It Was Harder to Sniff Bluetooth Through My Mask During the Pandemic

It Was Harder to Sniff Bluetooth Through My Mask During the Pandemic

Speakers: Xeno Kovah, Founder, OpenSecurityTraining2

Conference: Hacktivity

YouTube: https://www.youtube.com/watch?v=L4wEtuPSafg

Overview

In this Hacktivity 2023 presentation, Xeno Kovah, founder of the non-profit OpenSecurityTraining2, sheds light on the widespread and often overlooked security and privacy implications of Bluetooth Low Energy (BLE) and Bluetooth Classic devices. Titled "It Was Harder to Sniff Bluetooth Through My Mask During the Pandemic," the talk details an extensive, naive, yet highly effective methodology for identifying the underlying Bluetooth chips within a vast array of consumer and industrial devices. Kovah's motivation stems from a critical gap in the security landscape: while sophisticated firmware-level wireless exploits exist for various Bluetooth chips, there is a profound lack of knowledge regarding which devices utilize these vulnerable components.

The core of Kovah's research involves passive and active Bluetooth sniffing across diverse environments, from cross-country road trips to urban centers and conference venues. By analyzing Bluetooth Device Addresses (BD Adders), advertised names, UUIDs, and cross-referencing with public databases like the FCC, he demonstrates how to infer chip manufacturers and even specific chip models. This identification process is crucial, as it directly informs which devices might be susceptible to known, unauthenticated, over-the-air arbitrary code execution exploits, some of which were previously discovered and presented by his wife, Veronica Kovah. The talk serves as a stark reminder that Bluetooth, far from being a benign convenience, is a pervasive attack surface with significant implications for personal privacy, physical security, and critical infrastructure.

Background

▶ Watch: Introduction and motivation for Bluetooth chip identification (0:00)

The genesis of this research lies in the existence of powerful, firmware-level vulnerabilities affecting popular Bluetooth chips, coupled with a fundamental lack of visibility into their deployment. As Kovah explains, the security community has already demonstrated the feasibility of wireless over-the-air exploits that achieve arbitrary code execution on Bluetooth firmware without authentication. Notable examples include Armis's "Bleeding Bit" vulnerabilities in 2018, which targeted Texas Instruments chips. More recently, at Black Hat 2020, Veronica Kovah presented a superset of these vulnerabilities, affecting a broader range of Texas Instruments chips, and also disclosed similar weaknesses in Silicon Labs chips. Additionally, researchers at Simu Labs at TU Darmstadt in Germany have identified comparable vulnerabilities in Broadcom chips. Despite these significant discoveries, the practical application of these exploits has been hampered by the inability to easily identify which devices incorporate the vulnerable hardware.

Kovah's project thus aimed to bridge this knowledge gap by developing a practical, albeit "naive," methodology for Bluetooth chip identification. His approach involved extensive sniffing and data collection, leveraging readily available and inexpensive hardware. For the technical background, Kovah simplifies Bluetooth into two main categories: Bluetooth Classic (existing since approximately 2000) and Bluetooth Low Energy (BLE) (since about 2012). A critical concept for his methodology is the Bluetooth Device Address (BD Adder), which functions similarly to an Ethernet MAC address.

For Bluetooth Classic and Public BLE addresses, the upper 24 bits form the Organizationally Unique Identifier (OUI), assigned by the IEEE, which can reveal the manufacturer (e.g., "Resonic INC"). These addresses are static and, therefore, trackable. BLE also introduced "random" addresses to enhance privacy, but these come in several variants:

• Static Random Addresses: Identified by the uppermost two bits being 11. While theoretically changeable upon reboot, Kovah notes they rarely change in practice, making them effectively trackable. Unlike public addresses, they do not contain OUI information.
• Resolvable Private Addresses: Identified by the uppermost two bits being 01. These are designed to cycle periodically (e.g., every 15 minutes on an iPhone) to prevent long-term tracking.
• Non-resolvable Private Addresses: Identified by the uppermost two bits being 00. These are truly random and offer the highest level of privacy, as they provide no identifying or tracking information.

