Deep into Android Bluetooth Bug Hunting: New Attack Surfaces and Weak Code Patterns

on YouTube ↗35m

" summary

Maps Android Bluetooth internals to concrete attack surfaces and shows repeatable bugs: integer underflows in PT_HDR/deserialize math, use‑after‑free across pmsg lifecycle via osi_free, and SDP/BNEP parsing failures that lead to OOB writes. Uses automated CodeQL-like codecare scripts plus local harness fuzzing (AFL/nipah‑style) and stateful simulation of profile callbacks. Claims 631 findings in 2022 (three duplicates fixed) and demonstrates concrete exploit paths and minimal reproducer strategies.

AI-written summary · about

" chapters (7)

1. 0:00Introduction and overview
2. 1:44Android Bluetooth architecture
3. 5:55Attack surface analysis
4. 16:08Code audit for vulnerabilities
5. 24:07Memory management vulnerabilities
6. 30:35Fuzzing and testing techniques
7. 33:00Conclusion and future work

" related talks

• 51mBluetooth Hacking: Tools And TechniquesMike Ryan · hardwear.io USA 2019
• 24mAttacking Bluetooth LE Design and Implementation in Mobile + Wearables EcosystemsSunil Kumar, Nitin Lakshmanan · FIRSTCON21 Virtual Edition 2.0
• 54mAnalyzing the Security of Mobile Apps for AutomobilesNaohide Waguri · CODE BLUE 2016
• 25mSweynTooth: Unleashing Mayhem over Bluetooth Low EnergySudipta Chattopadhyay, Matheus E. Garbelini, Chundong Wang, Sun Sumei, Ernest Kurniawan · USENIX ATC '20
• 21mToothPicker: Apple Picking in the iOS Bluetooth StackJiska Classen, Matthias Hollick, Dennis Heinze · WOOT '20
• 57mBlueBorne - A New Class of Airborne Attacks that can Remotely Compromise Any Linux/IoT DeviceBen Seri, Gregory Vishnepolsky · Black Hat Europe 2017
• 32mBluetooth Low Energy GATT Fuzzing: Specification To ImplementationBaptiste · Hardwear.io Netherlands 2024
• 10mFuzzBT: Holistic-State-Guided Fuzzing for Bluetooth Host Stack in KernelsMathias Payer, Dave (Jing) Tian, Ruoyu Wu, Imtiaz Karim, Elisa Bertino, Sungwoo Kim, Hui Peng, Jianliang Wu · 20th USENIX WOOT Conference on Offensive Technologies (WOOT '26)