Finding New Bluetooth Low Energy Exploits via Reverse Engineering Multiple Vendors' Firmwares

## Overview

Veronica Kova presented her journey from zero BLE expertise (2018) to discovering multiple Bluetooth Low Energy controller vulnerabilities through firmware reverse engineering. Rather than focusing on high-level protocol attacks, her research targets the link-layer (physical BLE controller) to find remote code execution flaws that affect multiple device classes simultaneously. Kova's motivation: link-layer vulnerabilities are unauthenticated, require only proximity, and if discovered in a vendor's controller chip used across PCs, cars, medical devices, and IoT, compromise entire device categories at once. Starting from 2018 with zero Bluetooth controller-specific CVEs, she demonstrates how methodical reverse engineering of firmware images revealed critical vulnerabilities (including BLEACH/Bleeding Bit and two additional RCE bugs) affecting real-world devices. Kova released Jackpine Nimble, an open-source fuzzing tool for generating malformed BLE packets to discover controller logic bugs.

## Research Methodology: Firmware Analysis and Reverse Engineering Approach

**Study Phase**: Kova began by studying Bluetooth specifications and open-source BLE implementations (Zephyr RTOS, Apache Nimble). She focused on error-prone areas of embedded design—length fields, header parsing, memory operations—where programmers commonly introduce bugs. The BLE stack separates into host-layer protocols and link-layer protocols (controller-specific). Dual-chip configurations isolate host and controller via HCI (Host Controller Interface) command/event communication; single-chip configurations embed both layers on one SoC with implementation-dependent HCI internals.

**Lab Setup**: Development board selection is critical. Kova recommends starting with vendor evaluation/development boards (e.g., Nordic nRF5840, TI WL1835 MOD) because they expose hardware debugging interfaces (UART, JTAG/SWD), allowing real-time firmware inspection, memory dumps, and exploit validation. Her lab includes serial converters (with CTS/RTS flow control lines for reliable UART communication), hardware debuggers (J-Link for Cortex-M debugging via OpenOCD, or SWD), packet sniffers (Ubertooth, Sniffle for capturing OTA BLE frames), and power control (USB hub) for remote device cycling. Serial communication is the "easiest way to debug"—accessing UART logs reveals function names and runtime behavior.

**Target Selection and Patch Analysis**: Her first target was Texas Instruments WL1835 MOD, a Bluetooth 4.2 dual-chip supporting ROM-baked link-layer code. TI provides binary firmware patches for end-products; Kova used TI's HCI tester tool to translate these binary patches to human-readable form, identifying vendor-specific HCI read-memory commands. She extracted memory read opcodes from patch files and dumped controller ROM contents using Linux HCI tools, revealing embedded strings (log function calls) and code structure.

## Vulnerability Discovery and Jackpine Nimble Tool

**Reverse Engineering via Log Functions**: By analyzing binary log function signatures in dumped ROM, Kova identified function names and called code paths. Log functions transmit messages in binary format to UART; analyzing their encoding patterns revealed function names, offsets, and context within the link-layer code. This "looking at the colors" of logging patterns enabled systematic code reconstruction.

**Arbitrary Packet Generation**: Standard BLE implementations strictly generate specification-compliant packets. Kova modified the open-source Nimble stack to violate BLE specification constraints, creating a Python host that generates malformed link-layer packets (incorrect length fields, protocol state violations, memory corruption triggers) and feeds them via HCI to target controllers. This fuzzing approach provokes unexpected behavior.

**Jackpine Nimble Release**: Kova open-sourced Jackpine Nimble, a framework for generating arbitrary BLE link-layer packets extending Nimble with non-compliant packet generation capabilities. Researchers can use it to systematically test link-layer robustness across vendor implementations. The tool enables rapid vulnerability discovery by automating packet mutation and controller response capture.

**Vulnerability Impact**: As of the presentation, 14 controller-specific CVEs exist (split between Classic Bluetooth and BLE); only 3 represent proven BLE RCE vulnerabilities. The research demonstrates that link-layer flaws enable unauthenticated remote code execution requiring only wireless proximity—no pairing or authentication—and affect entire device ecosystems relying on common controller chips.