Understanding these BD Adder types is fundamental to Kovah's work, as the trackability and embedded manufacturer information directly inform his chip identification process and subsequent security assessments. The problem this research addresses is the pervasive deployment of Bluetooth devices, many of which are easily trackable or use potentially vulnerable chips, without a clear, scalable mechanism for inventorying and assessing these risks.

Key Findings

▶ Watch: Understanding Bluetooth device addresses and trackability (4:00)

Kovah's extensive data collection and analysis revealed several key findings regarding Bluetooth device prevalence, identification techniques, and inherent security/privacy risks:

1. Superior Sniffing Hardware: The Raspberry Pi 0 W emerged as the clear winner for passive Bluetooth sniffing. At a cost of just $15, it collected almost twice as many Bluetooth devices as a Raspberry Pi 4, despite both using PCB antennas. Crucially, its low power consumption allowed for over 90 hours of continuous sniffing from a USB battery pack, enabling prolonged deployments in public spaces like traffic overpasses.
2. Bluetooth Proliferation: Bluetooth devices are vastly more common than Wi-Fi. Kovah observes an order of magnitude more Bluetooth devices than Wi-Fi devices in contemporary environments, compared to a 4x ratio in 2004. This highlights the sheer scale of the attack surface.
3. Multi-faceted Chip Identification Methodology: Kovah successfully developed and demonstrated several methods to infer the underlying Bluetooth chips and module vendors:

• OUI Analysis: For public BD Adders, the OUI (top 24 bits) directly reveals the company (e.g., Texas Instruments, GE Security).
• Advertised Device Names: Many devices broadcast easily identifiable names (e.g., "Hypernet TV Box," "iHunt Watch 6T," "Dexcom").
• Module Vendor Identification: Sometimes, the name or OUI points to a module maker (e.g., "Blue Radios"), which then narrows down the potential chips (e.g., Nordic NRF SoCs).
• UUID Correlation: Both 16-bit and 128-bit UUIDs advertised by devices can uniquely identify vendors or product lines (e.g., Nest cameras use a specific 16-bit UUID, Fitbit uses 128-bit UUIDs).
• FCC Database Cross-referencing: The Federal Communications Commission (FCC) database (and similar regulatory bodies) provides internal photos and specifications for wireless devices, often revealing the exact Bluetooth chip used (e.g., identifying a Nordic NRF 52805 chip in a Bnom module or a Texas Instruments CC2642 in a Rivian).
• Behavioral Analysis: Observing how devices advertise (e.g., different names in advertisement vs. scan response for Pay Range) or their transmit power (e.g., extremely low for IGT card readers, 0 dBm for Flipper Zero) provides additional clues.

1. Widespread Trackability: A vast majority of devices, including Teslas, Rivians, most fitness trackers (except Apple Watch), Flipper Zeros, hotel locks, police body cameras, and continuous glucose monitors, are easily trackable. This is primarily due to the use of static public or static random BD Adders, or the broadcasting of static, unique names even when using resolvable addresses (e.g., Nest cameras). Teslas even embed parts of their VIN number in their BD Adders.
2. Critical Security and Privacy Risks: The ability to identify chips and track devices exposes significant vulnerabilities:

