Security Analysis Of Bluetooth Channel Sounding Protocol And Implementations
summary
Bluetooth Channel Sounding uses packet and multicarrier phase ranging but leaves combination and defenses optional, enabling attacks that shift perceived distance. Demonstrated weaknesses include Early-Detect Late-Commit waveform tricks and multipath spoofing that insert false early peaks; the spec’s normalized attack detector metric is not implemented by TI, Nordic, NXP or Silabs; vendors mostly prioritize phase-based ranging over packet-based, giving usable precision but little relay resistance. Typical sampling (4 MHz) yields 250 ns timestamps (≈75 m light travel; roundtrip ≈37.5 m), so implementations rely on sparse-tone processing (MUSIC, neural nets) rather than mandatory cryptographic timing checks.
AI-written summary · about
chapters (11)
- 0:00Introduction and speaker background
- 1:36What is Bluetooth channel sounding
- 5:24Secure ranging fundamentals
- 10:18Packet-based ranging details
- 15:13Attacking roundtrip time measurement
- 20:53Phase-based ranging explained
- 26:43Multipath propagation impact
- 34:09Combining ranging methods
- 35:33Vendor implementation analysis
- 38:21Security flaws in implementations
- 39:03Future research directions
related talks
27mExploring the latest Bluetooth® innovations
35mDeep into Android Bluetooth Bug Hunting: New Attack Surfaces and Weak Code Patterns
59mWireless security testing with attack
20mSoK: Insecurity of Cellular Basebands
51mBluetooth Hacking: Tools And Techniques
18mBluetooth Security Testing with BlueToolkit: a Large-Scale Automotive Case Study
16mBluetooth Low Energy Security Testing with Combinatorial Methods
01h 10mAttacking IoT Telemetry