bluetooth-security.md

Bluetooth Security

Notable Vulnerabilities

Vulnerability name	Conference & Year published	Vulnerability website URL	Paper URL	Video URL	SIG Notice	Technology Impacted	Related CVE
BlueBorne	Black Hat Europe 2017	Site	Paper	Video	No Notice	BR/EDR	CVE-2017-8628, CVE-2017-0781, CVE-2017-0782, CVE-2017-0783, CVE-2017-0785, CVE-2017-14315, CVE-2017-1000250, CVE-2017-1000251, CVE-2017-14315, CVE-2017-1000410
Bleedingbit	2018	Site	Paper	Video	No Notice	LE	CVE-2018-7080, CVE-2018-16986
Fixed Coordinate Invalid Curve Attack	2018	Site	Paper	No Video	SIG Notice	BR/EDR/LE	CVE-2018-5383
SweynTooth	2019	Site	Paper	Video	No Notice	LE	CVE-2019-16336, CVE-2019-17060, CVE-2019-17061, CVE-2019-17517, CVE-2019-17518, CVE-2019-17519, CVE-2019-17520, CVE-2019-19192, CVE-2019-19193, CVE-2019-19194, CVE-2019-19195, CVE-2019-19196, CVE-2020-10061, CVE-2020-10069, CVE-2020-13593, CVE-2020-13594, CVE-2020-13595
KNOB	USENIX 2019	Site	Paper	Video	SIG Notice	BR/EDR	CVE-2019-9506
BIAS	IEEE S&P 2020	Site	Paper	Video	SIG Notice	BR/EDR	CVE-2020-10135
Pairing Method Confusion	2020	Site	Paper	No Video	SIG Notice	BR/EDR/LE	CVE-2020-10134
BlueFrag	2020	Article	No Paper	No Video	No Notice	Android	CVE-2020-0022
Spectra	Black Hat USA 2020	Abstract	TBD	Video	No Notice	WiFi+BT modules	CVE-2019-15063, CVE-2020-10367, CVE-2020-10368, CVE-2020-10369, CVE-2020-10370
BLURtooth	2020	No site	No Paper	No Video	SIG Notice	BR/EDR+LE	CVE-2020-15802
BLESA	WOOT 2020	Site	Paper	Video	No Notice	LE	CVE-2020-9770
BleedingTooth	2020	Site	Writeup	Video	No Notice	Linux	CVE-2020-12351, CVE-2020-12352, CVE-2020-24490
BlueMirror	WOOT 2021	Site	Paper	Video	Multiple SIG Notices	BR/EDR/LE/Mesh	CVE-2020-26555, CVE-2020-26556, CVE-2020-26557, CVE-2020-26558, CVE-2020-26559, CVE-2020-26560
InjectaBLE	IEEE DSN 2021	Site	Paper	No Video	SIG Notice	LE	CVE-2021-31615
BrakTooth	2021	Site	Paper	Video	No Notice	BR/EDR	CVE-2021-28135, CVE-2021-28136, CVE-2021-28139, CVE-2021-28155, CVE-2021-31717, CVE-2021-31609, CVE-2021-31611, CVE-2021-31612, CVE-2021-31613, CVE-2021-31785, CVE-2021-31786, CVE-2021-31610, CVE-2021-34143, CVE-2021-34144, CVE-2021-34145, CVE-2021-34146, CVE-2021-34147, CVE-2021-34148, CVE-2021-34149, CVE-2021-34150

---

Conference Talks

2003

• DEF CON 11 - Bruce Potter - Bluetooth - The Future of Wardriving Video

2004

• 21C3 - Marcel Holtmann, Martin Herfurt, Adam Laurie - Bluetooth Hacking Video
• Black Hat USA 2004 - Adam Laurie, Martin Herfurt - BlueSnarfing The Risk From Digital Pickpockets Video

2005

• 22C3 - Marcel Holtmann, Martin Herfurt, Adam Laurie - Bluetooth Hacking - The State of The Art Video

2006

• 23C3 - Thierry Zoller, Kevin Finistere - Bluetooth Hacking Revisited Video
• Black Hat USA 2006 - Bruce Potter - Bluetooth Defense Kit Black Hat Video

