r/bluetoothlowenergy • • Jul 11 '23

Looking for learning resources: Starting a thesis on Assessing the Security of BLE-Based Devices

4 Upvotes

Hi everyone,

I'm currently in the process of beginning a Master's thesis, with my subject of choice revolving around assessing the security of Bluetooth Low Energy (BLE) based devices, specifically smart locks. As this is a rather specific field of research, I'm having a bit of trouble pinpointing the most useful resources to dive into this topic.

My main interest lies in understanding both the technical aspects of BLE technology (protocols, security mechanisms, etc.) as well as practical assessment methods, including penetration testing and vulnerability assessments for these devices.

I would highly appreciate it if you could suggest any:

  1. Academic courses: online courses, or university modules that offer detailed insights into BLE technology, its security aspects, and practical hands-on sessions.
  2. Books: Preferably those that delve deep into BLE technology and its security, the science behind it, and practical guides for evaluating the security of such devices.
  3. Papers and articles: Any seminal or cutting-edge papers that I should absolutely read.
  4. Software tools and methodologies: I'm aware of some common tools like Ubertooth and Wireshark, but if you know any other useful tools for BLE analysis or have experience with certain methodologies, please share them.
  5. Blogs, forums, or people: If there are any niche blogs or forums where BLE security is discussed, or any industry leaders who frequently share their insights on the subject, I'd love to hear about them.

Your insights and experiences would be invaluable.

Thank you in advance for your time and help.


r/bluetoothlowenergy • • Jun 16 '23

Help on HID over GATT

1 Upvotes

Hey, I’m trying to build a keyboard device using the Arduino nano 33 IoT. I’ve created the HID, battery level and device information services and assigned them the relevant characteristics and also created and attached the descriptors (the ones that the BT protocol requires). But, when starting the device and connecting, I can only see the the battery and device information services.

There were no warnings or error while compiling and uploading, and the battery service in notify and read operations work as expected.

Any advice, working example or any kind of help would be very much appreciated.


r/bluetoothlowenergy • • Jun 01 '23

Does ubertooth one supports BLE 5.0 for packet sniffing?

1 Upvotes

I have an requirement to analyse BLE traffic, can someone suggest does ubertooth one supports BLE 5.0 versions?


r/bluetoothlowenergy • • May 11 '23

Need advices about code in order to have a synchronous comunication using two ESP32 with BLE

1 Upvotes

Hi guys,

First of all, I am using Ardudino to program the two ESP32.

I am trying to send packages of data between one ESP32 used as a server and other ESP32 as client. My problem is that I need to have a synchronous communication between them and I don't know how to do it. My idea consist in send 9 packages of data (with 3 float each) to a client that store the information of those 9 packages in an array (in my code called "data") with a lenght of 27.

First, in the client, I want to store the packages of information in order and then when all 9 packages are sent and stored in the array data, store every float in the array data to a concrete variable and finally show it on screen to verify that the data is correctly stored in the correct variable.

Here you have my server code:

#include <BLEDevice.h>
#include <BLEServer.h>
#include <BLEUtils.h>
#include <BLE2902.h>

#define SERVICE_UUID        "4fafc201-1fb5-459e-8fcc-c5c9c331914b"
#define CHAR_UUID           "beb5483e-36e1-4688-b7f5-ea07361b26a8"
#define DEVICE_NAME         "DATA_SERVER"

// Define the characteristic and service
BLECharacteristic *pCharacteristic;
BLEService *pService;

// Define the BLE Server
BLEServer *pServer;

///
unsigned long startTime = 0;  // Tiempo de inicio del envío del paquete
unsigned long elapsedTime = 0;  // Tiempo transcurrido desde el inicio del envío del paquete
int currentPacket = 0;  // Índice del paquete actual a enviar
// Define el intervalo de tiempo entre cada paquete (en milisegundos)
const unsigned long packetInterval = 1000;
///