• Physical Security: Hotel door locks (GE Security) are often Bluetooth-enabled and trackable. Past research has shown successful bypasses of hotel lock security, raising concerns about physical access for malicious actors, even referencing historical assassination attempts where technological bypasses were suspected.
• Automotive Security: ODB2 Bluetooth dongles, commonly used for diagnostics, were found to be universally vulnerable, potentially allowing CAN bus injection and vehicle control. Modern cars like Teslas and Rivians also have trackable Bluetooth.
• Medical Device Security: Continuous Glucose Monitors (Dexcom) and CPAP machines are trackable and use Bluetooth. The connection between CGM devices and insulin pumps via Bluetooth introduces a critical attack surface, where compromise could lead to overdose and potentially death.
• Surveillance: Police body-worn cameras (e.g., Panasonic, Axon) use public, trackable BD Adders, raising questions about accountability and surveillance capabilities. The ability to track individuals via common devices like fitness trackers or even "dumb" devices like Pokémon Go accessories presents a significant privacy concern for mass surveillance, whether by state actors or commercial entities.
• Industrial Equipment: Heavy construction equipment with Bluetooth keyless ignition systems (using Texas Instruments chips) are trackable and potentially vulnerable to firmware exploits, though the speaker humorously notes that physical keys for $9 offer a simpler bypass.

1. Underdeveloped Bluetooth Tooling: Compared to Wi-Fi, the tools for Bluetooth sniffing and analysis are "massively undeveloped," making large-scale data collection and correlation a challenging, often manual, process.

These findings collectively underscore that Bluetooth, due to its ubiquity, inherent design choices, and the lack of robust security tooling, presents a fertile ground for both privacy infringements and serious security exploits across virtually every sector.

Technical Deep Dive

▶ Watch: Using FCC database to identify Bluetooth chips (20:00)

Kovah's technical methodology, while described as "naive," leverages fundamental Bluetooth protocols and publicly available information to achieve its goals.

Hardware and Software Setup:

The cornerstone of Kovah's data collection is the Raspberry Pi 0 W. This single-board computer, costing just $15, proved superior to other options like the Raspberry Pi 4 in terms of Bluetooth device detection (collecting almost twice as many devices) and battery life (over 90 hours from a USB pack). This allowed for long-duration, unattended deployments in areas with high Bluetooth device density, such as traffic overpasses. The software setup is intentionally simplistic, relying primarily on bash scripts wrapping standard Linux tools like bton (for capturing Bluetooth information between devices and the OS) and bluetoothctl. Kovah initially attempted using the official BlueZ Linux stack but found it "less capable [and] more difficult to use," reverting to his simpler approach. Data collected was eventually ingested into a database for correlation and visualization.

Bluetooth Device Addresses (BD Adders):

A core technical concept is the BD Adder, a 48-bit identifier similar to a MAC address.

• Bluetooth Classic & Public BLE Addresses: These are static and the upper 24 bits constitute the Organizationally Unique Identifier (OUI). The OUI, assigned by the IEEE, directly identifies the manufacturer. For example, Kovah used this to identify "Resonic INC" for some devices and later "GE Security" for hotel locks. Public addresses are inherently trackable.
• Random BLE Addresses: Designed for privacy, these have three sub-types:
• Static Random Addresses: Distinguished by the two most significant bits being 11. While they can change on reboot, Kovah observed that in practice, they rarely do, making them effectively trackable. They do not contain OUI information, making direct manufacturer identification harder without other clues. Tesla vehicles, for instance, use static random BD Adders, and interestingly, embed parts of their Vehicle Identification Number (VIN) within these addresses, making them uniquely identifiable and trackable.
• Resolvable Private Addresses: Identified by the two most significant bits being 01. These are designed to cycle periodically (e.g., an iPhone changes its BD Adder every 15 minutes) to thwart tracking. However, Kovah found that even devices using resolvable addresses can be trackable if they broadcast a static, unique name (e.g., Nest cameras).
• Non-resolvable Private Addresses: Identified by the two most significant bits being 00. These are truly random and offer the highest level of privacy as they contain no persistent identifying information.

Advertisement vs. Scan Response:

Kovah highlighted a crucial distinction in how devices broadcast information:

• Advertisement Packets (AD_IND): Many devices continuously "shout out" basic information, including their name.
• Scan Response Packets (SCAN_RSP): For other devices, a "scan request" must be sent to elicit a "scan response" containing more detailed information, potentially including a different name. The Pay Range vending machine dongles exemplified this, advertising "Pay Range" but responding with "Blue Radios" to a scan request. This distinction is vital for comprehensive device profiling.

