This video details the reverse engineering of an Anker power bank featuring Bluetooth Low Energy (BLE) connectivity. The presenter explores the device's internal hardware, its display interface, and the functionalities enabled by its BLE module. A key focus is the in-depth analysis of the power bank's proprietary communication protocol, including its encrypted handshake, and the vulnerabilities discovered in its over-the-air (OTA) firmware update mechanism. While the latest firmware version (1.6.2) implements signed updates, earlier versions lacked this security, allowing unauthorized firmware injection from anyone within Bluetooth range. The presenter demonstrates a custom web tool to interact with the power bank without the official app and discusses potential exploits related to firmware size manipulation.
Exploring the Anker Power Bank's Hidden Bluetooth Capabilities and Firmware Vulnerabilities
0:18 Bluetooth Low Energy (BLE) Integration: The Anker power bank features a BLE module, whose necessity is questioned, leading the presenter to reverse engineer its protocol and firmware.
0:48 Critical Firmware Vulnerability: The pre-roll demonstrates a "worst-case scenario" where an over-the-air firmware update could be exploited without physical access, potentially running malicious code. This is later confirmed to be a significant vulnerability in firmware versions prior to 1.6.2 due to the lack of signed firmware files.
1:07 Power Bank Specifications: The device is a 27,000 mAh power bank with a maximum output of 250 watts and can be charged by a 100-watt base station.
1:33 Detailed Display Interface: The power bank's built-in display provides comprehensive information, including real-time wattage and amperage output, remaining runtime, and charging cycle estimations for connected devices.
2:15 Reverse Engineering the BLE Protocol: The presenter disassembled the power bank to extract firmware and reverse engineer the BLE communication protocol and its encryption. A custom web tool is available on GitHub, allowing connection without the official Anker app.
3:00 Encrypted Handshake: The BLE protocol utilizes an encrypted handshake involving the power bank's serial number, a (potentially random) Anker account ID, and UTC time as the Initialization Vector (IV).
3:18 Web Tool Functionality: The custom web tool allows users to connect to the power bank, view details like the AES key and IV used, monitor battery status and current output, and change basic settings such as enabling a "find me" beep or adjusting the display theme.
5:03 Firmware Update Security Flaw: While firmware version 1.6.2 introduced signed updates, all previous versions lacked this crucial security measure, enabling unauthorized over-the-air firmware uploads by anyone within Bluetooth range. This could grant direct hardware control and potentially lead to dangerous overcurrent situations.
6:21 Disassembly Process: Opening the power bank is challenging due to glue and clips, but the presenter successfully disassembles and reassembles it with minimal damage.
7:26 Internal Hardware: Key components include a GD32F303 main SOC, a TLSR 8253 chip for BLE (which lacks a lock function, making its firmware dumpable), an RTC chip, an 8MB external flash memory (where firmware updates are stored), and chips for current calculation and the LCD display.
8:51 Firmware Dumping and Bootloader Insights: The presenter could not dump the main SOC due to lock protection but successfully extracted firmware versions (1.6.1 and 1.6.2) from the 8MB external flash. Details about the bootloader and methods for running firmware on an unlocked chip are discussed.
10:51 Potential Firmware Update Exploit: A theoretical exploit involving manipulating the firmware size (a 4-byte value) during OTA updates is identified. Writing a "super big" size could cause the firmware to loop around the 8MB flash, potentially bypassing certain checks, although this would likely corrupt display images.
11:47 Personal Preference & Conclusion: The presenter finds the rectangular form factor inconvenient for portability but will continue using the power bank. The Bluetooth feature is primarily interesting for its security vulnerabilities and reverse engineering potential rather than practical user benefits.