Bluetooth Security and Exploitation

5.

Bluetooth Low Energy (BLE) Vulnerabilities and Attacks

5.1.

Advertising Layer Attacks

5.1.1.

Advertisement Spoofing

5.1.1.1.

Malicious Advertisement Crafting

5.1.1.2.

Device Impersonation

5.1.1.3.

Service Advertisement Manipulation

5.1.2.

Advertisement Replay Attacks

5.1.2.1.

Packet Capture and Replay

5.1.2.2.

Timing Considerations

5.1.2.3.

Impact on Device Behavior

5.1.3.

Beacon Spoofing

5.1.3.1.

iBeacon Impersonation

5.1.3.2.

Eddystone Manipulation

5.1.3.3.

Location Spoofing

5.2.

GATT Protocol Exploitation

5.2.1.

Unauthorized Characteristic Access

5.2.1.1.

Permission Bypass Techniques

5.2.1.2.

Authentication Circumvention

5.2.1.3.

Data Exfiltration Methods

5.2.2.

GATT Fuzzing Attacks

5.2.2.1.

Automated Fuzzing Tools

5.2.2.2.

Protocol State Manipulation

5.2.2.3.

Crash and Vulnerability Discovery

5.2.3.

Service Manipulation

5.2.3.1.

Service Spoofing

5.2.3.2.

Characteristic Modification

5.2.3.3.

Descriptor Tampering

5.3.

Pairing and Encryption Attacks

5.3.1.

Passive Eavesdropping

5.3.1.1.

Pairing Exchange Capture

5.3.1.2.

Key Derivation Attack

5.3.1.3.

Temporary Key Extraction

5.3.2.

Active Man-in-the-Middle

5.3.2.1.

Pairing Interception

5.3.2.2.

Key Exchange Manipulation

5.3.2.3.

Connection Hijacking

5.3.3.

Downgrade Attacks

5.3.3.1.

Security Mode Downgrade

5.3.3.2.

Legacy Pairing Enforcement

5.3.3.3.

Encryption Bypass

5.3.4.

Just Works Exploitation

5.3.4.1.

Zero-Knowledge Pairing

5.3.4.2.

MITM Attack Scenarios

5.3.5.

5.3.5.1.

Authentication Bypass

5.3.5.2.

5.3.5.3.

Session Hijacking

5.4.

Privacy and Tracking Attacks

5.4.1.

Address Resolution Attacks

5.4.1.1.

5.4.1.2.

Address Correlation

5.4.1.3.

Device Tracking

5.4.2.

MAC Address Tracking

5.4.2.1.

Static Address Monitoring

5.4.2.2.

Movement Pattern Analysis

5.4.3.

Service UUID Tracking

5.4.3.1.

Unique Service Identification

5.4.3.2.

Device Fingerprinting

5.4.4.

Advertisement Data Analysis

5.4.4.1.

Manufacturer Data Tracking

5.4.4.2.

Custom Data Correlation

5.5.

Denial of Service Attacks

5.5.1.

BLE Channel Jamming

5.5.1.1.

Frequency-specific Interference

5.5.1.2.

Advertisement Channel Blocking

5.5.1.3.

Data Channel Disruption

5.5.2.

Connection Flooding

5.5.2.1.

Resource Exhaustion

5.5.2.2.

Connection Table Overflow

5.5.3.

Invalid Packet Injection

5.5.3.1.

Protocol Violation

5.5.3.2.

Stack Crash Induction

5.5.4.

Battery Drain Attacks

5.5.4.1.

Excessive Connection Requests

5.5.4.2.

High-frequency Operations

Previous

4. Classic Bluetooth (BR/EDR) Vulnerabilities and Attacks

Go to top

Next

6. Major Named Vulnerabilities and Attack Campaigns