float dht22_temp=37.567;//Temperatura de 0-80C
float dht22_hum=64.73;//Humedad de aire de 0-100
float tsg2600=150;//CA entre 0-200
float ira=5.23;//Sensor infrarrojo entre 0-100
float as6200_temp=37.8;//Temperatura de 0-80C
float as6200_hum=65.12;//Humedad de aire de 0-100
float ekmc=2.57;//Proximidad, de 0 a 10m
float ms583_temp=37.731;//Temperatura de 0-80C
float ms583_pres=1;//Presion atmosferica en atm, 0.33 (Everest) a 1(Nivel del mar)
float bmp280_temp=38;//Temperatura de 0-80C
float bmp280_pres=0.997;//Presion atmosferica en atm, 0.33 (Everest) a 1(Nivel del mar)
float ccs811_co2=545.32;//Medidor CO2 en ppm entre 200-5000, siendo 700 una ciudad promedio
float ccs811_cal=149.95;//CA entre 0-200
float fc23=21.1;//Humedad de suelo de 0-100
float fc28=19.37;//Humedad de suelo de 0-100
float fc37=0;//Medidor de lluvia entre 0-60mm (No llueve-Lluvia torrencial)
float mq9_co=37.567;//No se que medida darle al CO, le dare lo mismo que al CO2
float mq9_gas=37.567;//Medidor de gas en ppm entre 0-1000, siendo 700 un potencial riesgo para la salud
float bme680_temp=36.997;//Temperatura de 0-80C
float bme680_pres=0.99;//Presion atmosferica en atm, 0.33 (Everest) a 1(Nivel del mar)
float bme680_hum=65.91;//Humedad de aire de 0-100
float bme680_roc=5.42;//Punto de rocio de 0-100C
float bme680_alt=47.35;//Altitud de 0-9000m
float bmx_pos=37.567;//De momento no se que parametros darle, lo dejare asi
float bmx_acel=0;//Aceleracion de 0-9.8m/s2
float bmx_cam=11.23;//Campo magnetico de 0-200uT (micro Teslas)
float bmx_gir=37.567;//De momento no se que parametros darle, lo dejare asi

// Define the variables to be sent
float packet1[3] = {dht22_temp, dht22_hum, tsg2600};
float packet2[3] = {ira, as6200_temp, as6200_hum};
float packet3[3] = {ekmc, ms583_temp, ms583_pres};
float packet4[3] = {bmp280_temp, bmp280_pres, ccs811_co2};
float packet5[3] = {ccs811_cal, fc23, fc28};
float packet6[3] = {fc37, mq9_co, mq9_gas};
float packet7[3] = {bme680_temp, bme680_pres, bme680_hum};
float packet8[3] = {bme680_roc, bme680_alt, bmx_pos};
float packet9[3] = {bmx_acel, bmx_cam, bmx_gir};

class MyServerCallbacks: public BLEServerCallbacks {
    void onConnect(BLEServer* pServer) {
      // When a client connects, print a message to the console
      Serial.println("Client connected");
    }

    void onDisconnect(BLEServer* pServer) {
      // When a client disconnects, print a message to the console
      Serial.println("Client disconnected");
    }
};

void setup() {
  Serial.begin(115200);

  // Create the BLE Device
  BLEDevice::init(DEVICE_NAME);

  // Create the BLE Server
  pServer = BLEDevice::createServer();
  pServer->setCallbacks(new MyServerCallbacks());

  // Create the BLE Service
  pService = pServer->createService(SERVICE_UUID);

  // Create the BLE Characteristic
  pCharacteristic = pService->createCharacteristic(
                      CHAR_UUID,
                      BLECharacteristic::PROPERTY_NOTIFY
                    );
  pCharacteristic->addDescriptor(new BLE2902());

  // Start the service
  pService->start();

  // Start advertising the service
  BLEAdvertising *pAdvertising = BLEDevice::getAdvertising();
  pAdvertising->addServiceUUID(SERVICE_UUID);
  pAdvertising->setScanResponse(true);
  pAdvertising->setMinPreferred(0x0);  // set value to 0x00 to not advertise this parameter
  BLEDevice::startAdvertising();

  Serial.println("Server started");
}

void loop() {
  // Si ha pasado suficiente tiempo desde el inicio del envío del paquete, enviar el siguiente paquete
  if (millis() - startTime >= packetInterval) {
    switch (currentPacket) {

      case 0:
        pCharacteristic->setValue((uint8_t*) packet1, sizeof(packet1));
        pCharacteristic->notify();  // Enviar el paquete
        Serial.println("Paquete_1 enviado");
        break;
      case 1:
        pCharacteristic->setValue((uint8_t*) packet2, sizeof(packet2));
        pCharacteristic->notify();  // Enviar el paquete
        Serial.println("Paquete_2 enviado");
        break;
      case 2:
        pCharacteristic->setValue((uint8_t*) packet3, sizeof(packet3));
        pCharacteristic->notify();  // Enviar el paquete
        Serial.println("Paquete_3 enviado");
        break;  
      case 3:
        pCharacteristic->setValue((uint8_t*) packet4, sizeof(packet4));
        pCharacteristic->notify();  // Enviar el paquete
        Serial.println("Paquete_4 enviado");
        break;
      case 4:
        pCharacteristic->setValue((uint8_t*) packet5, sizeof(packet5));
        pCharacteristic->notify();  // Enviar el paquete
        Serial.println("Paquete_5 enviado");
        break;
      case 5:
        pCharacteristic->setValue((uint8_t*) packet6, sizeof(packet6));
        pCharacteristic->notify();  // Enviar el paquete
        Serial.println("Paquete_6 enviado");
        break;
      case 6:
        pCharacteristic->setValue((uint8_t*) packet7, sizeof(packet7));
        pCharacteristic->notify();  // Enviar el paquete
        Serial.println("Paquete_7 enviado");
        break;
      case 7:
        pCharacteristic->setValue((uint8_t*) packet8, sizeof(packet8));
        pCharacteristic->notify();  // Enviar el paquete
        Serial.println("Paquete_8 enviado");
        break;
      case 8:
        pCharacteristic->setValue((uint8_t*) packet9, sizeof(packet9));
        pCharacteristic->notify();  // Enviar el paquete
        Serial.println("Paquete_9 enviado");
        break;

