Jose Gutierrez and Ben Ramsey - How Do I BLE Hacking

### The BLE Landscape and Consumer Security Gaps At 01:31, Jose Gutierrez and Ben Ramsey introduce the rapid proliferation of Bluetooth Low Energy (BLE / Bluetooth Smart) across consumer and industrial electronics. At 03:01, they highlight critical security flaws commonly uncovered in commercial Bluetooth-enabled door locks, medical equipment, and home sensors. Many manufacturers operate under the misconception that short radio range constitutes security, failing to implement basic cryptographic authorization or payload validation on top of the physical link.

### Three-Phase BLE Penetration Testing Methodology At 06:03, Gutierrez outlines a structured three-step methodology for auditing BLE peripherals: target discovery and signal acquisition, attribute enumeration, and characteristic exploitation. By establishing this clear testing workflow, security researchers can quickly identify whether a device exposes sensitive operations to unauthenticated RF queries.

### Reconnaissance Tooling and BlueZ Utilities At 07:35, the presenters discuss software and hardware tools essential for BLE security assessments. They demonstrate using standard Linux BlueZ command-line tools—specifically `hciconfig`, `hcitool lescan`, and `btmon`—to discover peripheral advertisement packets and trace HCI traffic. At 09:06, they introduce dedicated sniffing hardware, including Ubertooth One and Nordic Semiconductor nRF51 dongles, which enable researchers to capture over-the-air BLE packets and inspect connection handshakes.

### Demystifying GATT Architecture and Attributes At 12:00, Gutierrez explains the Generic Attribute Profile (GATT) hierarchy, using real-world analogies to clarify the roles of Profiles, Services, Characteristics, Descriptors, and 16-bit versus 128-bit UUIDs. At 13:37, the speakers emphasize that virtually all BLE interaction boils down to reading, writing, or subscribing to notifications on specific 16-bit handles, making the attribute table the primary attack surface of any peripheral.

### Practical Exploitation and Replay Attacks At 15:08, the speakers demonstrate live attacks using `gatttool` against commercial devices. By enumerating handles, researchers can identify characteristics that control motor locking mechanisms or sensitive configuration parameters. At 16:39 and 18:12, they show how unencrypted communication allows trivial replay attacks—capturing an unlock payload and replaying it directly to the handle to trigger physical lock actuation without knowing passwords or encryption keys. The talk concludes with recommendations for pairing authentication and application-layer encryption.

(AI summary — Gemini 3.8 Flash)