2007

• DeepSec 2007 - Marcel Holtmann - New Security Model of Bluetooth 2.1 Video

2009

• DEF CON 17 - Dominic Spill, Michael Ossmann, and Mark Steward - Bluetooth Smells like Chicken Video
• Shmoocon 2009 - Bluetooth-Ossman.m4v Video

2010

• Shmoocon 2010 - Michael Ossmann - Bluetooth Keyboards: Who Owns Your Keystrokes? Video
• DEF CON 18: Breaking Bluetooth by Being Bored 1/3 Video

2011

• ShmooCon 2011 - Project Ubertooth: Building a Better Bluetooth Adapter Video
• DeepSec 2011 - Tommi Makila & Jukka Taimisto: Intelligent Bluetooth Fuzzing - Why bother? Video

2012

• Ruxcon 2012 - Dominic Spill - Bluetooth Packet Sniffing Using Project Ubertooth Video
• Toorcon 2012 - Hacking Bluetooth Low Energy: I Am Jack's Heart Monitor Video
• DEF CON 20 - Passive Bluetooth Monitoring in Scapy Video

2013

• USENIX WOOT 2013 - Mike Ryan - Bluetooth: With Low Energy Comes Low Security Video
• ShmooCon 9 - How Smart Is Bluetooth Smart? Video
• Black Hat USA 2013 - Bluetooth Smart: The Good, the Bad, the Ugly, and the Fix! Video
• DeepSec 2013 - Veronica Valeros & Sebastian Garcia: Uncovering your Trails - Privacy Issues of Bluetooth Devices Video

2014

• CanSecWest 2014 - Outsmarting Bluetooth Smart Video
• DEF CON 22 - The NSA Playset Bluetooth Smart Attack Tools Video
• DEF CON 22 - Grant Bugher - Detecting Bluetooth Surveillance Systems Video

2015

• DEF CON 23 - Mike Ryan and Richo Healey - Hacking Electric Skateboards Video

2016

• DEF CON 24 - Anthony Rose, Ben Ramsey - Picking Bluetooth Low Energy Locks a Quarter Mile Away Video
• DEF CON 24 - Realtime Bluetooth Device Detection with Blue Hydra Video
• DEF CON 24 Internet of Things Village Damien Cauquil Btlejuice The Bluetooth Smart Mitm Framework Video
• Black Hat USA 2016 - Gattacking Bluetooth Smart Devices - Introducing a New BLE Proxy Tool Video
• Hack.lu 2016 - Damiel Cauquil - BtleJuice: the Bluetooth Smart Man In The Middle Framework Video
• EMF16 - Michael Ossmann - My Ubertooth Year Video

2017

• Black Hat Europe 2017 - Ben Seri, Gregory Vishnepolsky - BlueBorne - A New Class of Airborne Attacks Video

2018

• DEF CON 26 - Damien Cauquil - You had better secure your BLE devices Video
• 35C3 - Dennis Mantz and Jiska Classen - Dissecting Broadcom Bluetooth Video
• MRMCD2018 - Dennis Mantz and Jiska Classen - A Deep Dive into Bluetooth Controller Firmware Video
• Black Hat Europe 2018 - Ben Seri, Dor Zusman - BLEEDINGBIT Your APs Belong to Us Video

2019

• DEF CON 27 - Damien Cauquil - Defeating Bluetooth Low Energy 5 PRNG for Fun and Jamming Video
• USENIX Security '19 - Pallavi Sivakumaran - A Study of the Feasibility of Co-located App Attacks against BLE Video
• RSA 2019 - Mike Ryan - Bluetooth Reverse Engineering: Tools and Techniques Video
• Hardwear.io USA 2019 - Mike Ryan - Bluetooth Hacking: Tools And Techniques Video
• Hardwear.io Netherlands 2019 - Sultan Qasim Khan - Sniffle: A low-cost sniffer for Bluetooth 5 Video
• MRMCD2019 - Dennis Mantz and Jiska Classen - Playing with Bluetooth Video
• BruCON 0x0B - Damien Cauquil - Defeating Bluetooth Low Energy 5 PRNG for fun and jamming Video
• Hack.LU 2019 - Damien Cauquil - Defeating Bluetooth Low Energy 5 PRNG For Fun And Jamming Video
• CyberCamp19 - Pablo González - Audit and hacking to Bluetooth Low-Energy (BLE) devices Video