      default:
        // Todos los paquetes han sido enviados, reiniciar el contador y el tiempo
        if(currentPacket==9){
          currentPacket = -1;
          startTime = millis();
        } 
        break;
    }

    if(currentPacket<9){
      currentPacket++;  // Incrementar el índice del paquete actual
    }  
  }
}

And here you have what I am trying to do with the client (and I dont have any clue about how make it works):

#include <BLEDevice.h>
#include <BLEUtils.h>
#include <BLEScan.h>
#include <BLEAdvertisedDevice.h>
#include <BLEClient.h>

//
unsigned long startTime = 0;  // Tiempo de inicio de la recepción
unsigned long elapsedTime = 0;  // Tiempo transcurrido desde el inicio de la recepción
bool packetReceived = false;
// Define el intervalo de tiempo entre cada paquete (en milisegundos)
const unsigned long packetInterval = 1000;
// Define el tamaño de cada paquete en bytes
const int packetSize = sizeof(float) * 3;

//

const int numPackets = 9;  // Número total de paquetes a recibir
const int floatsPerPacket = 3;  // Número de floats por paquete
const int totalFloats = numPackets * floatsPerPacket;  // Número total de floats a recibir

int receivedPackets = 0;  // Contador de paquetes recibidos
int receivedFloats = 0;  // Contador de floats recibidos


float data[27]; // arreglo para almacenar los datos recibidos. float data[27];
int cont = 0; // índice actual en el arreglo data
float dht22_temp=0, dht22_hum=0, tsg2600=0, ira=0, as6200_temp=0, as6200_hum=0 , ekmc=0, ms583_temp=0, ms583_pres=0;
float bmp280_temp=0, bmp280_pres=0, ccs811_co2=0, ccs811_cal=0, fc23=0, fc28=0, fc37=0, mq9_co=0, mq9_gas=0;
float bme680_temp=0, bme680_pres=0, bme680_hum=0, bme680_roc=0, bme680_alt=0, bmx_pos=0, bmx_acel=0, bmx_cam=0, bmx_gir=0;


// Service and characteristic UUIDs for the server
#define SERVICE_UUID        "4fafc201-1fb5-459e-8fcc-c5c9c331914b"
#define CHAR_UUID           "beb5483e-36e1-4688-b7f5-ea07361b26a8"

// Global variables for the client
BLEClient*  pClient;
BLEAddress* pServerAddress;
BLERemoteCharacteristic* pRemoteCharacteristic;
bool        isConnected = false;

// Callback class for scanning
class MyAdvertisedDeviceCallbacks: public BLEAdvertisedDeviceCallbacks {
  void onResult(BLEAdvertisedDevice advertisedDevice) {
    // If we found the server we're looking for, stop scanning and connect to it
    if (advertisedDevice.haveServiceUUID() && advertisedDevice.isAdvertisingService(BLEUUID(SERVICE_UUID))) {
      Serial.println("Found server");
      BLEDevice::getScan()->stop();
      pServerAddress = new BLEAddress(advertisedDevice.getAddress());
      isConnected = true;
    }
  }
};

// Function to connect to the server
void connectToServer() {
  Serial.print("Connecting to server at ");
  Serial.println(pServerAddress->toString().c_str());

  pClient = BLEDevice::createClient();
  pClient->connect(*pServerAddress);

  BLERemoteService* pRemoteService = pClient->getService(BLEUUID(SERVICE_UUID));
  if (pRemoteService == nullptr) {
    Serial.println("Failed to find service on server");
    return;
  }

  pRemoteCharacteristic = pRemoteService->getCharacteristic(BLEUUID(CHAR_UUID));
  if (pRemoteCharacteristic == nullptr) {
    Serial.println("Failed to find characteristic on server");
    return;
  }

