📶 Bluetooth & BLE Security¶
Curated resources for sniffing, reversing, and exploiting Bluetooth & BLE devices.
New to BLE?
Start with the BLE Researcher learning path for a structured 6-week curriculum.
Quick start¶
| Tool | Purpose | Cost |
|---|---|---|
| nRF52840 Dongle | BLE sniffing | ~$10 |
| Wireshark + nRF Sniffer plugin | Packet capture & decode | Free |
| bettercap | Live attacks | Free |
| BTLEJack | Injection & MITM | Free |
Reverse-engineer a fitness band's BLE protocol. Walkthrough: How I Hacked Xiaomi MiBand 3
🔬 Vulnerability Research¶
Major disclosures & CVEs¶
| Title | Year | CVE | Level |
|---|---|---|---|
| BLUFFS — Forward & Future Secrecy Attacks | 2023 | CVE-2023-24023 | Advanced |
| BleedingTooth — Linux Zero-Click RCE | 2020 | CVE-2020-12351 | Advanced |
| BlueDucky — HID Injection on Android | 2024 | CVE-2023-45866 | Intermediate |
| MS Bluetooth Driver Spoofing | 2024 | CVE-2024-21306 | Advanced |
| BrakTooth — Havoc on BT Link Manager | 2021 | multiple | Advanced |
| Sweyntooth — Stack-level BLE bugs | 2020 | multiple | Intermediate |
Practical research¶
- 🟡 Smart Band reverse engineering — Arun Magesh
- 🟡 Hacking a Tapo TC60 Camera
- 🟡 Smart Massager RE & exploit
- 🔴 Intel Edison as a BLE Exploit Box
🎤 Conference Talks¶
- 📺 Blue2thprinting — WTF Am I Even Looking At? (HardwearIO 2023)
- 📺 Open Wounds — 5 Years of BT Bleed (Hack.lu 2023)
- 📺 Sniffing BT During the Pandemic (HITB 2023)
🛠️ Tools¶
Software¶
Hardware¶
- nRF52840 Dongle (~$10)
- Ubertooth One — classic BT sniffer
- Sniffle on TI CC1352 — modern sniffer