UUIDs for Device and Vendor Identification:

• 16-bit UUIDs: These are commonly assigned numbers within the Bluetooth SIG specification that correlate to specific services or companies. Nest devices, for example, advertise a 16-bit UUID that specifically identifies them as Nest products. Kovah noted that if collection tools like Wiggle captured this, correlating specific Nest devices (e.g., "n001") would be much easier.
• 128-bit UUIDs: More complex and unique, these are often used by vendors for specific product lines or models. Fitbit devices, for instance, advertise specific 128-bit UUIDs that allow passive scanners to identify them as Fitbit devices (e.g., a Fitbit Flex or Ionic) even without a device name in the advertisement packet. This technique allowed Kovah to discover previously unknown Fitbit devices in his logs.

Transmit Power (dBm):

The transmit power of a Bluetooth device, measured in dBm (decibel-milliwatts), directly impacts its range. Kovah used this to infer device purpose. For example, the IGT card readers in casinos had "extremely, extremely low transmit power," suggesting they require close proximity for interaction, akin to NFC but using Bluetooth. Conversely, the Flipper Zero broadcasts at 0 dBm, yielding a range of only 15 to 21 meters, making it "not super useful for Bluetooth [attack] unless you want to get really close to your victims." He contrasts this with the legal limit in the US of 20 dBm, which is logarithmically much more powerful.

FCC Database:

A highly valuable resource for Kovah's deep dives was the FCC database. This regulatory body in the United States requires wireless transmitting devices to submit compliance information, often including internal photos of the devices. By carefully examining these photos, Kovah could identify the exact Bluetooth chips. Examples include identifying a Nordic NRF 52805 chip within a Bnom module and confirming a Texas Instruments CC2642 chip in a Rivian vehicle. This resource, while "hit or miss," provides definitive answers when available.

Wiggle Platform:

Kovah utilized Wiggle, an open-source project for collecting Wi-Fi, cell tower, and Bluetooth data, primarily for visualization of his collected data. While useful for mapping device locations, he noted its limitations in collecting specific Bluetooth information like 16-bit UUIDs, which he has since filed tickets to address.

Through this combination of low-cost hardware, basic scripting, detailed protocol understanding, and cross-referencing public databases, Kovah developed a robust methodology for identifying the specific Bluetooth chips within a wide array of real-world devices, laying the groundwork for targeted vulnerability assessment.

Demo / Proof of Concept

▶ Watch: Medical devices like CGMs and their security risks (37:00)

While Xeno Kovah's talk did not feature a live "demo" of a Bluetooth exploit in the traditional sense, the entire presentation serves as a comprehensive proof of concept for his chip identification methodology. His work demonstrates the practical feasibility of passively and actively profiling Bluetooth devices in real-world environments to infer their underlying hardware and potential vulnerabilities.

The "demo" is woven throughout the talk via numerous anecdotes and case studies using real-world data collected by Kovah. Each example illustrates how his methodology can identify specific devices, their manufacturers, and crucially, the Bluetooth chips they employ:

