Inside Job: Diagnosing Bluetooth Lower Layers Using Off-the-Shelf Devices

TL;DR

This paper demonstrates how standard smartphones can be used to diagnose and analyze Bluetooth chip behavior internally, revealing lower-layer operations and diagnostic features without expensive external tools.

Contribution

It introduces a method to reverse engineer a diagnostic protocol inside Broadcom Bluetooth chips using off-the-shelf smartphones.

Findings

Enabled internal Bluetooth analysis on consumer devices

Revealed diagnostic features like LL sniffing and memory access

Demonstrated practical on-device Bluetooth diagnostics

Abstract

Bluetooth is among the dominant standards for wireless short-range communication with multi-billion Bluetooth devices shipped each year. Basic Bluetooth analysis inside consumer hardware such as smartphones can be accomplished observing the Host Controller Interface (HCI) between the operating system's driver and the Bluetooth chip. However, the HCI does not provide insights to tasks running inside a Bluetooth chip or Link Layer (LL) packets exchanged over the air. As of today, consumer hardware internal behavior can only be observed with external, and often expensive tools, that need to be present during initial device pairing. In this paper, we leverage standard smartphones for on-device Bluetooth analysis and reverse engineer a diagnostic protocol that resides inside Broadcom chips. Diagnostic features include sniffing lower layers such as LL for Classic Bluetooth and Bluetooth Low Energy (BLE), transmission and reception statistics, test mode, and memory peek and poke.

Tables

Table 1. Table 1. H4 field bytes indicating UART traffic types.

H4 Type	Command	Direction
HCI Command	0x01	Host $\to$ Controller
ACL Data	0x02	Host $\leftrightarrow$ Controller
SCO Data	0x03	Host $\leftrightarrow$ Controller
HCI Event	0x04	Host $\leftarrow$ Controller
Broadcom Diagnostics	0x07	Host $\leftrightarrow$ Controller
Message Queue Put	0x0a	Host $\leftrightarrow$ Controller
WICED Studio (evaluation kit only)	0x19	Host $\leftrightarrow$ Controller

Table 2. Table 2. Complete list of diagnostic features and their command codes on CYW20735B01 .

Diagnostic Feature	Command	Direction
LMP Sent	0x00	Host $\leftarrow$ Controller
LMP Received	0x01	Host $\leftarrow$ Controller
Memory Access Response to Peek	0x03	Host $\leftarrow$ Controller
Memory Hex Dump Response	0x04	Host $\leftarrow$ Controller
Reported Completed Test	0x0a	Host $\leftarrow$ Controller
Memory Access Response to Poke	0x11	Host $\leftarrow$ Controller
CPU Load Response	0x15	Host $\leftarrow$ Controller
Basic Rate ACL Stats Data	0x16	Host $\leftarrow$ Controller
EDR ACL Stats Data	0x17	Host $\leftarrow$ Controller
Received AUX Response	0x18	Host $\leftarrow$ Controller
SCO Stats Data (Type 0x1a)	0x1a	Host $\leftarrow$ Controller
eSCO Stats Data (Type 0x1b)	0x1b	Host $\leftarrow$ Controller
Get Connection Response	0x1f	Host $\leftarrow$ Controller
LCP Sent	0x80	Host $\leftarrow$ Controller
LCP Received	0x81	Host $\leftarrow$ Controller
Reset Basic Rate ACL Stats	0xb9	Host $\to$ Controller
Get Basic Rate ACL Stats	0xc1	Host $\to$ Controller
Get EDR ACL Stats	0xc2	Host $\to$ Controller
Get AUX Stats	0xc3	Host $\to$ Controller
Get SCO Stats (Type 0x1a)	0xc5	Host $\to$ Controller
Get eSCO Stats (Type 0x1b)	0xc6	Host $\to$ Controller
Get Connection Stats	0xcf	Host $\to$ Controller
Toggle LMP Logging	0xf0	Host $\to$ Controller
Memory Peek	0xf1	Host $\to$ Controller
Memory Poke	0xf2	Host $\to$ Controller
Memory Hex Dump	0xf3	Host $\to$ Controller
Run Test	0xf6	Host $\to$ Controller

Table 3. Table 3. LMP vendor specific BPCS packet types.

