Damien Cauquil - Defeating Bluetooth Low Energy 5 PRNG for Fun and Jamming
Breaks the BLE 5.0 channel hopping PRNG to predict future advertisement channels and enable targeted jamming of Bluetooth 5 devices.
Summary
BLE 5 PRNG Attack
Damien Cauquil (security researcher, Digital Security) presents a cryptanalytic attack against the Bluetooth Low Energy 5.0 pseudo-random number generator used for channel hopping in advertisement and connection events.
BLE Channel Hopping Mechanism
BLE uses FHSS across 37 advertising channels and 37 data channels, with channel selection determined by a PRNG seeded from the access address and connection parameters. The PRNG is documented in the Bluetooth Core Spec as a linear feedback shift register.
PRNG Prediction and Targeted Jamming
By observing a small number of advertisement packets, Cauquil recovers the PRNG state and predicts future channel selections. Using a software-defined radio, he then jams only the predicted channels, creating selective denial-of-service against specific BLE devices while leaving other nearby devices unaffected.
Impact on BLE 5 Long Range
The attack extends to BLE 5's Long Range (coded PHY) mode, which extends range to ~1km but uses the same vulnerable PRNG, enabling targeted jamming of medical implants and industrial sensors at significant distance.
Related talks
Main Stage·37 min
Jose Pico · Fernando Perera
Jose Pico and Fernando Perera demonstrate exploiting Windows Bluetooth Low Energy (BLE) pairing flaws to execute unauthorized wireless keystroke injection.
Wireless Village·1 hr 10 min
FreqyXin
Breaks down Bluetooth Low Energy architecture, GATT services, sniffing tools, and attack surfaces in connected devices.
Main Stage·45 min
Romain Cayre · Damien Cauquil
Framework and unified protocol architecture for wireless security research, hardware abstraction, and over-the-air exploitation.