Finding New Bluetooth Low Energy Exploits via Reverse Engineering Multiple Vendors' Firmwares

This talk presents a workflow for reverse engineering Bluetooth Low Energy firmware across multiple vendors using static and dynamic analysis, fuzzing, hardware debugging, and packet injection. It demonstrates unauthenticated, proximity-based remote code execution through stack and heap buffer overflow vulnerabilities and discusses their impact.

Syllabus

Intro
Learning mode
BLE stack in dual chip configuration Host
BLE stack in single chip configuration Controller
New BLE low layer vulnerabilities!
Lab setup: targets
Lab setup: for basic HW debug 1
Lab setup: for fuzzer and convenience
Lab setup: sniffers
Lab setup: packet sending HW
Lab setup: JackBNimBLE, packet sending SW
Target #1: Texas Instruments WL1835 MOD
Static analysis
Dynamic analysis
Remote code execution bugs
Stack buffer overflow 1 CVE-2019-15948
Attack packet example 1
"Quiet Place" attack
Stack buffer overflow 2 CVE-2019-15948
Attack packet example 2
Target #2
Fuzzing extended advertisements
Difference from the target #1's RCE bug
RCE: heap buffer overflow CVE-2020-15531
Impact assessment