LMP BPCS Type	Purpose
0x00	Features Request
0x01	Features Response
0x02	Not Accept
0x03	BFC Suspend
0x04	BFC Resume Request/Response
0x05	BPCS Accept
0x95	Enable Device Under Test Mode (Vulnerability)

Table 4. Table 4. LCP vendor specific packet types.

LCP Extended Type	Purpose
0x01	Vendor Specific Feature Request
0x02	Vendor Specific Feature Response
0x03	Vendor Specific Enable BCS Timeline
0x04	Random Address Change

Full text

††journalyear: 2019††copyright: acmlicensed††conference: 12th ACM Conference on Security and Privacy in Wireless and Mobile Networks; May 15–17, 2019; Miami, FL, USA††booktitle: 12th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec ’19), May 15–17, 2019, Miami, FL, USA††price: 15.00††doi: 10.1145/3317549.3319727††isbn: 978-1-4503-6726-4/19/05††submissionid: 95

1. Introduction

Bluetooth is a widespread standard for short-range wireless communication. Initially developed as infrared replacement and for applications like wireless headphones in the ’90s, it is now spreading with Internet of Things (IoT) devices (Bluetooth SIG, 2019b). Features still making it interesting nowadays are BLE introduced in version 4.0, mesh networking in 5.0 and localization in 5.1 (Bluetooth SIG, 2016, 2017, 2019a).

A conventional Bluetooth diagnostic and sniffing setup requires external components and might necessitate wireless network infrastructure changes. A sniffer follows the frequency hopping scheme of a connection. Some devices only require basic connection establishment without pairing for encryption. To decrypt paired devices’ encryption, a sniffer must observe the initial Secure Simple Pairing (SSP) procedure, and if numeric comparison is used actively alter exchanged packets. Existing sniffing solutions range from professional but expensive Ellisys equipment to numerous open source solutions, the latter having less stable implementations to follow encryption and hopping, such as Ubertooth and Bluefruit (Ellisys, 2019; Great Scott Gadgets, 2019; Adafruit, 2019). None of these run on the analyzed off-the-shelf device itself.

Most likely users of such a setup are aware of sniffing. We assume sniffers are installed to legally observe and analyze traffic between devices the analyst owns. Typical use cases are to inspect security of a proprietary smartphone app communicating with a proprietary IoT device, or to analyze performance on the Physical Layer (PHY) of a smartphone app and IoT firmware under development.

Android devices offer the BTSnoop Log, a developer option, which only covers HCI containing messages exchanged between the operating system and the Bluetooth chip. HCI is the Bluetooth middleware layer, but lower layer packets are not directly encapsulated within HCI and hence cannot be observed this way. In contrast, traces sniffed over the air with an external sniffer only contain Classic Bluetooth Link Manager Protocol (LMP) and BLE Link Control Protocol (LCP) packets. The toolchain implemented in this paper captures both, HCI and LL traces, and can inject LMP packets. To the best of our knowledge, Bluetooth LLs did not experience security research yet, and we are the first to uncover major security issues within their implementations.

When reverse engineering symbols extracted from a Broadcom IoT BLE/ Basic Rate (BR) 5.0 evaluation kit firmware from 2018, we found an undocumented diagnostic serial protocol. A small subset of this diagnostic protocol is contained in Apple’s Bluetooth Explorer and Packet Logger on some MacBooks (Inc., 2019), but only allows some pre-configured usage for LL sniffing and is not further documented. Diagnostic features also include memory reading and writing as well as dumps inside the firmware, producing statistics for throughput, and controlling device under test mode.

Broadcom is ranked market leader for wireless communication chips, followed by Qualcomm and MediaTek (Ray and Erensen, 2018). The diagnostic protocol that we reverse engineered is not disabled on consumer devices and can be found throughout all smartphones with Broadcom chips we analyzed, such as Nexus 5/6P and Samsung Galaxy S6. Moreover it is supported by chips in Raspberry Pi 3/3+.

With this paper, we enable diagnostic mode on a variety of off-the-shelf devices and program software to control and interpret diagnostics. Our contributions are as follows:

• •

Implementation of live forwarding of diagnostic messages to a Linux host which can remotely control and analyze diagnostic mode including a live traffic view.

• •

Patching drivers of Android 6.0.1, Android 7.1.2 and LineageOS 14.1 to forward the diagnostic protocol.

