Let’s BLESPlo.it the world together

Suomir Yask opens with the difference between classic Bluetooth and Bluetooth Low Energy, and explains the broadcast and connected modes that the talk focuses on. He introduces BLESS, a mobile app that decodes advertising packets using JSON definitions and Lua scripts. An optional ESP32 board adds lower-level packet visibility, remote scanning, device simulation and cloning, and the speaker says cloning a device takes under a minute.

The middle of the talk is a series of case studies. He describes using LLM agents to reverse engineer vendor apps and build decoders in minutes, covering a soundbar, a robotic dog, a smart faucet, crosswalk controllers, irrigation batteries and car remote-entry systems that share a key. He also covers abuse of Google Fast Pair, the WhisperPair issue in headphones, and an unauthorized memory-access problem in headsets, and notes that many of these were still unpatched when he tested them.

The takeaway is that missing or weak authentication, shared keys and unprotected control channels leave many small devices easy to control, and that AI tools have cut the time needed to reverse engineer their protocols. He invites the audience to share scans for an open device library, with firmware and library code on GitHub and the mobile apps to follow.