Bluetooth & BLE · Study deck

BLE Attack Labs: Security Review

A BLE lock can pair and still fail under attack.

Radio Remi is your guide for this deck.

securitydefense

After studying this chapter

Learning objectives

You will be able to:

Implement BLE Security in Code: Build and test secure vs insecure BLE configurations on ESP32, comparing encrypted vs plaintext data transmission
Design Defense-in-Depth Architectures: Construct multi-layer security schemes for BLE IoT deployments covering link, application, and firmware layers
Analyze Attack Vectors: Diagnose vulnerability windows throughout the device lifecycle, from manufacturing supply chain to decommissioning
Evaluate Pairing Method Trade-offs: Assess the security guarantees of Just Works, Passkey Entry, Numeric Comparison, and OOB against realistic threat models

Major section

In 60 Seconds

The lock must know which phone is asking.

It must also know whether that user may open this door.
A hidden radio exchange does not answer both questions.
A lab should make each check visible.
This quick view uses one lock.

ESP32 BLE security lab circuit showing GPIO 4 wired through a 220 ohm resistor to the green secure-mode LED, GPIO 2 wired through a 220 ohm resistor to the red insecure-mode LED, GPIO 5 wired to the mode-toggle push button, and all returns tied to ESP32 ground.

Major section

In 60 Seconds (continued)

Real products cross phones, online services, and support work.

Practitioner tests make those paths repeatable.
Under the Hood examines data permissions, key life, write checks, and the gaps that a successful pairing can hide.
BLE security requires defense-in-depth: link-layer encryption via pairing is necessary but not sufficient.

Major section

Key Concepts

MITM Attack on Just Works: Passive attacker captures BLE 4.x Just Works pairing exchange; crackle tool recovers TK (always 0 for Just Works) and derives LTK from STK offline.

BLE Fuzzing: Sending malformed ATT/GATT PDUs (invalid handle ranges, out-of-bounds characteristic values) to test server input validation; public research tools and vendor test harnesses are useful references.

ESP32 BLE security lab circuit showing GPIO 4 wired through a 220 ohm resistor to the green secure-mode LED, GPIO 2 wired through a 220 ohm resistor to the red insecure-mode LED, GPIO 5 wired to the mode-toggle push button, and all returns tied to ESP32 ground.

Major section

Minimum Viable Understanding

BLE security must be implemented in layers (defense-in-depth): link-layer encryption via authenticated pairing is necessary but not sufficient.

Production deployments need application-layer authorization for sensitive commands, secure firmware updates (secure boot), rate limiting against brute-force attacks, and physical security considerations.

ESP32 BLE security lab circuit showing GPIO 4 wired through a 220 ohm resistor to the green secure-mode LED, GPIO 2 wired through a 220 ohm resistor to the red insecure-mode LED, GPIO 5 wired to the mode-toggle push button, and all returns tied to ESP32 ground.

Major section

For Beginners: Labs and Defense-in-Depth

These labs give you hands-on experience with Bluetooth security -- scanning for nearby devices, analyzing pairing processes, and understanding how to defend against common attacks.

Think of it as learning home security by actually testing locks and alarm systems, so you understand both how they work and how they can be strengthened.

ESP32 BLE security lab circuit showing GPIO 4 wired through a 220 ohm resistor to the green secure-mode LED, GPIO 2 wired through a 220 ohm resistor to the red insecure-mode LED, GPIO 5 wired to the mode-toggle push button, and all returns tied to ESP32 ground.

Deck summary

Key takeaways

The lock must know which phone is asking.

Real products cross phones, online services, and support work.
MITM Attack on Just Works: Passive attacker captures BLE 4.x Just Works pairing exchange; crackle tool recovers TK (always 0 for Just Works) and derives LTK from STK offline.
BLE security must be implemented in layers (defense-in-depth): link-layer encryption via authenticated pairing is necessary but not sufficient.
These labs give you hands-on experience with Bluetooth security -- scanning for nearby devices, analyzing pairing processes, and understanding how to defend against common attacks.

Retrieval practice

Recall check 1 of 2

Radio Remi says: answer from memory, then check your reasoning.

Q1A reviewer is checking the Bluetooth security decision for this topic. Which evidence keeps the claim bounded?

AA statement that Bluetooth is common in consumer devices, without checking this deployment

BA successful connection screenshot with no power, security, or failure-behavior evidence

CPairing method, I/O assumptions, key storage, encryption level, authorization boundary, recovery plan.

DA decision to defer retest triggers until after deployment problems appear

Show answer

Answer: C Bluetooth security review should separate pairing, encryption, key management, authorization, and recovery evidence.

Retrieval practice

Recall check 2 of 2

Radio Remi says: answer from memory, then check your reasoning.

Q2An IoT temperature sensor uses BLE 'Just Works' pairing and transmits readings every 10 seconds. Which specific attack does this configuration fail to prevent?

ARF jamming that prevents the sensor from transmitting

BJust Works permits pairing MITM.

CBattery drain caused by repeated connection requests

DFirmware tampering via JTAG after the device is deployed

Show answer

Answer: B Correct!

Print reference

Answers

Answer key.

C · Bluetooth security review should separate pairing, encryption, key management, authorization, and recovery evidence.
B · Correct!