Open Wounds: The Last 5 Years Have Left Bluetooth To Bleed

Xeno Kovah surveys five years of Bluetooth security research, arguing that the field has moved through distinct waves of researchers and tooling. He starts by describing how a large body of published papers was catalogued and tagged, which made it possible to see who kept working on the topic and which tools they built. Early classic Bluetooth work gave way to a second wave centred on sniffers and the first machine-in-the-middle frameworks, followed by a third wave where firmware hooking and custom chip firmware made arbitrary packet injection practical.

The middle of the talk covers the recent findings. Several chip-level bugs let crafted link-layer packets reach code execution on controllers from multiple silicon vendors, before any pairing takes place. Kovah then explains how the chain of silicon vendors, module makers and product makers spreads each flaw across many devices. He walks through pairing weaknesses, including a key-entropy downgrade, unidirectional authentication that allows role-switch impersonation, reflection attacks, packet injection into connections, and a proximity-based unlock relay against a car.

He closes by arguing that many of these issues will stay unpatched in the field. Updates depend on phones or computers that many Bluetooth devices never connect to, and embedded operating systems and end-of-life products widen the gap. The practical takeaway is that enterprises can do little to assess Bluetooth exposure today, and that the field needs more researchers.