Attacking Bluetooth LE Design and Implementation in Mobile + Wearables Ecosystems

### Overview This presentation examines the security challenges and implementation weaknesses in the Internet of Things (IoT) and wearable ecosystems, focusing specifically on Bluetooth Low Energy (BLE) communication between hardware devices and mobile applications. The speakers introduce the basic architecture of IoT setups—comprising hardware devices, mobile phones, protocols, and cloud backends—and demonstrate how flaws in BLE pairing mechanisms and local mobile permissions can expose sensitive user data.

### Key Topics - **IoT Ecosystem Architecture**: The components connecting hardware sensors (such as home automation units or fitness trackers), mobile applications, and backend servers over Wi-Fi, BLE, and cellular connections. - **BLE Protocol & Pairing Security**: Technical mechanisms used in BLE pairing (Just Works, Passkey Entry, Out of Band), key generation processes (Temporary Key / TK and Long-Term Key / LTK), and AES-128 encryption. - **Vulnerabilities in Displayless Devices**: The risks that occur when headless or displayless wearables rely on insecure pairing modes like Just Works, allowing traffic sniffing and interception. - **Application-Layer and Operating System Permissions**: How malicious or unauthorized applications on a mobile device can exploit broad Bluetooth permissions to intercept BLE communications without breaking the underlying cryptographic algorithm directly.

### Technical Details - **Pairing Mechanisms and Key Generation**: In standard BLE pairing, devices negotiate a Temporary Key (TK) to generate a Short-Term Key (STK) and subsequently derive a Long-Term Key (LTK), which handles AES-128 encryption. While BLE supports methods like Passkey Entry and Out of Band pairing, fitness trackers and simple wearables frequently lack displays or complex input interfaces, forcing them into the 'Just Works' pairing model. - **Sniffing and Demodulation Setup**: The demonstration utilizes Ubertooth One, an open-source hardware platform for Bluetooth packet analysis and penetration testing, linked to a PC running packet capture software (Wireshark) to monitor over-the-air BLE packets. - **Just Works Exploitation**: Because the target fitness device has no display to show a PIN or confirmation key, it relies on Just Works pairing where the Temporary Key is effectively zero. By capturing the pairing request and response packets (`LL_ENC_REQ`, `LL_ENC_RSP`), the attacker can determine the LTK and decrypt all subsequent over-the-air communication, capturing sensitive biometric and personal tracking records. - **Mobile OS Permission Abuse**: The talk also highlights risks within the mobile operating system's software stack. When a mobile application gains Bluetooth permissions, it may monitor or register for notifications from connected BLE peripherals. If the peripheral does not enforce application-layer encryption, any local app with Bluetooth access can read raw data sent over the link.

### Takeaways - **Defense-in-Depth with Application-Level Encryption**: Because link-layer BLE encryption is vulnerable when displayless devices default to Just Works pairing, developers must implement secondary encryption directly at the application layer. - **Secure by Design**: Time-to-market pressures often lead hardware vendors to omit proper security architecture. Manufacturers and app developers must incorporate privacy and security requirements early in the product development lifecycle. - **Granular Mobile Permissions**: Organizations and operating systems must enforce stricter controls over which applications can interact with paired Bluetooth peripherals to prevent unauthorized local sniffing.