Is It Possible to Hack the Paytm Hey , Hello and welcome to new article my ethical hacker kiddo. Here your friend , security researcher Darshan Naik aka #darshanhackz, Yeah in the last article we have seen how to hack the IoT device of any SDR and that methodology will apply to the each & every device present into the IoT System or the embedded system connected with the RF. → Physical Hardware Hacking- Pentest of the hardware by directly connecting to the UART , JTAG and Multimeter or via connection of the USB. → SDR Hacking- We will user here reply (or Even Man in the middle) attack against the Soundbox wireless link with the help of the BLE (Bluetooth Low-Energy) at 2.4 GHz. DISCLAIMER : THIS CAN BE DONE ONLY FOR EDUCATIONAL PURPOSE NEVER TRY AT HOME UPI Soundbox Communication — Backend System : → Customer initiates a payment using UPI — enabled app by scanning merchant QR Code → The payment request is sent to the UPI server. → The UPI Server forwards the request to the NPCI switch. → NPCI routes the request to the merchants account to very and complete transaction. → Once the transaction completed a confirmation came back from through same path. → The merchants bank send an API callback or push notification to UPI soundbox. → The Soundbox receives the message and play voice. Here we have to focus on the last two lines about the API callbacks and send notifications definetly this can be done and get from the Internet from that wifi or dongal where those request are able to capture by soundbox then it will play that sound , “paytm pe 20 rupaye prapt hue” . Actual Hacking Starts. → Now let us consider we don’t have the device with us now we want to hack the Soundbox with the SDR with the analysis of the Protocol. Here the actual Hacking Starts.Here with the help of the reply attack we against the wireless Soundbox we are going to repeat the same request , Because the device used Bluetooth Low-Energy (BLE) at 2.4 GHz with frequency hopping and link layer encryption. Ubsertooth-btle -f -c 37, 38, 39 -w capture.pcap → In wireshark you will see the adv packets and connection request.<br>→ We can also use the hackRF with gr-bluetooth<br>→ Record a wide slice of the 2.4 GHz ISM band at >=10 Msps.<br><br> From here we need to extract<br>→ Access Address (32bits)<br>→ Channel map (37 bits)<br>→ Hop Interval / Increment<br><br> Capture the data packet<br>→ Here from the above steps we need to capture the data packets to dump the raw encrypted LL Data PDUs.(powe Distribution unit)<br>→ With a BLE Sniffer like Ubertooth this is handled for you automatically.<br><br> Reply the Attack<br>→ If the connection is unencrypted then we can simply re-transmit the raw LL PDUs Back to the same channels with identical timing and soundbox will accept them.<br>→ If the link is encrypted , you can still reply the raw encrypted PDUs.<br><br> hackrf_transfer -t capture_id.bin -f <channel_fre> -s <samplerate> Practical Takeover keys Here what we have done see. Once you’ve mastered the sniff<br>→decrypt (or sniff→replay-in-flight) pipeline, you can:<br>→ Trigger arbitrary sound patterns or LEDs at will.<br>→ Intercept and replay the OTA-DFU flow to drop your own firmware.<br>→ Measure RSSI/timing to map proximity or build a tracking attack.<br> <br>In this way there is a possibility of hacking the Paytm Soundbox and I know this will work as per my research and pentest thinking. If you have some points or something related to topic for discussion please try to ping me on the <a href="https://www.linkedin.com/in/darshan-naik-73b870204/" target="_blank">linkedIn</a> or<a href="https://x.com/Darshan_Cyber" target="_blank"> twitter </a>or in the comments we will definitely discuss this topics, Cause as you also loves to read and do research like me.<br><br> <br>Thank you for Reading… Keep Hacking :)
