<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-mobile-bluetooth-security-testing
description: >-
  Test Bluetooth and BLE security on mobile applications and devices including
  pairing vulnerabilities, GATT service enumeration, sniffing, replay attacks,
  and insecure data transmission using hcitool, gatttool, Frida, and dedicated
  BLE security tools.
domain: cybersecurity
subdomain: mobile-security
tags:
  - bluetooth
  - ble
  - gatt
  - pairing
  - sniffing
  - replay-attack
  - hcitool
  - gatttool
  - frida
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1011.001", "T1040"]
  owasp-mobile: ["M3", "M5"]
  tools: ["hcitool", "gatttool", "btlejack", "nRF Connect", "frida", "wireshark"]
---

# Performing Mobile Bluetooth Security Testing

## Overview

Bluetooth and BLE security testing evaluates pairing mechanisms, data
encryption in transit, GATT service exposure, and authentication on mobile
apps that communicate with peripherals (wearables, medical devices, IoT).
Weak BLE implementations leak sensitive data, accept unauthenticated commands,
or allow replay attacks.

## Prerequisites

```bash
apt install bluetooth bluez bluez-tools
pip install frida-tools
# btlejack: pip install btlejack (requires micro:bit or Ubertooth)
# nRF Connect app on test device
# Ubertooth One for BLE sniffing: apt install ubertooth
```

## Workflow

### Step 1: Device Discovery and Enumeration

```bash
# Scan for Bluetooth Classic devices
hcitool scan

# Scan for BLE devices
hcitool lescan --duplicates

# Detailed device info
hcitool info AA:BB:CC:DD:EE:FF

# Enumerate BLE services
gatttool -b AA:BB:CC:DD:EE:FF --primary
gatttool -b AA:BB:CC:DD:EE:FF --characteristics

# Read characteristic values
gatttool -b AA:BB:CC:DD:EE:FF --char-read -a 0x0025
```

### Step 2: GATT Service Analysis

```bash
# Interactive GATT exploration
gatttool -b AA:BB:CC:DD:EE:FF -I
# connect
# primary
# characteristics
# char-read-hnd 0x0025
# char-write-req 0x0025 0100

# Enumerate all handles and descriptors
gatttool -b AA:BB:CC:DD:EE:FF --char-desc

# Monitor notifications
gatttool -b AA:BB:CC:DD:EE:FF --listen --char-write-req -a 0x0026 -n 0100

# Check for sensitive data in readable characteristics
for handle in $(seq 1 50); do
  val=$(gatttool -b AA:BB:CC:DD:EE:FF --char-read -a "0x$(printf '%04x' $handle)" 2>/dev/null)
  [ -n "$val" ] && echo "Handle 0x$(printf '%04x' $handle): $val"
done
```

### Step 3: BLE Traffic Sniffing

```bash
# Ubertooth BLE sniffing
ubertooth-btle -f -t AA:BB:CC:DD:EE:FF -c capture.pcap

# btlejack — sniff existing BLE connections
btlejack -s  # scan for connections
btlejack -f AA:BB:CC:DD:EE:FF -o sniffed.pcap

# Wireshark analysis
wireshark -r capture.pcap -Y 'btle'
tshark -r capture.pcap -Y 'btle.data' -T fields \
  -e btle.data_header.length -e btle.data

# Android HCI snoop log
adb shell settings put secure bluetooth_hci_log 1
# Reproduce BLE operations, then:
adb pull /data/misc/bluetooth/logs/btsnoop_hci.log
wireshark btsnoop_hci.log
```

### Step 4: Pairing and Authentication Testing

```bash
# Check pairing mode (Just Works = no MITM protection)
# Monitor pairing with Frida
frida -U -f com.target.app -l hook_ble_pairing.js --no-pause

# Test if device accepts connections without pairing
gatttool -b AA:BB:CC:DD:EE:FF --char-read -a 0x0025
# If reads succeed without pairing → finding

# Attempt pairing with known passkeys
bluetoothctl
# pair AA:BB:CC:DD:EE:FF
# trust AA:BB:CC:DD:EE:FF

# Check for static passkey (e.g., 000000, 123456)
```

### Step 5: Replay and Command Injection

```bash
# Capture a BLE write command, then replay it
# 1. Sniff the write
gatttool -b AA:BB:CC:DD:EE:FF --listen &
# Trigger action in app

# 2. Replay the captured value
gatttool -b AA:BB:CC:DD:EE:FF --char-write-req -a 0x0025 -n CAPTURED_VALUE

# Frida — intercept and modify BLE data in transit
frida -U -f com.target.app -l ble_intercept.js --no-pause

# Test command injection on writable characteristics
gatttool -b AA:BB:CC:DD:EE:FF --char-write-req -a 0x0025 -n "$(python3 -c 'print("41"*100)')"
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Just Works pairing | Pairing analysis | No MITM protection |
| Unencrypted data | BLE sniff | Sensitive data in cleartext |
| No authentication | GATT access | Characteristics readable without auth |
| Static passkey | Pairing test | Predictable or default passkey |
| Replay success | Replay test | Commands accepted without freshness |

```yaml
title: Mobile Bluetooth Security Testing Detection
id: 60a7d8b1-426f-44eb-b503-2cb1711790dd
status: experimental
description: Detects suspicious activity related to performing mobile bluetooth security testing techniques in mobile security context
logsource:
  category: application
  product: android
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1011.001
  - attack.t1040
  - attack.initial_access
falsepositives:
  - Mobile device management platform enforcing security policies
```

## Verification

- [ ] BLE device discovery and GATT enumeration completed
- [ ] Service and characteristic permissions assessed
- [ ] BLE traffic captured and analyzed for cleartext data
- [ ] Pairing mechanism strength evaluated
- [ ] Replay attack resistance tested
- [ ] Writable characteristics tested for injection

## References

- [Bluetooth SIG Security](https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/)
- [OWASP MASTG — Network Communication](https://mas.owasp.org/MASTG/)
- [MITRE T1011.001 — Exfiltration Over Bluetooth](https://attack.mitre.org/techniques/T1011/001/)
- [NIST SP 800-121 — Bluetooth Security](https://csrc.nist.gov/pubs/sp/800/121/r2/final)
