Attacking Bluetooth LE Design and Implementation in Mobile + Wearables Ecosystems
Channel: FIRST
Date: 17/06/2021

Speakers: Sunil Kumar (Deep Armor, IN), Nitin Lakshmanan (Deep Armor, IN)

Consumer IoT devices manifest in a variety of forms today, including fitness trackers, rings, smart-watches, pacemakers, and so on. The wearable IoT market is dominated by small and medium-sized business, who are often in a rush to hit the shelves before their competitors, and trivialize the need for security in the bargain, citing no “return on investment”. In our presentation, we deep-dive into the wireless protocol of choice for wearables — Bluetooth Low Energy (BLE), and its impact from a security perspective. We use a USB-based bluetooth hacking hardware board called Ubertooth-One to analyze popular market products, and also perform a live demo on stealing information from a fitness tracker using standard Android app development practices. We wrap up with a discussion on simple cryptographic approaches and BLE-hardening mechanisms to prevent such attacks on wearable and IoT platforms.

About the Speakers
Sunil is an industry expert in security research, product security assessment and risk management. He has worked extensively on threat modeling and penetration testing of Web applications, IoT products, Cloud infrastructure and mobile solutions. Sunil is skilled in JavaScript and Python scripting, and has developed numerous security tools and applications. He regularly speaks at local and international security conferences, including at FIRST Annual Conference, FIRST TC, ISC2 events, and soon. He currently works as a Principal Security Analyst at Deep Armor. Prior to that, Sunil worked as a security engineer for Ola Cabs and Aricent Technologies.

Nitin Lakshmanan is a Senior Security Analyst at Deep Armor. He is skilled in SDLC methodologies and security assessment of IoT platforms, web applications, mobile solutions and thick client applications. He has developed advanced tools for infrastructure security assessment of modern cloud platforms, with special focus on AWS. Prior to his job at Deep Armor, Nitin worked for Aricent Technologies and Aujas Networks. Nitin regularly speaks at security conferences and conducts trainings/workshops on IoT and Cloud topics. Nitin has conducted training at Black Hat USA