• Hid human interface device
• Map message access profile

7. Bluetooth Profiles (in iOS) Bohemian rapsody
Dispositivo HFP 1.6 PBAP A2DP AVRCP 1.4 PAN HID MAP
iPhone 4 y posterior Sí Sí Sí Sí Sí Sí Sí
iPhone 3GS Sí Sí Sí Sí Sí Sí -
iPhone 3G Sí Sí Sí Sí Sí - -
iPhone Original Sí Sí - - - - -
iPad 2 y posterior Sí - Sí Sí Sí Sí -
iPad (1ª Generación) - - Sí Sí Sí Sí -
iPod Touch (4ª
Generación)
Sí - Sí Sí Sí Sí -
iPod Touch (2ª y 3ª
Generación)
- - Sí Sí Sí Sí -

8. Song 1: who I really am
looking like a2dp with no pariring token

9. Song 1: who I really am
looking like a2dp with no pariring token

10. Song 2: what about now?
PBaP default configuration

11. Song 3 let me in your heart again
access to phonebook in android

12. Videoclip: 1
rage against the machine
https://www.youtube.com/watch?v=9IrvKsaCmeI

13. Song 4:say something I am giving up on you
your profile changed and nothing happened

14. Videoclip: 2
nothing else matters
https://www.youtube.com/watch?v=nxxFySuKYpg

15. Lyrics 1nothing else matters
your profile changed and nothing happened

16. DirtyTooth: Rogue BT Speaker

17. DirtyTooth: Rogue BT Speaker

18. Videoclip: 3it is only rock and roll
https://www.youtube.com/watch?v=hy31Xin94tw

19. DirtyTooth: Rogue BT Speaker
debug Mode

20. Song 5 you give me all your love tonight
vcards , calls history who you are

21. Backstage DirtyTooth:VIP Contacts)

22. Backstage DirtyTooth: vip Call History

23. DirtyTooth (OSINT data enrichment)

24. Videoclip: 4 but I like it
https://www.youtube.com/watch?v=4UfAco75w80

25. Extra song
• Hack works with other bluetooth profiles
• MAP has not auto sync
• Writing Vcards
• Play it in iPhone 3g to iPhone 7 Plus
• Play it in iOs 10.2.1 and earlier
• Osint Personal and Professional relationships
• What about wifi
• What about Location with GPS,IP BT Power celltower

26. Band Credits
• Chema Alonso Vocals
• Pablo gonzalez guitar
• Ioseba Palop Bass
• Jorge rivera Drums
• Alvaro nunez-romero flaut
www.dirtytooth.com