detecting-bluetooth-low-energy-attacks

Use ubertooth-btle with the -p flag for promiscuous passive capture and -r to write pcapng output, for example ubertooth-btle -p -r capture.pcapng. To follow one specific device's connection across data channels, add -f -t with the target's MAC address.

Use the bleak library's BleakClient to connect to a device address, then iterate client.services to list each service's characteristics, properties, and descriptors. Flag characteristics with write or write-without-response properties that lack authentication.

No, crackle only works against BLE Legacy Pairing (Bluetooth 4.0/4.1) such as Just Works or 6-digit passkey exchanges. LE Secure Connections (4.2+) uses ECDH key exchange and cannot be cracked passively. Crackle also requires PCAP with PPI headers, not PcapNG.

Ubertooth One follows only one connection at a time across the 37 data channels, so busy environments require targeting a specific address with -t or deploying multiple sniffers. BLE 5.0 extended advertising on secondary channels also evades older Ubertooth firmware.

Capture a GATT write command, then retransmit the identical bytes to the same characteristic using bleak's write_gatt_char. If the device state changes without any nonce, timestamp, or challenge-response check, it is vulnerable to replay.

Yes, devices using resolvable private addresses (RPA) rotate their MAC periodically, breaking address-based tracking and connection following. Monitoring must rely on advertising data fingerprints and service UUID patterns instead of fixed addresses.