BLE attacks: sniffing, spoofing and replay

BLE powers countless IoT devices. Many implement the protocol's security poorly, or not at all.

The weak points

"Just Works" pairing: with no confirmation, an attacker in range pairs. Unauthenticated commands: many locks/devices accept GATT writes without verification — replayed after sniffing. Sniffing: with cheap hardware (nRF52, Ubertooth) you capture traffic and, if pairing is weak, decrypt it. Static MAC: device tracking.

gatttool / nRF Connect to enumerate services and characteristics
# then replay the write that opens the lock

Defence

Authenticated pairing (LE Secure Connections, not Just Works), application-level command authentication (challenge-response, non-replayable), link encryption, randomized MACs for privacy. Do not rest security on "it is not documented".