• •

Enabling LMP injection.

• •

Showcase this is a powerful security analysis tool by discovering two Common Vulnerabilities and Exposures based on malicious LMP packets.

Source code for using Broadcom diagnostics with InternalBlue is publicly available on https://github.com/seemoo-lab/internalblue. It is the first zero cost sniffer for the Bluetooth LL.

This paper is structured as follows. Section 2 gives an overview on the Bluetooth protocol stack and explains how to utilize it. In Section 3, Broadcom’s diagnostic protocol features and inner workings are reversed. We apply this knowledge on the Android device, controllable and observable with Python scripts and Wireshark on a Linux host connected over Android Debug Bridge (ADB), and make first experiments in diagnostic mode including security flaw detection in Section 4. We discuss the outcome and Broadcom’s protocol design in Section 5. We conclude our findings in Section 6.

2. System Overview

Figure 1 gives an overview of the Bluetooth protocol stack and hardware components involved. The host system, in our case Android or LineageOS, has a Bluetooth driver providing communication services to applications. The controller, in our case a Broadcom chip, manages connections and performs wireless communication.

A diagnostic trace including HCI and LMP packets can be found in Figure 2. It is produced on Android by activating LL diagnostics through our custom patched Bluetooth driver and interpreting the output with our Wireshark dissector. Even though Bluetooth Media Access Control (MAC) addresses have the standard 6 byte format, only the lower 4 bytes are required to address devices (Michael Ossmann and Dominic Spill and Mark Steward, 2009). This is why diagnostic traces do not include the full MAC address.

2.1. Interface Between Operating System and Bluetooth Chip

Host and controller are connected via HCI as defined in the Bluetooth standard (Bluetooth SIG, 2016, p. 656). The host sends HCI commands to the controller, while the controller indicates HCI events happening. Events can be replies to commands, but they can also happen asynchronous. In Figure 2, the host initiates a connection and the controller confirms this directly with an event. Later this will be answered with a connect complete event, which can confirm successful connection establishment but also indicate a page timeout. The host is not aware of any LL actions performed between requesting connection establishment and the feedback if this succeeded.

HCI is controllable via a serial interface using Universal Asynchronous Receiver-Transmitter (UART). On Android systems it appears as /dev/HS99 or a similar number. For testing purposes the Android driver can be bypassed by directly writing to UART. A useful HCI command to determine if the controller is running on a Broadcom chip is reading local version information, which can be sent on an Android shell as follows:

⬇

echo -ne ’\x01\x01\x10\x00’ >/dev/ttyHS99

The first byte is set to 0x01 to indicate in an H4 header that the message will be an HCI command, as listed in Table 1. Following content is a standard compliant read local version information command. The controller answers with a command complete event containing version information.

The Android driver offers more convenient ways to control this serial interface. When compiled with the flag BT_NET_DEBUG=TRUE, it locally opens Transmission Control Protocol (TCP) port 8872 for sniffing and 8873 for injecting messages (Git, 2019a). Traffic to these ports can be forwarded over ADB to control them from a remote device. Message contents are restricted to H4 types 0x01-0x04 without Android source code changes.

2.2. Over-the-Air Communication Between Bluetooth Devices

Bluetooth devices use a PHY which is frequency hopping on 79 channels. The Bluetooth master in a piconet controls the hopping clock for all slaves. Communication can be encrypted based on keys exchanged with Elliptic Curve Diffie-Hellman (ECDH). Details of lower layers are abstracted from the host and only handled inside the controller. An overview of connection establishment steps followed by diagrams of HCI and LMP packets exchanged can be found in the Bluetooth specification (Bluetooth SIG, 2016, p. 1420).

Wireless Bluetooth sniffers aim to extract management protocols exchanged over the air. On Classic Bluetooth this protocol is LMP, while it is LCP for BLE. To successfully decrypt wireless message contents, an over-the-air sniffer must be present during initial pairing and succeed in following the hopping sequence. If the latter fails, SSP must be manually repeated multiple times.

A sniffer implemented inside the Bluetooth controller is not required to observe the initial pairing for demodulation and decryption. The controller knows all necessary connection information and keeps internal states of not yet modulated, respectively demodulated, LMP and LCP messages. This is the case for the setup in this paper. