<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-bluetooth-security-assessment
description: >-
  Assess Bluetooth Classic and BLE device security including pairing analysis, GATT enumeration, BLE sniffing, and exploitation of common Bluetooth vulnerabilities.
domain: cybersecurity
subdomain: wireless-security
tags:
  - bluetooth
  - ble
  - gatt
  - btlejack
  - bluetooth-security
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1011.001", "T1200"]
  nist-csf: ["PR.AC-3", "DE.CM-1"]
  uuid: 58a2fff9-7327-4613-bf15-ac189f819421
---

# Performing Bluetooth Security Assessment

## Overview

Bluetooth security assessment covers both Classic Bluetooth and Bluetooth Low Energy (BLE)
protocols. Testing includes device discovery, pairing mechanism analysis, GATT service enumeration,
characteristic read/write testing, BLE connection sniffing with btlejack, and exploitation of
common vulnerabilities like Just Works pairing, static keys, and unencrypted data transfer.

Mode: `[MODE: RED]` for this technique.

## Prerequisites

| Requirement | Details |
|---|---|
| Bluetooth adapter with BLE support (e.g., CSR 4.0 USB dongle) | Required |
| btlejack or Ubertooth One for BLE sniffing | Required |
| gatttool and bluetoothctl (bluez package) | Required |
| nRF Connect or similar BLE exploration app | Required |
| bettercap for Bluetooth recon | Required |

## Key Concepts

### Bluetooth Attack Surface

```
Bluetooth Assessment Areas:
├── Discovery & Enumeration
│   ├── Classic BT device scan (hcitool scan)
│   ├── BLE advertisement scan (hcitool lescan)
│   ├── Service discovery (sdptool browse)
│   └── GATT service/characteristic enumeration
├── Pairing Analysis
│   ├── Just Works (no user interaction — MITM vulnerable)
│   ├── Numeric Comparison
│   ├── Passkey Entry
│   └── Out of Band (OOB)
├── Data Interception
│   ├── BLE connection sniffing (btlejack/Ubertooth)
│   ├── Classic BT sniffing (Ubertooth)
│   └── Unencrypted characteristic reads
└── Exploitation
    ├── BlueBorne (CVE-2017-0781)
    ├── KNOB attack (CVE-2019-9506)
    ├── BLE GATT write abuse
    └── Firmware extraction over BLE DFU
```

### Device Discovery

```bash
# Classic Bluetooth scan
hcitool scan

# BLE scan
sudo hcitool lescan

# Detailed BLE scan with bettercap
sudo bettercap -eval 'ble.recon on'

# Service discovery for classic BT
sdptool browse $BT_ADDR
```

### GATT Enumeration

```bash
# Connect and enumerate GATT services
gatttool -b $BLE_ADDR -I
> connect
> primary          # List primary services
> characteristics  # List all characteristics
> char-read-hnd 0x000e   # Read characteristic by handle

# Read all readable characteristics
for handle in $(gatttool -b $BLE_ADDR --characteristics | awk '{print $NF}'); do
  echo "Handle: $handle"
  gatttool -b $BLE_ADDR --char-read -a $handle 2>/dev/null
done
```

### BLE Sniffing

```bash
# Sniff BLE connection with btlejack
sudo btlejack -d $BLE_ADDR

# Ubertooth BLE sniffing
ubertooth-btle -f -t $BLE_ADDR -c capture.pcap
```

## Workflow

### Step 1: Discovery

```bash
sudo hcitool lescan --duplicates
sudo bettercap -eval 'ble.recon on; sleep 30; ble.show'
```

### Step 2: Service Enumeration

```bash
gatttool -b $TARGET -I -t random
> connect
> primary
> characteristics
```

### Step 3: Characteristic Testing

Read and write test all characteristics. Identify sensitive data exposure.

### Step 4: Pairing Analysis

Test pairing mechanism. Check for Just Works or static key usage.

### Step 5: Traffic Interception

```bash
sudo btlejack -d $TARGET -o capture.pcap
```

### Step 6: Report findings with device, vulnerability, and remediation.

## Detection

```yaml
title: Bluetooth Security Assessment Detection
id: 02b60bc4-95bd-4098-baff-1d303fd4aab5
status: experimental
description: Detects suspicious activity related to performing bluetooth security assessment techniques in wireless security context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1011.001
  - attack.t1200
  - attack.initial_access
falsepositives:
  - Wireless intrusion detection system performing routine monitoring
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Bluetooth Security Assessment Detection | windows/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1011.001, T1200 |

## Verification

- [ ] All BLE devices in scope discovered and cataloged
- [ ] GATT services and characteristics fully enumerated
- [ ] Pairing mechanism identified and security assessed
- [ ] Unencrypted data transfer flagged
- [ ] BLE traffic capture attempted for sensitive data
- [ ] Findings documented with device-specific remediation

## References

- MITRE ATT&CK T1011.001 — Exfiltration Over Bluetooth
- Bluetooth SIG Security Guidelines
- [btlejack documentation](https://github.com/virtualabs/btlejack)
- NIST SP 800-121 Rev. 2: Guide to Bluetooth Security
