BLESA: Spoofing Attacks against Reconnections in Bluetooth Low Energy
summary
Formal analysis finds two BLE reconnection design flaws that let an attacker impersonate a previously paired device and inject spoofed data. The authors build BLESA and a laptop-based spoofing proof-of-concept that successfully feeds fake battery readings to a paired phone and fitness ring. They test four stacks and 12 server devices, finding the Linux BLE stack uses vulnerable reactive authentication, Android and iOS have logic bugs, only 2 of 12 servers enforce reconnection auth, and 68.6% of 127 Android apps fail to authenticate.
AI-written summary · about
chapters (5)
- 0:00Start
- 0:24Motivation
- 6:56BLESA against Reactive Authentication
- 11:16Evaluation and Impact
- 15:57Mitigations
related talks
24mAttacking Bluetooth LE Design and Implementation in Mobile + Wearables Ecosystems
30mUnfit Story of Fitness Trackers: Hacking BLE Fitness Trackers
25mSweynTooth: Unleashing Mayhem over Bluetooth Low Energy
43mWhen encryption is not enough: Attacking Wearable
51mBluetooth Hacking: Tools And Techniques
40mGattacking Bluetooth Smart Devices - Introducing a New BLE Proxy Tool
30mUnfit Story of Fitness Trackers: Hacking BLE Fitness Trackers
35mDeep into Android Bluetooth Bug Hunting: New Attack Surfaces and Weak Code Patterns