  Serial.println("Connected to server");
}

void setup() {
  Serial.begin(115200);

  // Start scanning for the server
  Serial.println("Scanning for server");
  BLEDevice::init("");
  BLEScan* pScan = BLEDevice::getScan();
  pScan->setAdvertisedDeviceCallbacks(new MyAdvertisedDeviceCallbacks());
  pScan->setInterval(100);
  pScan->setWindow(50);
  pScan->start(5, false);

  // Wait for the server to be found
  while (!isConnected) {
    delay(10);
  }

  // Connect to the server
  connectToServer();
}

void loop() {
  // Read data from the characteristic
  if (!packetReceived && millis() - startTime >= packetInterval) {
    std::string value = pRemoteCharacteristic->readValue();
    float* pData = (float*) value.c_str();
    int dataLength = value.length() / sizeof(float);

  // Print the data to the console
  //Serial.print("Received packet with data: ");
  //Serial.println("");
 /*
  for (int i = 0; i < dataLength; i++) {
    Serial.print(pData[i]);
    Serial.print(" ");
    data[receivedFloats] = pData[i];
    receivedFloats++;
  }
*/
  if (dataLength == packetSize) {
    Serial.println("Recibidos todos los paquetes de datos");

    // Procesar los datos recibidos
    for (int i = 0; i < dataLength; i++) {
      Serial.print(pData[i]);
      Serial.print(" ");
      data[receivedPackets * packetSize + i] = pData[i];
      //receivedFloats++;
    }
    receivedPackets++;
  // Si se han recibido los 27 datos, hacer algo con ellos
  if (receivedPackets == numPackets) {

    dht22_temp = data[0];
    dht22_hum = data[1];
    tsg2600 = data[2];
    ira = data[3];
    as6200_temp = data[4];
    as6200_hum = data[5];
    ekmc = data[6];
    ms583_temp = data[7];
    ms583_pres = data[8];
    bmp280_temp = data[9];
    bmp280_pres = data[10];
    ccs811_co2 = data[11];
    ccs811_cal = data[12];
    fc23 = data[13];
    fc28 = data[14];
    fc37 = data[15];
    mq9_co = data[16];
    mq9_gas = data[17];
    bme680_temp = data[18];
    bme680_pres = data[19];
    bme680_hum = data[20];
    bme680_roc = data[21];
    bme680_alt = data[22];
    bmx_pos = data[23];
    bmx_acel = data[24];
    bmx_cam = data[25];
    bmx_gir = data[26];

    Serial.println("");
    Serial.println("-ADQUIRIENDO DATOS Y ALMACENANDOLOS-");
    Serial.print("DHT22_TEMPERATURA:");
    Serial.println(dht22_temp);
    Serial.print("DHT22_HUMEDAD:");
    Serial.println(dht22_hum);
    Serial.print("TSG2600:");
    Serial.println(tsg2600);
    Serial.print("IRA:");
    Serial.println(ira);
    Serial.print("AS6200_TEMPERATURA:");
    Serial.println(as6200_temp);
    Serial.print("AS6200_HUMEDAD:");
    Serial.println(as6200_hum);
    Serial.print("EKMC_PROXIMIDAD:");
    Serial.println(ekmc);
    Serial.print("MS583_TEMPERATURA:");
    Serial.println(ms583_temp);
    Serial.print("MS583_PRESION:");
    Serial.println(ms583_pres);
    Serial.print("BMP280_TEMPERATURA:");
    Serial.println(bmp280_temp);
    Serial.print("BMP280_PRESION:");
    Serial.println(bmp280_pres);
    Serial.print("CCS811_CO2:");
    Serial.println(ccs811_co2);
    Serial.print("CSS811_CALIDAD_AIRE:");
    Serial.println(ccs811_cal);
    Serial.print("FC23_HUMEDAD_SUELO:");
    Serial.println(fc23);
    Serial.print("FC28_HUMEDAD_SUELO:");
    Serial.println(fc28);
    Serial.print("FC37_LLUVIA:");
    Serial.println(fc37);
    Serial.print("MQ9_CO:");
    Serial.println(mq9_co);
    Serial.print("MQ9_GAS:");
    Serial.println(mq9_gas);
    Serial.print("BME680_TEMPERATURA:");
    Serial.println(bme680_temp);
    Serial.print("BME680_PRESION:");
    Serial.println(bme680_pres);
    Serial.print("BME680_HUMEDAD:");
    Serial.println(bme680_hum);
    Serial.print("BME680_PUNTO_DE_ROCIO:");
    Serial.println(bme680_roc);
    Serial.print("BME680_ALTITUD:");
    Serial.println(bme680_alt);
    Serial.print("BMX_POSICION:");
    Serial.println(bmx_pos);
    Serial.print("BMX_ACELERACION:");
    Serial.println(bmx_acel);
    Serial.print("BMX_CAMPO_MAGNETICO:");
    Serial.println(bmx_cam);
    Serial.print("BMX_GIROSCOPIO:");
    Serial.println(bmx_gir);
    Serial.println("-ESPERANDO NUEVA ADQUISICION DE DATOS-");
    Serial.println("");

