Bluetooth and IoT Wireless Threats

Bluetooth is a short-range wireless technology (typically 10-100 meters) operating in the 2.4 GHz ISM band. It uses frequency hopping spread spectrum (up to 1600 hops per second) which provides some resistance to interference and casual eavesdropping. Bluetooth devices pair by exchanging a PIN or using Secure Simple Pairing (SSP). Security+ tests knowledge of Bluetooth-specific attacks, the security modes available in Bluetooth classic and BLE (Bluetooth Low Energy), and controls to minimize the attack surface of Bluetooth-enabled devices.

Bluejacking is a relatively benign attack that sends unsolicited messages to discoverable Bluetooth devices. It requires the target to have Bluetooth in discoverable mode and exploits the device's contact-sharing feature to push a vCard or message. More serious is bluesnarfing, which exploits vulnerabilities in the OBEX Push protocol to access contacts, calendar data, and files on a target device without pairing authorization. Bluesnarfing was a significant concern in early Bluetooth implementations (pre-2004) but has largely been patched in modern devices. Both attacks require proximity to the victim.

Bluebugging exploits Bluetooth vulnerabilities to gain unauthorized control of a target device — making calls, reading messages, or intercepting communications — by abusing AT commands over Bluetooth. The BIAS (Bluetooth Impersonation Attacks) vulnerability (2020, CVE-2020-10135) affects the Bluetooth BR/EDR specification itself, allowing an attacker who has previously paired with a device to impersonate the remote device during authentication, bypassing the pairing process. BIAS affected almost all Bluetooth implementations until vendors released firmware patches. Keeping firmware updated is the primary defense.

Bluetooth Low Energy (BLE) is used in fitness trackers, medical devices, smart home gadgets, and beacons. BLE uses advertisement packets that devices broadcast continuously so other devices can discover them. These advertisements may contain device identifiers that can be used for tracking — following the physical location of a person based on their BLE devices. BLE connections with weak or no pairing (Just Works mode) can be sniffed and manipulated. Medical IoT devices using BLE with weak authentication pose particular risk because unauthorized commands can affect patient safety.

IoT (Internet of Things) devices — cameras, smart thermostats, industrial sensors, medical monitors — introduce unique security challenges. They are often resource-constrained, running simple firmware that rarely receives security updates. Many ship with default credentials that users never change. IoT devices expand the attack surface dramatically: in 2016, the Mirai botnet compromised hundreds of thousands of IP cameras and DVRs using default credentials (admin/admin, root/root) and used them to launch massive DDoS attacks. Each unsecured IoT device is a potential entry point.

The most effective network-level control for IoT devices is segmentation. IoT devices should be placed on a dedicated VLAN with highly restrictive firewall rules that allow only the specific outbound connections required for their function. Inbound connections from other internal network segments should be blocked entirely. For example, a smart thermostat may need outbound HTTPS to its cloud service but should never be able to initiate connections to internal file servers or databases. This limits the blast radius if a device is compromised.

Zigbee (IEEE 802.15.4) and Z-Wave are mesh networking protocols widely used in smart home and building automation. Zigbee uses AES-128 for encryption but security depends on key management: the trust center link key and network key must be protected. Early Zigbee implementations transmitted the network key in plaintext during device joining, allowing passive eavesdroppers to capture it. Z-Wave S2 (Security 2) improved this significantly. Researchers have demonstrated attacks including replay attacks on Z-Wave door locks that captured and replayed unlock commands.

NFC operates at 13.56 MHz with a range of about 4 cm. It is used for contactless payments, access badges, and device pairing. Despite the very short range, NFC is not immune to attacks. Eavesdropping on active NFC communication has been demonstrated at ranges up to 1 meter with sensitive antennas. Relay attacks use two colluding devices to extend the range of NFC, allowing an attacker near a victim (e.g., in a crowd) to relay the NFC signal to an accomplice at a payment terminal. This is a known threat to contactless payment systems.

RFID (Radio Frequency Identification) is used in access badges, asset tracking, and supply chains. Passive RFID tags respond when powered by a reader's RF field and have no internal power source. Security issues include cloning (copying a legitimate badge to a blank tag using a Proxmark or similar reader), eavesdropping (capturing tag-to-reader transmissions from nearby), and replay attacks. Legacy HID cards at 125 kHz (EM4100, HID Prox) have no encryption and are trivially cloned. Modern smart card systems (13.56 MHz MIFARE DESFire, SEOS) use AES encryption and mutual authentication.

Practical controls for Bluetooth security include: set devices to non-discoverable mode when not actively pairing; use Secure Connections (Bluetooth 4.1+ with P-256 ECDH key exchange) instead of legacy Simple Pairing; require Numeric Comparison or Passkey Entry instead of Just Works pairing; enforce a minimum pairing PIN length; and apply manufacturer firmware updates promptly since many Bluetooth vulnerabilities are fixed via firmware. For corporate devices, MDM can disable Bluetooth entirely or restrict it to specific use cases.

IoT devices are often deployed for 5-15 years but receive firmware updates for only 2-3 years — leaving a large window of exposure. Organizations should include IoT in their asset inventory with model, firmware version, and end-of-support date tracked. When vendor support ends, devices should be replaced or isolated behind strict network controls. For critical systems, use IoT-specific security platforms (Azure Defender for IoT, Armis, Claroty) that passively profile device behavior and alert on anomalies without requiring agents on the devices.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: Bluetooth attacks including bluejacking, bluesnarfing, and BIAS exploit short-range wireless vulnerabilities and are mitigated by disabling discoverability and applying firmware patches, IoT devices pose significant risk due to default credentials, infrequent updates, and large deployment scale — mitigated with network segmentation and dedicated IoT VLANs, and RFID and NFC technologies used in access badges and payments face cloning and relay attack threats that require strong encryption and mutual authentication. Next up we explore phishing, spear phishing, and whaling attacks.