Answers.Body: <p>I think that most sumo bot competitions do not allow interchange of information between bricks. And you have to connect via Bluetooth with your opponent's bot, which requires your opponent's permission.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-04-26T13:11:36.887Z
Answers.Text: I asked the person in charge of the sumo bot battles and he said he would love to see this attack work. @GeromeAng Thats what I am trying to overcome. If the opponents bluetooth is on, I want to exploit it and be able to control it.
Answers.UserDisplayName: Starwarsfan2099
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-04-26T07:54:54.447Z
Answers.LastActivityDate: 2016-04-26T15:29:20.597Z
Answers.LastEditDate: 2016-04-26T15:29:20.597Z
Answers.UserDisplayName: Gerome Ang
Body: <p>I originally posted this question on the Reverse Engineering site, but there were no answers. They told me to also post this question here. OK, my friends and I have Lego NXT sumo bot competitions for fun. Basically, you build a robot that waits five seconds and competes against a robot to stay on a board. We normally focus on the mechanical side to win against other robots (find them and push them off the board), but I had the idea to try a software attack. My idea was to:</p>
  
  <ol>
  <li>Find some sort of Bluetooth vulnerability that I could exploit from another NXT (I write my programs in NXC).</li>
  <li>Upload a malicious program that makes the robot drive backwards forever.</li>
  <li>Somehow execute the program (and win)!</li>
  </ol>
  
  <p>I have tried testing the NXT Bluetooth for vulnerabilities (I have knowledge of Windows/Linux exploitation and debugging) and I can't find anything. The main problem is that the NXT firmware handles Bluetooth connections, in other words you connect the devices with a pass code <strong>before</strong> running the program that requires Bluetooth. So, my questions are:</p>
  
  <ul>
  <li>Is this even slightly possible or is it just a waste of time?</li>
  <li>If there was a NXT Bluetooth vulnerability, could I even send it from another NXT that's not connected?</li>
  <li>Was this the right place to post this question?</li>
  <li>Would NXT debugging even be possible?</li>
  </ul>
  
  <p><strong>Update</strong>
  First, thanks for all of the ideas and answers. Secondly, several of the answers note about the legality of what I am trying to do. Yes, it is legal where I live. Third, I talked with main guy and judge of the competition and he said that he would love to see a software attack like this. </p>
  
  <p><strong>Where I'm at now</strong>
  I have Kali Linux and the mac address has been found. I also found a paper <a href="http://joanna.iwr.uni-heidelberg.de/projects/NXT_DAME/data/nxt_direct_command.pdf" rel="nofollow">here</a>
  on the control protocols. The main dilemma I am still facing is the fact that a Bluetooth passcode has to be entered <strong>on</strong> the device I intend to connect to. Any updates will be posted here!</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-06-28T10:26:42.087Z
Comments.Text: Does an attempt to pair cause the bots software to pause to ask for confirmation?
  
  Maybe you can disable their bots control by continually trying to pair with it while your opponent is trying to control it.
Comments.UserDisplayName: John Meacham
Tags: <mindstorms><nxt><programming>
Title: Lego NXT Exploitation or Vulnerabilities?
UserDisplayName: Starwarsfan2099
ThreadText: # Lego NXT Exploitation or Vulnerabilities?
  
  (Asked by: username_0 on 2016-04-24)
  
  I originally posted this question on the Reverse Engineering site, but there were no answers. They told me to also post this question here. OK, my friends and I have Lego NXT sumo bot competitions for fun. Basically, you build a robot that waits five seconds and competes against a robot to stay on a board. We normally focus on the mechanical side to win against other robots (find them and push them off the board), but I had the idea to try a software attack. My idea was to:
  
  1. Find some sort of Bluetooth vulnerability that I could exploit from another NXT (I write my programs in NXC).
  2. Upload a malicious program that makes the robot drive backwards forever.
  3. Somehow execute the program (and win)!
  
  I have tried testing the NXT Bluetooth for vulnerabilities (I have knowledge of Windows/Linux exploitation and debugging) and I can't find anything. The main problem is that the NXT firmware handles Bluetooth connections, in other words you connect the devices with a pass code **before** running the program that requires Bluetooth. So, my questions are:
  
  * Is this even slightly possible or is it just a waste of time?
  * If there was a NXT Bluetooth vulnerability, could I even send it from another NXT that's not connected?
  * Was this the right place to post this question?
  * Would NXT debugging even be possible?
  
  **Update**
  First, thanks for all of the ideas and answers. Secondly, several of the answers note about the legality of what I am trying to do. Yes, it is legal where I live. Third, I talked with main guy and judge of the competition and he said that he would love to see a software attack like this.
  
  **Where I'm at now**
  I have Kali Linux and the mac address has been found. I also found a paper [here](http://joanna.iwr.uni-heidelberg.de/projects/NXT_DAME/data/nxt_direct_command.pdf)
  on the control protocols. The main dilemma I am still facing is the fact that a Bluetooth passcode has to be entered **on** the device I intend to connect to. Any updates will be posted here!
  
  **Tags:** mindstorms, nxt, programming
  
  > **Comments:**
  > **username_1**: Does an attempt to pair cause the bots software to pause to ask for confirmation?  Maybe you can disable their bots control by continually trying to pair with it while your opponent is trying to control it.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2016-04-26. Score: 1
  
  I think that most sumo bot competitions do not allow interchange of information between bricks. And you have to connect via Bluetooth with your opponent's bot, which requires your opponent's permission.
  
  > **Comments:**
  > **username_0**: I asked the person in charge of the sumo bot battles and he said he would love to see this attack work. @username_2 Thats what I am trying to overcome. If the opponents bluetooth is on, I want to exploit it and be able to control it.  
  
  ---
  
  