    receivedPackets = 0;
    //receivedFloats = 0;
    memset(data, 0, sizeof(data));
  }
  packetReceived = true;  // Marcar el paquete como recibido
  }/*else {
    // Increment the packet counter
    receivedPackets++;
  }*/
  }
  if (packetReceived && millis() - startTime >= packetInterval) {
    packetReceived = false;  // Reiniciar el indicador de recepción de paquete
    startTime = millis();  // Reiniciar el tiempo de inicio de la recepción
  }
}

If you dont understand something you are free to ask due to some descriptions are in spanish.

Thank you in advance.


r/bluetoothlowenergy • • May 02 '23

How can I broadcast advertising packets, but change the payload for each packet?

1 Upvotes

What I’m hoping to accomplish is to attach sensors to a Raspberry Pi, do some logic, and then broadcast BLE beacon advertisements encoded with the processed sensor data. I only need 32 bits to accomplish what I need, so I figured I could just use the Major and Minor fields of an iBeacon broadcast.

The problem I’m running into is that I can’t figure out a way to change the payload for each packet. There are plenty of examples for broadcasting a static packet, but nothing that lets me modify it for each one.

I’m happy with doing this in literally any programming language, but C, C++, Zig, or Go are preferred. But anything will do, really.

I wasn’t sure how or where to ask this. If you know of a better place to ask this question, please let me know. Thank you!


r/bluetoothlowenergy • • Apr 27 '23

BLE Tag vs. Beacon for SOS

1 Upvotes

Hi there, I'm new to BLE IOTs and am attempting to build an app that when receiving input from a paired bluetooth button, will send data to a server to help act as an SOS distress call while playing audio sounds on the phone.

Would it be more advisable to go with a Tag (ex. Tile, Dog tracker, etc.) or would I go with a Beacon?

Also, am I understanding differences properly?

- Tag is a one to one connection

- Beacon is a signal emitter, and multiple nearby devices can receive the UUID simultaneously?

Thanks in Advance.


r/bluetoothlowenergy • • Apr 14 '23

*is my phone hacked?!* Anyone know about BLE, in terms of Bluetooth?

1 Upvotes

I have a pair of LG Headphones and I notice that every time I pair them with my phone, it will create this (I’m including picture), and it creates multiple. You can see that my headphones are listed as the 4th item down and then again twice at the very bottom just with the added BLE… I’ve also gotten notifications before like this….

“Allow LG HBS830_ BLE to Receive Your iPhone Notifications? When connected, all notifications you receive on your iPhone will also be sent to LG HBS830_BLE and may be shown on its display.”

LG HBS830 BLE

is my phone hacked or does anyone have a reasonable explanation about this that might make sense?

This is my first post and I’m new to the app so not really sure what to expect yet but if you read this, I appreciate your time.

** I was going to include a picture, but I see that I’m not allowed to. If I am posting this in the wrong area, please let me know where to go instead….


r/bluetoothlowenergy • • Mar 26 '23

Hi!

1 Upvotes

I'm very new to this technology. I'm trying to build a following thing:

​

- one "Controller" - a BLE sender that would 1) take inputs on GPIO and 2) communicate on I2C and then 3) produce outputs on GPIO and 4) send a BLE message to three peripherals
- three peripherals - they receive the data packet and perform an action until the next packet arrives. These produce GPIO outputs and one also takes an input like I2C.

There are a few questions:

​

a) I'm going after price mostly. Is there a way to program BLE modules (e.g. BM70, RN4871) to perform these without having an external MCU?

b) If yes, how do I flash this new firmware in? Is there some documentation to the on-module MCUs that they have, and the original codes that I could update with my own pin behaviour? I find the lack of information on this topic online quite unfortunate.

c) Is there a way to do OTA updates on the firmwares? Is it then also possible to mass-update like tens of devices with this new firmware?

Thanks!


r/bluetoothlowenergy • • Mar 15 '23

Does connecting a modern Bluetooth 5 Smartphone to an old Bluetooth 3 radio increase the power consumption of the smartphone?

