| name | performing-bluetooth-security-assessment |
| description | Assess Bluetooth Low Energy device security by scanning, enumerating GATT services, and detecting vulnerabilities |
| domain | cybersecurity |
| subdomain | wireless-security |
| tags | ["bluetooth","ble","gatt","wireless-security"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.IR-01","DE.CM-01","ID.AM-03"] |
Performing Bluetooth Security Assessment
Overview
This skill covers performing Bluetooth Low Energy (BLE) security assessments using the Python bleak library. BLE devices are ubiquitous in IoT, healthcare, fitness, and smart home applications, and many ship with weak or absent security controls. This assessment identifies unencrypted GATT characteristics, devices broadcasting sensitive data, known vulnerable device fingerprints, and improperly secured pairing configurations.
The agent uses bleak's asyncio API to discover nearby BLE devices, connect to target devices, enumerate all GATT services and characteristics, and analyze security properties of each characteristic. It flags characteristics that allow unauthenticated read/write access to sensitive data and identifies devices matching known vulnerable profiles.
When to Use
- When conducting security assessments that involve performing bluetooth security assessment
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
Most Often Missed & How to Confirm
- Classic vs BLE scope:
bleak only covers Bluetooth Low Energy. Bluetooth Classic (BR/EDR) devices and profiles (SDP, RFCOMM) won't appear in a BLE scan — assess them separately with hcitool, sdptool browse, and bettercap's ble.recon/Classic modules.
- Discoverable vs non-discoverable: a device not advertising is not absent. Non-discoverable peripherals and randomized resolvable private addresses (RPA) hide from passive scans; don't conclude "nothing here" from a single
BleakScanner.discover() pass.
- Pairing mode matters: "Just Works" pairing provides no MITM/eavesdropping protection (TK=0) yet often presents as "paired/secure." Inspect the actual IO capabilities and auth requirements rather than trusting the connection state.
- Enumeration depth: flag characteristics with
read/write/write-without-response reachable without authentication, and sensitive GATT services (Heart Rate 0x2A37, Device Information, Battery) that should require encryption but allow unauthenticated reads.
- How to confirm a finding: corroborate the bleak results with independent tools —
hcitool lescan and gatttool --primary/--characteristics for service/characteristic enumeration, and () — then prove the weakness by actually performing an unauthenticated read/write of the flagged characteristic. A property listed as in the GATT table is not confirmed exploitable until an unauthenticated write succeeds end-to-end.
