ToothPicker: Apple Picking in the iOS Bluetooth Stack
summary
Built an in-process Frida fuzzer called ToothPicker that forges virtual Bluetooth connections inside bluetoothd, exercises ACL and BLE handlers, and reports coverage via Frida Stalker. Fuzzing runs ~25–30 messages/sec (versus 1–5 OTA), collects ~6,000 of ~150,000 basic blocks, and finds multiple crashes and two CVEs; one zero-click RCE is reported (patched in iOS 13.5). Pointer authentication slows instrumentation, and crash candidates are verified over-the-air before being counted as true bugs.
AI-written summary · about
chapters (9)
- 0:00ToothPicker Apple Picking in the iOS Bluetooth Stack
- 0:38Bluetooth in the Apple Ecosystem
- 2:39Proprietary Bluetooth Protocols Category
- 3:30Bluetooth on iOS
- 4:45Over-the-Air Fuzzing
- 7:01Fuzzing bluetoothd
- 11:13In-Process Fuzzing
- 15:59Bluetooth Protocol Targets
- 16:53Performance 25-30 messages per second
related talks
25mSweynTooth: Unleashing Mayhem over Bluetooth Low Energy
10mFuzzBT: Holistic-State-Guided Fuzzing for Bluetooth Host Stack in Kernels
35mDeep into Android Bluetooth Bug Hunting: New Attack Surfaces and Weak Code Patterns
32mBluetooth Low Energy GATT Fuzzing: Specification To Implementation
58mUncovering OWASP’s Mobile Risks in iOS Apps
53mResearching New Attack Interfaces On iOS And OSX
18mBluetooth Security Testing with BlueToolkit: a Large-Scale Automotive Case Study
45mFuzzing Android: A Recipe For Uncovering Vulnerabilities Inside System Components In Android