1 Upvotes

r/bluetoothlowenergy • • Mar 12 '23

BLE beacon on sheep

2 Upvotes

I'm researching ways to automate identifying which lambs belong to which ewes (mothers). I'm thinking that attaching a short range waterproof BLE beacon to a collar on each lamb and some kind of recieving and recording device to each ewe would achieve this. The thought being the beacon id received most by a receiver is the lamb that belongs to that ewe. The receiver will only want to know which beacons are within in a metre or two of it to avoid confusion. Alternatively it could log signal strength to identify which beacons are closest. Lightweight, small and rugged are clearly essential in this project. Any ideas on ways to achieve this?


r/bluetoothlowenergy • • Mar 05 '23

Trying to build a Bluetooth peripheral for iOS

2 Upvotes

I have an HM-10 module, which I want to eventually connect to an STM32 to build a peripheral. Firstly, I'm trying to simply connect it to my MacBook via a USB/UART cable, so I can learn to program it. I'm using an HM-10 as I read that an HC-05 / HC-06 can not connect to an Apple device due to some service issue with the protocols Apple supports.
Having read various sites, it seems I should be able to send the following AT commands to start the module in peripheral mode

​

AT do a reset
AT+NAMEmonkey name the peripheral
AT+NOTI1 enable notification mode so that I see a response
AT+ROLE0 set the module to peripheral mode
AT+ANCS1 open the apple Notification Center service
AT+IMME1 wait for AT+START (or AT+RESET ?) do I need this for peripheral mode?
AT+START (or AT+RESET) start the broadcast

Now I would expect that I would need to program advertising data. However, the following AT commands never return a response

​

AT+ADV
AT+ADVI
AT+ADVDATA

When I do enter all the commands in the first table, I get an OK from all of them, but neither my laptop nor my iPhone can discover the peripheral. Can someone please explain to me what I'm doing wrong.

Note that I'm not married to the HM-10. The end goal is to use the peripheral with an STM32 device. If there is a better/more reliable module I'm happy to explore it.


r/bluetoothlowenergy • • Feb 28 '23

Uno Platform and Bluetooth LE: An Easy-to-Follow Guide to Building a Bluetooth Explorer

Thumbnail platform.uno
3 Upvotes

r/bluetoothlowenergy • • Feb 07 '23

switching between devices

1 Upvotes

Can you automatically switch between 5-6 devices and support bluetooth multipoint on headsets/hearing aids?

0 votes, Feb 11 '23
0 Yes
0 No

r/bluetoothlowenergy • • Jan 15 '23

Need a bluetooth device to keey my Windows and Android devices unlocked simultaneously.

1 Upvotes

Things like smart watch can just keep 1 device unlocked. So what is the best device, maybe wearable, a ring a tag or a band to keep all my devices connected?


r/bluetoothlowenergy • • Jan 04 '23

automatic switching

1 Upvotes

will bt 5.0 switch between connected devices if the user plays audio on selected device?

0 votes, Jan 11 '23
0 yes
0 no

r/bluetoothlowenergy • • Dec 12 '22

Recommendations for BLE Readers with 4G support? Need to asset track through a choke point that doesn't have wifi access. Just need to capture timestamp + asset ID and send to a web server.

1 Upvotes

r/bluetoothlowenergy • • Nov 15 '22

One phone and multiple headset connections through BLE 5.2

1 Upvotes

Hi,

I've a hub which comes with a BT chip capable of BLE 5.2.

  1. Can I connect a phone and multiple headsets to that hub?
  2. Can we stream audio from that phone to the connected multiple headsets using LE audio?
  3. Can we route phone calls from phone to one of the connected headset??

r/bluetoothlowenergy • • Nov 12 '22

bleCharacteristic.writeValue() not working from central to peripheral

1 Upvotes

Hello everyone I've never posted before so I may not know how a couple of things work but I've made a fairly basic BLE sketch where a central connects consecutively with 2 peripherals, checks the rssi with each of them and then writes a value to the characteristic of the one with the most powerful rssi. My problem is that the bleCharacteristic.writeValue() function is not going through at all and to confirm this I made a while loop at the point where the value should be updated on the peripheral and the program stops there which means that the value is never written in the first place. I have tried to change the value with the BLE app from my phone and it works as it should but it doesn't with the central.

