Security Analysis of Bluetooth Channel Sounding: Protocol and Implementations

Security Analysis of Bluetooth Channel Sounding: Protocol and Implementations

Speakers: Sultan Qasim Khan, Principal Security Consultant, Tetrel Security

Conference: Hardwear.io USA

YouTube: https://www.youtube.com/watch?v=0Qjo3jxokd4

Overview

In this insightful talk from Hardwear.io USA, Sultan Qasim Khan, a Principal Security Consultant at Tetrel Security, delves into the security vulnerabilities inherent in Bluetooth Channel Sounding. Introduced in Bluetooth 5.1 (referred to as 6.0 in the talk), this feature is designed to enable secure distance bounding between devices by measuring signal propagation time. Its primary goal is to prevent malicious actors from spoofing a device's proximity, a critical requirement for applications like "phone as a key" systems for cars or homes, as well as general indoor localization. Unlike other secure ranging technologies such as Ultra-Wideband (UWB), Bluetooth Channel Sounding leverages existing Bluetooth radio hardware, promising a low-cost, widely adoptable solution.

Khan, known for his previous work on Bluetooth Low Energy (BLE) sniffing tools like Sniffle and link-layer relay attacks, highlights how the Bluetooth specification's flexibility in implementation has led to significant security weaknesses. While the protocol includes robust building blocks, vendors often prioritize simplicity and performance over stringent security measures. The presentation meticulously dissects the two primary ranging methods—packet-based and multicarrier phase-based—exposing how critical security features are either optional, unimplemented, or outright ignored in popular SDKs, rendering the technology largely insecure for its stated purpose of secure ranging.

This article will explore the technical details of Bluetooth Channel Sounding, the specific attacks it aims to mitigate, and the critical flaws found in its real-world implementations. It will also offer recommendations for developers and defenders, emphasizing the need for stricter adherence to security principles and more robust validation mechanisms to truly achieve secure distance bounding with Bluetooth technology.

Background

▶ Watch: Bluetooth Channel Sounding: Secure Distance Bounding (1:20)

Historically, determining the distance between Bluetooth devices has been a challenging task, often fraught with inaccuracies and security vulnerabilities. Early approaches primarily relied on Received Signal Strength Indication (RSSI), which measures the power of a received radio signal. However, as Khan explains, RSSI is highly unreliable for precise distance estimation. Factors such as obstacles, multipath reflections (where signals bounce off surfaces), and antenna directionality can drastically alter signal strength independent of actual distance, making it difficult to distinguish between a device that is truly far away and one that is simply obstructed.

Another method, Angle of Arrival (AoA) measurement, was introduced to address some of RSSI's limitations. AoA uses multiple antennas to determine the direction from which a signal originates, which can then be used for triangulation to estimate distance. While more precise than RSSI, AoA implementations often require bulky antenna arrays and multiple receiving points, limiting their adoption in compact consumer devices. Crucially, both RSSI and AoA are inherently vulnerable to relay attacks, where an attacker intercepts a legitimate signal and retransmits it, making a distant device appear to be nearby. This vulnerability is particularly problematic for security-critical applications like keyless entry systems.

The need for a relay-resistant and more precise distance measurement led to the development of secure ranging schemes, which aim to prevent devices from appearing closer than they truly are. These schemes are typically based on Time of Flight (ToF) measurements, leveraging the speed of light to calculate distance. A fundamental principle of secure ranging is that an attacker should not be able to guess or predict the correct values to transmit prematurely. In a simplified protocol, two devices (A and B) with a shared secret would exchange pseudo-random values. Device A sends a ping, B responds with a pseudo-random pong at a fixed time offset, and A calculates the round-trip time. An attacker could extend the perceived distance by delaying the legitimate signal, but they could not make devices seem closer by responding early without knowing the secret. Bluetooth Channel Sounding was introduced in Bluetooth 5.1 (or 6.0 as stated by Khan) to bring this secure ranging capability to the widely adopted Bluetooth ecosystem, promising improved precision and relay resistance without requiring specialized hardware.

