Taking D-Bus to Explore the Bluetooth Landscape

The talk frames the Bluetooth landscape as a sprawling, poorly documented environment where devices are everywhere and many existing command-line tools are outdated. The speaker presents bleep, a Python tool built on Linux D-Bus and the BlueZ library, which enumerates nearby Bluetooth Low Energy devices and reads their services, characteristics, and descriptors. Background covers the host controller interface, which can be sniffed but not injected into, and the nested structure of GATT servers.

Live examples included Apple phones and watches, an Intel-flagged device, and a handheld barcode scanner identified through its GATT data. HCI captures were used to check what the tool reported against actual traffic. Several Apple devices disconnected after a read error, which the speaker interpreted as a deliberate protective reaction. Mapping known trouble handles and skipping them let enumeration proceed much further, though some devices still timed out. Changing how the tool presented itself also altered device behavior, including an audio profile that moved headphones to a laptop.

The main takeaways are that manufacturers shape Bluetooth behavior, producing an uneven landscape, and that systematic probing can trigger defensive disconnects. The talk closed with a CTF-style demonstration of brute-forcing a writable characteristic to retrieve a flag, showing basic read and write interaction with a device.