Finding New Bluetooth Low Energy Exploits via Reverse Engineering Multiple Vendors' Firmwares
Explore the process of discovering new Bluetooth Low Energy exploits through reverse engineering firmware from multiple vendors in this Black Hat conference talk. Delve into the journey from Bluetooth novice to uncovering remote code execution vulnerabilities at the lowest levels of the BLE protocol stack. Learn about exploits that require only proximity, bypassing the need for pairing or authentication. Gain insights into the dual and single chip BLE stack configurations, lab setup for hardware debugging, fuzzing, and packet sending. Examine case studies on Texas Instruments WL1835 MOD and another target, covering static and dynamic analysis techniques, stack and heap buffer overflow vulnerabilities, and their corresponding CVEs. Understand the impact of these discoveries and the potential for "Quiet Place" attacks in Bluetooth Low Energy devices.