Key Findings

▶ Watch: Early Detect Late Commit (EDLC) Attack Explained (14:50)

Sultan Qasim Khan's analysis of Bluetooth Channel Sounding reveals a critical disparity between the protocol's theoretical security capabilities and its real-world implementations. The core finding is that while the Bluetooth specification provides the building blocks for secure ranging, its flexibility allows vendors to make choices that undermine the intended security, often prioritizing ease of implementation and performance over robustness.

The primary security weaknesses identified are:

1. Unimplemented Security Features: The Normalized Attack Detector Metric (NATAM), an optional feature designed to detect sophisticated Early Detect Late Commit (EDLC) attacks in packet-based ranging, is entirely absent from all popular vendor implementations examined (TI, Nordic, NXP, Scilabs). This leaves packet-based ranging vulnerable to timing manipulation attacks.

1. Neglected Extension Slot Validation: In multicarrier phase-based ranging, the extension slot is a pseudo-random element intended to provide a security check against signal tampering. However, the Bluetooth specification does not mandate how this data should be used. Consequently, all surveyed vendor SDKs measure this data but "completely discard all the extension slot information" at higher levels of the stack, rendering this security feature moot.

1. Prioritization of Insecure but Precise Ranging: Implementations consistently prioritize phase-based ranging over packet-based ranging due to the former's significantly higher precision. While packet-based ranging offers stronger security guarantees through its extensive use of pseudo-random bits, its inherent precision limitations (e.g., 250 nanoseconds leading to a 37.5-meter distance ambiguity) make it "almost unusable for a lot of security-critical applications." This prioritization effectively bypasses the more secure but less precise method.

1. Lack of Cross-Validation: None of the investigated implementations perform cross-validation between the distance estimates derived from packet-based and phase-based ranging. If both methods are available, they either present both as equally valid (leaving the user to choose the more precise, less secure one) or simply return the phase-based estimate. This means the security offered by packet-based ranging, even if implemented, is never used to validate the phase-based results, making it "moot."

1. Vulnerability to False Early Peaks in Multipath Scenarios: The use of sparse measurements and algorithms like Inverse Fourier Transform (IFFT) or Multiple Signal Classification (MUSIC) for multipath handling, while improving precision, can be exploited. An attacker can induce a false early peak in the impulse response by spoofing a minimal number of measurements, leading the system to report a distance closer than reality.

In essence, Khan concludes that despite being marketed as "secure ranging," Bluetooth Channel Sounding, as implemented by major vendors today, "doesn't really provide much security" for its critical applications.

Technical Deep Dive

▶ Watch: Using Inverse FFT to Handle Multipath (27:50)

Bluetooth Channel Sounding employs two primary mechanisms for distance estimation: packet-based ranging and multicarrier phase-based ranging. These methods can be used independently or in combination, designated as Mode One, Mode Two, and Mode Three respectively, for ranging steps.

At the physical layer, Channel Sounding utilizes 72 radio channels in the 2.4 GHz ISM band, spanning from 2404 to 2478 MHz, spaced 1 MHz apart. Notably, these channels are not fully contiguous, with gaps for Bluetooth advertising channels 37, 38, and 39. For packet-based ranging, devices can use either the 1 Mbps or 2 Mbps PHY, similar to standard Bluetooth Low Energy (BLE), with minor deviations in modulation. Phase-based ranging, in contrast, transmits unmodulated tones at these frequencies. A unique aspect is an "on-off key" portion of the tone, where transmission depends on a single pseudo-random bit.

The security of Channel Sounding fundamentally relies on an AES-based pseudo-random number generator (PRNG). Assuming a secure key exchange occurs prior to ranging (a topic outside the scope of Channel Sounding itself), this PRNG generates values used across various protocol elements.