2020

• Hardwear.io Virtual Con 2020 - Daniele Antonioli - From Bluetooth Standard to Standard Compliant 0-days Video
• DEF CON 28 - Jiska Classen and Francesco Gringoli - Spectra — New Wireless Escalation Targets Video
• DEF CON 28 - Maxine Filcher - The Basics Of Breaking BLE v3 Video
• USENIX WOOT 2020 - Jianliang Wu - BLESA: Spoofing Attacks against Reconnections in Bluetooth Low Energy Video
• USENIX WOOT 2020 - Dennis Heinze, Jiska Classen, Matthias Hollick - ToothPicker: Apple Picking in the iOS Bluetooth Stack Video
• USENIX 2020 - Yue Zhang - Breaking Secure Pairing of Bluetooth Low Energy Using Downgrade Attacks Video
• Black Hat Europe 2020 - Wang Yu - Please Make a Dentist Appointment ASAP: Attacking IOBluetoothFamily HCI and Vendor-Specific Commands Video
• Ekoparty 2020 - Cecilia Pastorino and Dan Borgogno - Bluetooth Low Energy Hacking 101 Video
• rC3 2020 - Jiska Classen - Exposure Notification Security Video

2021

• CCC #DiVOC2020 - Jiska Classen - Finding Eastereggs in Broadcom's Bluetooth Random Number Generator Video
• CCC #DiVOC2020 - Jan Ruge - No PoC? No Fix! - A sad Story about Bluetooth Security Video
• WOOT2021 - Tristan Claverie, José Lopes Esteves - BlueMirror: Reflections on Bluetooth Pairing and Provisioning Protocols Video
• Hardwear.io NL 2021 - Tristan Claverie, José Lopes Esteves - BlueMirror: Defeating Authentication In Bluetooth Protocols Video

---

Bluetooth Security Tools

Linux Utilities & Tools

• BlueZ (l2ping, gatttool, hciconfig, hcidump, hcitool, sdptool, bccmd, bluetoothctl, etc.) Link

Scanners & Sniffers

• BTLEmap Github
• Sniffle Github
• Bettercap Github
• sparrow-wifi Github
• bluelog Github
• btsniffer Github
• Blue Hydra Github
• btlesniffer Github
• btscanner Link
• BT Audit Link
• redfang Gitlab
• bleah (deprecated, replaced by Bettercap) Github

Exploit Tools

• Btlejack Github
• crackle Github
• btcrack Github
• BLE-Replay Github
• BLESuite-CLI Github
• BlueMaho Gitlab
• BlueDiving Sourceforge
• Blooover Link
• l2ping (BlueSmack DoS) Link
• hidattacl Link

OBEX Attack Tools

• obexstress Download
• bluesnarfer Gitlab
• nOBEX Github

Fuzzing

• Toothpicker Github
• bss (unsupported) Github
• Defensics (Commercial) Link

Firmware Analysis

• InternalBlue Github
• Frankenstein Github
• Nexmon Github

Man-in-the-middle & Packet Injection

• BtleJuice Github
• Gattacker Github
• BTLE (for SDRs) Github
• (Unsupported) Btproxy Github

Device Spoofing

• Spooftooph Gitlab
• Bluefog Github

Ping & Signal Strength Tools

• blue_sonar Github
• BlueRanger Gitlab

Denial of Service

• Blue Deauth Github

Honeypot

• bluepot Github

Android Apps

• nRF Connect for Mobile Google Play

Hardware

• Nordic Semiconductor nRF-51 Development Kit Link
• Sena UD-100 (~$39) Link
• Ubertooth One (~$120) Link
• Ellisys Bluetooth Tools Link
• Frontline Bluetooth Tools Link

Other

• Wireshark: Protocol analyzer and packet capture Link
• Frontline Wireless Protocol Suite (Windows only) Link
• Uberducky (BLE-triggered rubber ducky) Github
• CarWhisperer: Bluetooth sniffer for in-vehicle connections Link
• BLEBoy: BLE testing platform Github

---

Primary Reference Materials

Bluetooth Core Specifications Link

NIST Special Publication (SP) 800-121 revision 2 Link

---

Useful Sites

• List of Bluetooth bugs Link
• Bluetooth arsenal tool list Github
• trifinite Bluetooth info Link
• Mike Ryan's Bluetooth info Link
• Colin Mulliner's Bluetooth info Link
• BlackArch Linux tool list Link
• Bluetooth pen test framework Link