Bluetooth Low Energy Security Testing with Combinatorial Methods
summary
Implements combinatorial security testing on BLE by generating per-layer covering arrays (t=2) and combining them into a meta-CA, driving a modified Greyhound stack over nrf52840 dongles (one injector, one sniffer per target). Tests 10 vendor devices and finds 19 distinct issues, mostly in the initiating state and typically triggered by a single parameter. Uses simplified crash/availability oracles, runs fewer tests than Greyhound while finding more faults, and reports reproducible dumps and hangs.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 0:19Combinatorial security testing
- 3:54Greyhound fuzzer overview
- 6:22BLE input space modeling
- 8:09Security testing strategy
- 10:58Test setup and oracle
- 12:22Results on 10 MCUs
- 14:50Comparison with original fuzzer
- 15:32Summary
related talks
18mBluetooth Security Testing with BlueToolkit: a Large-Scale Automotive Case Study
25mSweynTooth: Unleashing Mayhem over Bluetooth Low Energy
32mBluetooth Low Energy GATT Fuzzing: Specification To Implementation
35mDeep into Android Bluetooth Bug Hunting: New Attack Surfaces and Weak Code Patterns
18mBLESA: Spoofing Attacks against Reconnections in Bluetooth Low Energy
43mWhen encryption is not enough: Attacking Wearable
51mBluetooth Hacking: Tools And Techniques
19mBLuEMan: A Stateful Simulation-based Fuzzing Framework for Open-Source RTOS...