Packet-Based Ranging (Mode One)

In packet-based ranging, the primary packet type is the CS Sync packet. These packets begin with a standard preamble, followed by a 32-bit Access Address. Unlike regular BLE, this Access Address is not fixed for a connection but is a pseudo-random value generated by the shared secret and changes for every single packet. Optionally, a 4-bit fixed trailer can be followed by a variable-length sequence (32 to 128 bits) that is either partially or fully random.

The sounding sequence (32 or 96 bits) consists mostly of alternating ones and zeros, but includes a randomized marker (0011 or 1100) whose position and polarity are pseudo-randomly determined. The 96-bit sequence can even contain one or two markers. Alternatively, a random sequence (32 to 128 bits) can be used, which is entirely random. These sequences serve two purposes: increasing the amount of pseudo-random information an attacker must guess, and making the packet longer to potentially allow for more precise timing measurements.

Combined, a CS Sync packet can contain anywhere from 32 (Access Address only) to 160 (Access Address + 128-bit random sequence) pseudo-random bits. This large number of bits makes it "relatively unlikely to be guessed correctly within a small number of attempts," as multiple failures typically lead to connection termination. This design is intended to prevent crude early response attacks where an attacker simply replies to a ping without knowing the correct data.

A more sophisticated threat is the Early Detect Late Commit (EDLC) attack. In an EDLC attack, the adversary starts transmitting a preamble early, then sends ambiguous waveforms for the unknown data portion of the packet. Once the legitimate device transmits the actual data, the attacker quickly changes their waveform mid-symbol to match the correct value. This can trick the receiver into believing the packet arrived earlier than it actually did, thereby shortening the perceived distance. To counter this, the specification defines an optional Normalized Attack Detector Metric (NATAM). NATAM suggests two detection methods:

1. Cross-correlation of raw IQ samples of the received signal against the expected signal to detect distortions.
2. Frequency domain analysis of the raw signal to look for anomalous peaks at harmonics of the symbol rate, which are characteristic of EDLC attacks.

The spec requires NATAM implementations to achieve 90% or better reliability in detecting predefined test cases. However, Khan's research found that "nobody implemented it," rendering this crucial defense mechanism ineffective in current devices.

A significant limitation of packet-based ranging is its precision. Due to the narrow channel bandwidth and relatively slow sampling clocks (e.g., 4 MHz), the precision of packet timestamping is typically 250 nanoseconds. In this time, light travels approximately 75 meters, meaning a single bit of timing error translates to a 37.5-meter uncertainty in distance for a round trip. This level of imprecision makes packet-based ranging "almost unusable for a lot of applications that are security critical."

Multicarrier Phase-Based Ranging (Mode Two)

To address the precision limitations of packet-based ranging, multicarrier phase-based ranging was introduced. This method measures the round-trip phase shift and change in signal amplitude at multiple frequencies across the 2.4 GHz ISM band. The core idea is that if you plot the phase shift against frequency, the resulting line's slope is directly proportional to the time of flight. A steeper slope indicates a greater delay. By measuring across many frequencies, this approach can overcome the 360-degree phase ambiguity that would arise from a single frequency measurement. Real-world clock inaccuracies are handled by an initial Mode Zero step, which measures the frequency offset between devices and compensates for it in software.

Security in phase-based ranging relies on the extension slot. This is a specific time slot within the tone transmission where the presence or absence of a tone is determined by a pseudo-random bit from the AES PRNG. If a receiver detects a tone when none should be present, or vice-versa, or if the tone's amplitude/phase deviates, it could indicate tampering. While this provides "one bit of entropy for each ranging step," Khan notes that typical ranging operations involve 8, 10, or 20 steps, making it harder to guess all correctly. However, the critical flaw here is that "the spec doesn't say what you're supposed to do with extension slots." As a result, implementers "chose to do nothing," effectively nullifying this security feature. An attacker can easily manipulate the perceived phase and magnitude at the receiver by injecting an interfering tone at the same frequency with a carefully chosen amplitude and phase.

Multipath Propagation and Algorithms

Both ranging methods must contend with multipath propagation, where signals travel along multiple paths (direct line-of-sight, reflections off obstacles) to reach the receiver. This creates a superposition of signals with different delays and strengths, making it difficult to isolate the shortest, most direct path for accurate distance measurement.

