"Encrypted packet decrypted incorrectly (bad MIC)" - how to get LTK

[ilker Aktuna]

Hi,

I am trying to sniff between my phone and a BLE device.

When I put the device in pairing mode, I can see it in the "advertising" list. Then I select it (but I don't know if I should select anything from the "legacy passkey", "legacy ltk", "follow le address") 

I can see packets from/to that device.

Then I make the pairing on my phone (no PIN is required)

But then I can't get any data , all is encrypted and all I see is "empty PDU" or "Encrypted packet decrypted incorrectly (bad MIC)"

What is the correct method ?

As far as aI remember from my past experiences, if I sniff within the pairing session , I should not need a LTK.

But if LTK will help, can you guide me how to get the LTK ?

Btw, if I do the pairing, I no longer see the device in "advertising" list. If I get the LTK and try to sniff after pairing, how do I filter that device ?

[billtsai]

Hi,

If your device has no lesc, then you can sniff LTK in pairing process.

Otherwise, you need a LTK to decrypt packet.

LTK will store in flash if you use bonding.

But you need to provide which sdk you use.

[ilker Aktuna]

thanks for your response. But I am not a professional and the terms you use  , I am not familiar with them.

"if your devişce has no lesc" -> what is lesc , and how do I know if my device has lesc ?

"then you can sniff LTK in pairing process" -> how can I do that ?

"which sdk you use." -> I don't know. I have a laptop with Wireshark installed and 2 years ago I had installed extensions to sniff using nRF52840. I had followed official guides that time. But I'm not sure where the guide is now.

[billtsai]

Nordic has two general sdk now.

NCS SDK : https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/index.html

nRF5x SDK : https://developer.nordicsemi.com/nRF5_SDK/

Lesc is low energy secure connection. This function can be enabled or disabled by your application code.

Sniffer will auto get LTK throung pairing process if you use just work and without lesc.

You can attach your sniffer log, that will show more information.

[ilker Aktuna]

I am not sure if I'm using any of these SDKs because I am not developing anything. I am just using the sniffer to understand the traffic.

I am attaching the capture from sniffer. Maybe you can help me extract the LTK from this capture.

Which packet should I look at ? And then how to format the LTK and use it for other sniff sessions ?

I am also attaching a sreenshot of my Wireshark screen so that you can tell me what option to use on Wireshark.

https://tmpfiles.org/10219552/mb.cap

Thanks

[billtsai]

I can't download your file.

You can refer to my sniffer file. My wireshark version is v4.0.6.

In packet 2134, the device responses host that device does not support secure connection. 

In packet 2433, the device sends LTK to host. 

You can use the same method to find more information.

desktop_dfu_sniffer_log.pcapng

[ilker Aktuna]

mb.pcapng

Can you please check this file ? My sniff session is not like your example.

[ilker Aktuna]

this traffic is between a BLE device and an app on Android phone.

Probably the app has an hardcoded LTK and without it I won't be able to decrypt the traffic for investigation.

Would it be possible to get the LTK on the Android phone ? Is it possible to sniff on the phone itself and get an unencrypted trace ?

[Amanda Hsieh]

Hi, 

Please check out Exercise 3 Follow and decrypt a paired connection in the Bluetooth Low Energy Fundamentals course (which is highly recommended).

-Amanda H.