Mandating Security: Sultan Qasim Kahn on the Vulnerabilities of Bluetooth Channel Sounding
summary
Bluetooth channel sounding implementations generate valid low‑level security metadata but then drop it above HCI, creating a simple exploit path where extension slot data discarded nullifies radio‑layer protections. Packet‑based ranging has low bandwidth and packet-based ranging lacks multipath handling, so timing is noisy; vendors push phase‑based methods for centimeter precision which forces a tradeoff and effectively phase-based gives precision at cost of security. Result: key‑fob and access ranging can be spoofed or relayed despite compliant radios.
AI-written summary · about
related talks
27mExploring the latest Bluetooth® innovations
20mSoK: Insecurity of Cellular Basebands
43mWhen encryption is not enough: Attacking Wearable
51mBluetooth Hacking: Tools And Techniques
44mNew Vulnerabilities in 5G Networks
36mBehind Closed Curtains - Insights on Security Vulnerabilities in Smartphone Basebands
59mWireless security testing with attack
52m"New Tales of Wireless Input Devices - Matthias Deeg, Gerhard Klostermeier