• Hypernet TV Box (Hungary/Serbia): Identified by public BD Adders (OUIs pointing to Chinese OEMs) and unique naming conventions, demonstrating geographic specificity.
• Pay Range Vending Machine Dongles: Revealed the module vendor ("Blue Radios") and underlying chip (Nordic NRF SoC) by analyzing different names broadcast in advertisement vs. scan response packets, and cross-referencing OUIs.
• IGT Card Readers (Las Vegas Casinos): Identified as gaming hardware by advertised names and OUIs, with behavioral analysis noting their extremely low transmit power.
• Kicko Scooters (Seoul, South Korea): Directly identified as using Expressive chips because the BD Adder's OUI pointed to Expressive.
• Bnom Bluetooth Module (Korean Maker): After identifying the module maker, Kovah used the FCC database to pinpoint the specific chip, a Nordic NRF 52805, showcasing the power of regulatory filings.
• Tesla and Rivian Vehicles: Demonstrated trackability via static BD Adders (Teslas with VIN fragments) and identified Rivian's use of Texas Instruments CC2642 chips, again confirmed via FCC database. This is a direct link to his wife's TI chip exploits.
• Nest Cameras: Showed how static naming conventions undermine privacy even with resolvable addresses, and how 16-bit UUIDs could definitively link devices to Nest.
• Flipper Zero: Analyzed its 0 dBm transmit power and public BD Adders, highlighting its trackability and limited range for offensive Bluetooth operations.
• Hotel Door Locks (GE Security): Identified by OUI and UUIDs, illustrating the prevalence of Bluetooth in physical security and referencing past research on lock bypasses.
• Continuous Glucose Monitors (Dexcom): Demonstrated their trackability via non-random static addresses and the potential for critical exploits on interconnected insulin pumps.
• Heavy Construction Equipment: Identified as using Texas Instruments chips for keyless ignition, directly linking to known TI vulnerabilities, though the speaker noted the simpler "exploit" of buying a $9 physical key.

Through these detailed examples, Kovah effectively "demos" the process of turning raw Bluetooth emissions into actionable intelligence about device hardware, trackability, and potential susceptibility to existing firmware-level exploits. The core "proof of concept" is the methodology itself: that with readily available tools and a systematic approach, one can map the vast, unseen landscape of Bluetooth devices and their underlying components.

Defensive Implications

▶ Watch: Key takeaways and call to action for Bluetooth security (41:00)

The detailed findings from Xeno Kovah's research have significant implications for device manufacturers, security defenders, and end-users alike. Understanding the pervasive nature of Bluetooth, the ease of device identification, and the widespread trackability is crucial for mitigating risks.

1. For Device Manufacturers:

• Implement Robust Privacy by Design: Manufacturers must prioritize privacy in their Bluetooth implementations. This means consistently using resolvable private addresses for BLE devices and ensuring that these addresses are not undermined by broadcasting static, unique names or embedding personally identifiable information (like VINs or serial numbers) in BD Adders or advertisement packets. The Nest camera example clearly shows how a static name negates the privacy benefits of resolvable addresses.
• Secure Bluetooth Stacks: Given the history of firmware-level vulnerabilities (Armis, Veronica Kovah, Simu Labs) and recent Pwn2Own exploits targeting Bluetooth (e.g., Tesla infotainment), manufacturers must treat Bluetooth as a critical attack surface. This requires rigorous security testing, prompt patching, and potentially adopting secure-by-design Bluetooth stacks that are resilient to over-the-air exploits. The universal vulnerability of ODB2 dongles highlights a widespread failure in this regard.
• Careful Use of UUIDs: While 16-bit and 128-bit UUIDs can be useful for device identification and service discovery, manufacturers should be mindful of the information they implicitly leak. If anonymity is desired, UUIDs should be generic or randomized where possible, or only broadcast when necessary.
• Audit Transmit Power: Unnecessarily high transmit power can increase a device's discoverability and attack surface. Manufacturers should configure transmit power to the minimum required for intended functionality.
• Transparency and Disclosure: When vulnerabilities are discovered, manufacturers should be transparent with users and provide clear guidance on updates and mitigation.