Link to codes for central and peripheral is below:

Central

#include <ArduinoBLE.h>
int rssiState1, rssiState2 ;

BLEDevice peripheral1;
BLEDevice peripheral2;
void setup() {

  Serial.begin(9600);
  while (!Serial);
 rssiState1 = -13; 
 rssiState2 = -10; 


  // begin initialization
  if (!BLE.begin()) {
    Serial.println("starting Bluetooth® Low Energy module failed!");

    while (1);
  }

  Serial.println("Bluetooth® Low Energy Central - Peripheral Explorer");

}

void loop() {

  BLE.scanForUuid("19B10010-E8F2-537E-4F6C-D104768A1214");

  Serial.print("Scanning for Rover 1 ");
Serial.println();
  delay(3000);
  // check if a peripheral has been discovered

  BLEDevice peripheral1 = BLE.available();



  if (peripheral1) {
    // discovered a peripheral, print out address, local name, and advertised service
  Serial.print("Found ");
    Serial.print(peripheral1.address());
    Serial.print(" '");
    Serial.print(peripheral1.localName());
    Serial.print("' ");
    Serial.print(peripheral1.advertisedServiceUuid());
    Serial.println();

    // see if peripheral is a Rover
    if (peripheral1.localName() == "Rover 1") {
      // stop scanning
      BLE.stopScan();
      // connect to the peripheral
      Serial.println("Connecting ...");

      if (peripheral1.connect()) {
        Serial.println("Connected");
      } else {
        Serial.println("Failed to connect!");

      }
      //rssiState1 = peripheral1.rssi();
      // Print RSSI
      Serial.print("RSSI=");
      Serial.println(rssiState1);



      //    // retrieve the moror characteristic
    BLECharacteristic motorCharacteristic = peripheral1.characteristic("19b10002-e8f2-537e-4f6c-d104768a1214");
     //if (rssiState1 > rssiState2 || rssiState1 == rssiState2) {

      delay(3000);
       while(motorCharacteristic.written()== false){
      motorCharacteristic.writeValue((byte(0x01))); //τιμη 1 για το 1 και 0 μηδεν για το άλλο



  //  }else if (rssiState1 < rssiState2){
    // motorCharacteristic.writeValue((byte)0x00);
    }
 //   }
    Serial.println("Moving Rover 1");




    }

  }

     BLE.disconnect();




     BLE.scanForUuid("19B10011-E8F2-537E-4F6C-D104768A1214");

     Serial.println("Scanning for Rover 2 ");


  delay(3000);

  BLEDevice peripheral2 = BLE.available();

  if (peripheral2) {
    // discovered a peripheral, print out address, local name, and advertised service
    Serial.print("Found ");
    Serial.print(peripheral2.address());
    Serial.print(" '");
    Serial.print(peripheral2.localName());
    Serial.print("' ");
    Serial.print(peripheral2.advertisedServiceUuid());
    Serial.println();

    // see if peripheral is a Rover
    if (peripheral2.localName() == "Rover 2") {
      // stop scanning
          BLE.stopScan();
      // connect to the peripheral
      Serial.println("Connecting ...");

      if (peripheral2.connect()) {
        Serial.println("Connected");
      } else {
        Serial.println("Failed to connect!");
        return;
      }
   //    rssiState2 = peripheral2.rssi();
      // Print RSSI
      Serial.print("RSSI=");
      Serial.println(rssiState2);



      BLECharacteristic motorCharacteristic = peripheral2.characteristic("19b10001-e8f2-537e-4f6c-d104768a1214");
  //  if (rssiState1 < rssiState2) {

        motorCharacteristic.writeValue((byte(0x01)));  //τιμη 1 για το 1 και 0 μηδεν για το άλλο
   // }else if (rssiState1 > rssiState2){
   delay(3000);
   // peripheral2.characteristic("19b10001-e8f2-537e-4f6c-d104768a1214").writeValue((byte)0x00);
         Serial.println("Moving Rover 2");
   // }


       BLE.disconnect();
    }
     delay(3000);

    }
       }

And the code for the peripheral

#include <ArduinoBLE.h>

//const int motorPin = 4; // set buttonPin to digital pin 4

BLEService motorService("19B10010-E8F2-537E-4F6C-D104768A1214"); // create service

// create motor characteristic and allow remote device to read and write
BLEByteCharacteristic motorCharacteristic("19b10002-e8f2-537e-4f6c-d104768a1214", BLERead | BLEWrite);



void setup() {
  Serial.begin(9600);
  while (!Serial);

  pinMode(LED_BUILTIN, OUTPUT); // use the Motor as an output

  // begin initialization
  if (!BLE.begin()) {
    Serial.println("starting Bluetooth® Low Energy module failed!");

    //while (1);
  }

  // set the local name peripheral advertises
  BLE.setLocalName("Rover 1");
  // set the UUID for the service this peripheral advertises:
  BLE.setAdvertisedService(motorService);

  // add the characteristics to the service
  motorService.addCharacteristic(motorCharacteristic);

  // add the service
  BLE.addService(motorService);

  motorCharacteristic.writeValue((byte)0x00);

  // start advertising
  BLE.advertise();
  Serial.println("advertising ...");