For multicarrier phase-based ranging, multipath manifests as curves in the phase response and oscillations in the amplitude across different frequencies. By applying an Inverse Fourier Transform (IFFT) to this frequency response, one can derive the impulse response of the channel, which clearly shows peaks corresponding to the different signal paths and their respective delays. The earliest peak typically represents the shortest path.

However, practical implementations often take sparse measurements, sampling only a subset of the available channels, which are also non-contiguous. While zero-padding and IFFT can still yield a usable impulse response, sparsity degrades quality and, crucially, reduces the number of measurements an attacker needs to spoof. This makes it easier to induce a false early peak in the impulse response, tricking the system into reporting a shorter distance.

More advanced algorithms are employed to improve precision and handle sparsity:

• Multiple Signal Classification (MUSIC) algorithm: This approach models how delays impact the signal and treats different frequency measurements as separate sensors. It then optimizes to find the delays that best match the measured data, offering significantly better precision than IFFT and better handling of sparse data. Many vendors (TI, NXP, Scilabs) utilize MUSIC.
• Neural networks: Some vendors (TI, Scilabs) use neural networks, trained on diverse real-world RF environments, to process ranging data. These can be more robust against complex and hard-to-model phenomena. However, Khan points out that it's "hard to reason about how a neural network is making its decisions," making adversarial analysis challenging and an "interesting area to research further."

Ultimately, the inherent flexibility of the Bluetooth specification regarding how these different ranging data points and security features should be combined and validated has led to a landscape of insecure implementations. Vendors often prioritize the higher precision of phase-based ranging while discarding its security mechanisms and neglecting the more secure, albeit less precise, packet-based method.

Demo / Proof of Concept

▶ Watch: Vendor Implementations Ignore Key Security Features (34:30)

While Sultan Qasim Khan's talk did not include a live demonstration or a fully realized proof-of-concept attack, he extensively detailed the theoretical underpinnings of potential attacks and their mechanisms. He presented an illustrative waveform for an Early Detect Late Commit (EDLC) attack, showing how an attacker could transmit an early preamble and ambiguous data, then switch to the correct signal mid-symbol to manipulate the perceived packet arrival time.

Furthermore, Khan discussed how an attacker could manipulate phase-based ranging by injecting an interfering tone at the same frequency as the legitimate signal, carefully selecting its amplitude and phase to achieve desired constructive or destructive interference, thereby altering the receiver's perceived phase and magnitude. He acknowledged the practical challenges of implementing such attacks, particularly the need for precise timing and accounting for oscillator unpredictability, but affirmed that "in principle, it should be fully doable" and indicated he is actively working on it as future research. The talk's focus was on the analytical dissection of protocol flaws and implementation weaknesses rather than a live exploit.

Defensive Implications

▶ Watch: Future Research: Implementing Ranging Attacks (38:50)

Sultan Qasim Khan's analysis provides clear implications for both Bluetooth chip vendors and developers implementing Channel Sounding, as well as for end-users and security practitioners. The core message is that while the Bluetooth specification lays the groundwork for secure ranging, current implementations fall short, making the technology vulnerable to distance spoofing.

For Bluetooth chip vendors and SDK developers, the primary defensive implications are:

1. Implement NATAM: The Normalized Attack Detector Metric (NATAM) is an essential, albeit optional, feature for defending against Early Detect Late Commit (EDLC) attacks in packet-based ranging. Vendors must prioritize implementing NATAM to spec, ensuring it achieves the mandated 90% or better detection reliability. This is currently a critical missing piece across all major implementations.

1. Mandate Extension Slot Validation: The Bluetooth SIG should revise the specification to explicitly mandate how the extension slot data in phase-based ranging must be processed and validated for security. If the spec does not provide clear guidance, vendors will continue to discard this information. Implementers should, at a minimum, check for unexpected tones or missing tones in the extension slot and treat such occurrences as evidence of tampering, invalidating the ranging measurement.

