SweynTooth: Unleashing Mayhem over Bluetooth Low Energy
summary
An automated fuzzer controls the BLE link layer (using nRF52-based tester) and drives a state-machine model to send malformed, mistimed, and out-of-order packet injection sequences while an optimizer steers mutations. Testing 12 devices from eight vendors yields 11 new vulnerabilities and 13 CVE IDs covering crashes, device hangs, a smart-lock bypass tied to pairing/order handling, and a tracker that needs a screwdriver to recover because vendor firmware relies on a watchdog reset. Proof-of-concept exploits and tooling are open source.
AI-written summary · about
chapters (16)
- 0:00Sweyn Tooth: Unleashing Mayhem over Bluetooth Low Energy
- 0:55Why the Mayhem?
- 2:00A look into Bluetooth flavours - Past Vulnerabilities
- 3:45Bluetooth Low Energy Overview Can we test BLE security ourselves with off the shelve hardware?
- 5:35Testing Security by Fuzzing Is it possible to apply fuzzing to lower-level over the air communication?
- 7:27Introducing a non-compliant controller implementation! Setup
- 8:59Fuzzer Arquitecture Overview Peripheral Smart Home
- 10:06Fuzzing BLE Layers - Fields mutation
- 10:51Fuzzing BLE Layers - Out of order sequences
- 12:23Validation Strategy - Exemplified
- 15:08Optimization
- 16:07Evaluation - Setup
- 17:39Evaluation - Comparison
- 20:19Impact - Non-compliance in the wild!
- 23:02Conclusion
- 24:58Thank you Questions?
related talks
21mToothPicker: Apple Picking in the iOS Bluetooth Stack
32mBluetooth Low Energy GATT Fuzzing: Specification To Implementation
16mBluetooth Low Energy Security Testing with Combinatorial Methods
30mUnfit Story of Fitness Trackers: Hacking BLE Fitness Trackers
18mBluetooth Security Testing with BlueToolkit: a Large-Scale Automotive Case Study
10mFuzzBT: Holistic-State-Guided Fuzzing for Bluetooth Host Stack in Kernels
35mDeep into Android Bluetooth Bug Hunting: New Attack Surfaces and Weak Code Patterns
30mUnfit Story of Fitness Trackers: Hacking BLE Fitness Trackers