1. For Security Defenders (Organizations, CISOs):

• Bluetooth Asset Inventory: Organizations should conduct a comprehensive inventory of all Bluetooth-enabled devices within their premises, including often-overlooked items like hotel door locks, vending machine dongles, loyalty card readers, and even specialized equipment (e.g., medical devices, industrial controls). This inventory should aim to identify specific chips and module vendors.
• Risk Assessment of Bluetooth Devices: Once inventoried, assess the risk profile of each Bluetooth device. Consider:
• Trackability: Are devices broadcasting static identifiers that could be used for surveillance or to map physical presence (e.g., police body cams, employee fitness trackers)?
• Vulnerability: Are devices using known vulnerable chips (e.g., specific Texas Instruments, Silicon Labs, Broadcom models)?
• Access to Critical Systems: Does the Bluetooth device connect to or control critical systems (e.g., CAN bus in vehicles, insulin pumps, building access systems)?
• Network Segmentation: Isolate Bluetooth-enabled devices from critical internal networks where possible. Treat Bluetooth connections with the same caution as Wi-Fi.
• Physical Security Audit: For facilities relying on Bluetooth for physical access (e.g., hotel locks), re-evaluate the security posture, considering the potential for over-the-air bypasses.
• Employee Awareness: Educate employees about the privacy and security implications of their personal Bluetooth devices (wearables, car systems) within the workplace.

1. For End-Users:

• Be Aware of Trackability: Understand that many common devices (fitness trackers, smart home gadgets, vehicles) are constantly broadcasting trackable Bluetooth identifiers. This information can be used for personal surveillance or to infer habits and locations.
• Question Device Privacy Settings: If a device offers options for Bluetooth privacy (e.g., randomized addresses), enable them. Be skeptical of "privacy features" that are undermined by static naming conventions.
• Consider the Attack Surface: Recognize that any Bluetooth-enabled device is a potential entry point for attackers. Be cautious about connecting to unknown devices or using apps that grant broad Bluetooth permissions.
• Regular Updates: Keep device firmware and associated apps updated to receive critical security patches.

In essence, Kovah's work calls for a fundamental shift in how Bluetooth is perceived and secured. It is no longer just a short-range communication convenience but a critical and often vulnerable vector demanding serious attention from designers, defenders, and users.

Key Takeaways

• Bluetooth is a Pervasive and Underestimated Attack Surface: Bluetooth devices are far more prevalent than Wi-Fi, creating a massive, often overlooked, attack surface with significant security and privacy implications across consumer, medical, automotive, and industrial sectors.
• Device Identification is Crucial for Exploit Applicability: While firmware-level exploits for Bluetooth chips exist, the critical challenge has been identifying which real-world devices use these vulnerable components. Kovah's methodology provides practical ways to bridge this gap.
• Multi-faceted Techniques Enable Chip and Vendor Identification: A combination of OUI analysis, advertised names, UUIDs, behavioral patterns (e.g., transmit power, advertisement types), and public databases (like the FCC) can effectively reveal underlying Bluetooth chips and module manufacturers.
• Widespread Trackability Undermines Privacy: Many devices, even those nominally designed with privacy in mind (e.g., using resolvable addresses), remain easily trackable due to static BD Adders, embedded unique identifiers (like VINs), or persistent, unique names.
• Bluetooth Security Tools are Immature: Compared to the mature ecosystem for Wi-Fi security, tools for large-scale Bluetooth data collection, analysis, and vulnerability assessment are "massively undeveloped," hindering comprehensive defensive efforts.
• Real-world Risks Range from Privacy to Life-Threatening: Bluetooth vulnerabilities can lead to personal tracking, physical security bypasses (hotel locks), car hacking (ODB2/CAN bus), and even life-threatening scenarios with medical devices like insulin pumps.

About the Speaker(s)

Xeno Kovah is primarily known as the founder of OpenSecurityTraining2, a non-profit organization dedicated to creating and providing free, open-source training materials on various security topics, including assembly, operating systems internals, firmware vulnerabilities, and exploitation. He dedicates approximately 75% of his time to this educational initiative. The remaining 25% of his time is spent on research, like the Bluetooth sniffing presented at Hacktivity, which he describes as a "Trojan horse" to raise awareness for OpenSecurityTraining2. Prior to his current work, Kovah had experience working at Apple in Silicon Valley. His research often focuses on low-level system security and hardware vulnerabilities, aiming to provide practical insights for the security community. The talk also references his wife, Veronica Kovah, a prominent security researcher who has presented significant Bluetooth firmware vulnerabilities at conferences such as Black Hat.