1. Cross-Validate Ranging Methods: Implementations must actively cross-validate distance estimates from both packet-based and phase-based ranging. While phase-based ranging offers superior precision, packet-based ranging provides stronger security guarantees due to its higher entropy. If both are enabled, the system should compare the two estimates. Significant discrepancies (e.g., beyond a reasonable margin of error for the less precise packet-based method) should trigger an alert, invalidate the measurement, or prompt a re-evaluation. Simply returning the phase-based number or discarding the packet-based measurement negates its security value.

1. Prioritize Security Over Convenience: Vendors often choose simpler, faster, and cheaper implementation paths due to the specification's flexibility and marketing pressures. The industry needs to shift towards prioritizing robust security, even if it adds complexity or minor overhead. Marketing materials should also accurately reflect the security posture of actual implementations, not just the theoretical potential of the protocol.

1. Robust Multipath Handling: While advanced algorithms like MUSIC and neural networks improve precision in multipath environments, their behavior in adversarial scenarios needs further research. Implementers should be cautious about reducing the number of ranging steps or measurements, as this makes the system more susceptible to false early peak attacks. Robustness against such attacks should be a key evaluation criterion for these algorithms.

For end-users and security practitioners deploying applications like "phone as a key" that rely on Bluetooth Channel Sounding:

• Be Aware of Current Limitations: Understand that current Bluetooth Channel Sounding implementations may not provide the secure distance bounding they claim. Do not solely rely on this technology for critical security functions without independent validation or additional security layers.
• Demand Secure Implementations: Put pressure on vendors to implement the full range of security features defined in the Bluetooth specification and to provide transparency on their security postures.
• Layered Security: For high-security applications, Bluetooth Channel Sounding should be treated as one layer in a multi-layered security approach, augmented with other authentication factors or complementary technologies until its security is proven robust.

In conclusion, the defensive implications underscore a clear call to action for the Bluetooth ecosystem: move beyond "building blocks" and flexibility to mandated, rigorously implemented, and validated security features to deliver on the promise of secure Bluetooth ranging.

Key Takeaways

• Bluetooth Channel Sounding's Security is Undermined by Implementation Choices: While the protocol includes security features for secure distance bounding, vendors consistently prioritize performance and simplicity, leading to insecure implementations.
• Critical Security Features Are Unimplemented or Ignored: The Normalized Attack Detector Metric (NATAM) for packet-based ranging and the extension slot validation for phase-based ranging are largely absent or discarded in popular vendor SDKs, leaving systems vulnerable to timing attacks and signal manipulation.
• Precision Over Security: Implementations favor multicarrier phase-based ranging for its higher precision, despite its weaker security. The more secure packet-based ranging is often not prioritized or even implemented due to its limited precision (e.g., 37.5m uncertainty).
• Lack of Cross-Validation: No vendor SDKs cross-validate distance estimates between the two ranging methods, effectively rendering the security of packet-based ranging moot even when present.
• Multipath Vulnerabilities: Sparse measurements and certain multipath handling algorithms (like IFFT) can be exploited to induce false early peaks, making the system report devices as closer than they are.
• Call for Stronger Specification and Implementation: The Bluetooth SIG needs to mandate the implementation and proper use of security features, and vendors must commit to more robust, security-focused implementations rather than relying on optionality.

About the Speaker(s)

Sultan Qasim Khan is a Principal Security Consultant at Tetrel Security, based in Montreal, Canada. His expertise lies in embedded system security and wireless communications, encompassing areas such as firmware and ROM analysis, protocol stack examination, and reverse engineering of wireless protocols. Khan has a long-standing interest in Bluetooth security, notably releasing Sniffle, an open-source tool for Bluetooth Low Energy (BLE) sniffing. He further extended this work to include transmission capabilities, developing a tool for performing low-latency, link-layer relay attacks against encrypted BLE connections with unknown keys. His research consistently highlights vulnerabilities in widely adopted wireless technologies, providing critical insights for the security community.