BrokenMesh: New Attack Surfaces of Bluetooth Mesh

Overview: Han Yan of Baidu Security presents BrokenMesh, an in-depth vulnerability research initiative exploring the architectural and implementation attack surfaces of Bluetooth Mesh (BLE Mesh). Standardized by the Bluetooth SIG in 2017, Bluetooth Mesh provides many-to-many managed flooding communications for smart home and industrial IoT deployments. The research exposes critical software implementation vulnerabilities—specifically memory corruption bugs—within the protocol's provisioning and network control layers, targeting the Segmentation and Reassembly (SAR) mechanism via a custom automated fuzzer.

Key Topics: - Bluetooth Mesh protocol architecture vs. classic Bluetooth and BLE - Managed flooding, unicast/group addressing, and publish/subscribe models - Pre-authentication attack surfaces during the Network Build (provisioning) stage - Exploiting Segmentation and Reassembly (SAR) in provisioning and Lower Transport layers

Technical Details: The presentation distinguishes Bluetooth Mesh from classic Bluetooth and Bluetooth Low Energy (BLE), explaining that while BLE functions as a point-to-point physical/link technology similar to Wi-Fi, Bluetooth Mesh acts as an upper-layer networking protocol analogous to TCP/IP. Nodes communicate across a multi-hop topology using managed flooding relayed by designated relay nodes. Devices address messages using unicast or group addresses under a publish/subscribe communication model (e.g., switches publishing state commands to a subscribed group address shared by multiple luminaires).

The author examines two primary protocol phases: the Network Build stage (provisioning) and the Network Control stage. In the Network Build stage, an unprovisioned device associates with a mesh gateway (Provisioner) through an exchange of generic provisioning Protocol Data Units (PDUs) encapsulated in BLE advertising packets. Although the specification mandates ECDH key exchange and authentication using vendor-specific parameters, the speaker identifies that pre-authentication PDU handling represents a universal attack surface applicable across all hardware vendors. Attackers can assume the role of either a rogue Provisioner targeting joining devices or a rogue unprovisioned device attacking legitimate gateways.

The vulnerability research specifically targets the Segmentation and Reassembly (SAR) mechanism, which breaks large application payloads into Transaction Start and Transaction Continue PDUs. Because SAR requires allocating memory buffers, caching incoming segments, and reconstructing packets, implementations are susceptible to memory corruption. By mutating SAR header fields—including Segment Number (SegN), Segment Offset/Index (SegO), and total payload length—attackers can induce buffer overflows and out-of-bounds memory writes. In the Network Control stage's eight-layer architecture, lower transport layer SAR operates beneath upper transport encryption (AppKey) and network encryption (NetKey), allowing malformed segments to trigger memory safety vulnerabilities prior to cryptographic validation. To automate discovery across stacks, the researchers developed the BLE Mesh Fuzzer tool.

Key Takeaways: IoT device manufacturers and stack developers must rigorously validate and bounds-check all Segmentation and Reassembly (SAR) parameters in generic provisioning and lower transport PDUs before allocating memory or copying packet fragments. Security assessments of Bluetooth Mesh hardware must evaluate pre-authentication states, as rogue BLE advertising packets can compromise devices prior to cryptographic pairing. Automated fuzzing of protocol parsers should be incorporated into the development lifecycle of smart home and industrial mesh gateways.

(AI summary — Gemini Flash)