PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Bluetooth Low Energy GATT Fuzzing

blog.quarkslab.com | research | #fuzzing | #vulnerability | #embedded | #ble | #gatt | #bluetooth
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Quarkslab presents a fuzzer for the Bluetooth Low Energy GATT/ATT layers, built around attack scenarios from an in-depth spec study; it uncovered bugs and vulnerabilities across several BLE stacks.
Published
Collected

Related coverage

research · blog.quarkslab.com
Examining the August Smart Lock
A reverse engineering study of the August Smart Lock 3rd generation and its Bluetooth Low Energy attack surface, examining whether a nearby attacker could interact with the lock.
blog · bishopfox.com
An Introduction to Bluetooth Security
An introduction to Bluetooth Low Energy security focused on version 4.2, covering the BLE stack, how it differs from Bluetooth Classic, and options for penetration testing BLE devices.
blog · blog.trailofbits.com
You could have invented that Bluetooth attack
Trail of Bits explains the invalid curve point attack behind Biham and Newman's BLE bug, showing how unsanitized curve parameters let attackers recover ECDH keys on patch-averse IoT devices.
blog · bugcrowd.com
A guide to Bluetooth Low Energy hacking: Part II
Part II of Bugcrowd's BLE testing guide moves from recon to GATT service analysis with an ESP32, covering unauthenticated reads/writes, weak pairing, and broadcast abuse in IoT assessments.
blog · bugcrowd.com
A guide to Bluetooth Low Energy hacking
An educational guide to Bluetooth Low Energy hacking: how radio waves and frequency shift keying carry binary data, plus techniques for attacking BLE-enabled devices.
research · blog.quarkslab.com
State of Post-Quantum Cryptography implementations
In this blogpost, we first review the landscape of Post-Quantum Cryptography implementations across some of the most popular cryptographic libraries. Following that, we present the results of a differential fuzzing campaign on few of the presented implementations.
Back