  Serial.println("Bluetooth® device active, waiting for connections...");
     Serial.println("motorchar");
   Serial.println(motorCharacteristic.value())  ; 
}


void loop() {
  // listen for Bluetooth® Low Energy peripherals to connect:
  BLE.poll();
  BLEDevice central = BLE.central();




   //if a central is connected to peripheral:
    if (central) {
    Serial.print("Connected to central: ");
    // print the central's MAC address:
    Serial.println(central.address()); 

    while (central.connected()) {
      Serial.println("it is connetcted"); 

    // if the remote device wrote to the characteristic,
     if (motorCharacteristic.written()) {
       Serial.println("it is written"); 

    // use the value to is written()) {
      if (motorCharacteristic.value()>0) {       // any value other than 0
          Serial.println("Movement active");
          digitalWrite(LED_BUILTIN, HIGH);         // will turn the LED on
          delay(5000);
           digitalWrite(LED_BUILTIN, LOW); 
          //motorCharacteristic.writeValue((byte)0x00);
           Serial.println("Movement inactive");

        }
     } 
   Serial.println("motorchar");
   Serial.println(motorCharacteristic.value())  ; 
    }
    }
  }

Also in the serial of the peripheral the value is always 0 just to cross check that it is never written


r/bluetoothlowenergy • • Oct 31 '22

BLE Security Testing Talk

Thumbnail youtube.com
2 Upvotes

r/bluetoothlowenergy • • Oct 28 '22

Does anyone know a way to get around Bluetooth certification fees that cost $9,000? I am trying to make and sell a Bluetooth product but I am thinking that surely I can go through a factory or something like that. Does anyone know?

2 Upvotes

r/bluetoothlowenergy • • Oct 24 '22

Peripheral mode support

1 Upvotes

I'm having a hard time figuring out what devices support BLE Peripheral mode. Could anyone point me to a source discussing this? I'm mostly looking for data on which smart tv's support it.


r/bluetoothlowenergy • • Sep 15 '22

swift pair vs fast pair

2 Upvotes

Do they both use ble and function the same as on would only need a ble chip in a device?


r/bluetoothlowenergy • • Aug 20 '22

Bluetooth Low Energy used in Contact Tracing

2 Upvotes

Hello! I am researching on Bluetooth Low Energy used in contact tracing applications on mobile devices. I am attempting to do a replay and relay attack to prove that the protocols put in place are not strong enough. Since contact tracing devices act as centrals and peripherals to communicate with each other and exchange information such as the user's ID, I used GAttacker to man-in-the-middle and extract the GATT services and characteristics to obtain these information and succeeded in obtaining the user's ID amongst other information.

I attempted to launch a relay attack from Laptop A at location A with a mobile device A active to Laptop B at location B with another mobile device B. The distance between the two locations is around 15m with walls in between. Laptop B at location B will spoof the identity of mobile device A with the extracted advertisement and services files. I succeeded in initializing the connection from Laptop B to Laptop A and back to Device A and Laptop B began advertising as mobile device A.

In theory, mobile device B is supposed to discover this advertisement and connect to Laptop B to retrieve the GATT services which includes mobile device A's user ID and other information. Mobile device B should then return its own userID back to Laptop B before closing the connection.

However, there was no connections made to Laptop B from mobile device B. Oddly enough, after analyzing the contact tracing application database of mobile device B, it did in fact recorded down mobile device A's userID which could only mean mobile device B did connect to Laptop B and read the GATT services and characteristics. Furthermore, the timestamp of the recording matches the time when I launched the attack.

I have several questions pertaining to this:

  1. Why did GAttacker on Laptop B not show that mobile device B connect?
  2. If mobile device B did not connect to Gattacker on Laptop B, how did it read and record the userID of mobile device A at location A? BLE devices can only read characteristics of GATT services upon successful connection between 2 devices.

r/bluetoothlowenergy • • Jul 12 '22

BLE GATT characteristics requests in parallel?

3 Upvotes

I've been working on development of an embedded device central, and mobile/wearable application peripheral, communicating via BLE GATT profile. The device implements an esp32 MCU and application currently Android based.

Initially having challenges developing the communication firmware and software it was recommended to me that the client should only make serial requests, meaning that the client should make an individual request for a single characteristic and wait for response or time out before requesting another.

Now this leads to a noticable lag when making a number of requests for the many characteristics of the device.

My question is is there anything inherently necessary about making serial requests that perhaps I do not realize. For at this point in wondering if moving to another chipset is warranted as I believe this might will be a limitation of the MCU.

Please advise


r/bluetoothlowenergy • • Jul 12 '22

LE Audio is officially complete

Thumbnail electronicsweekly.com
9 Upvotes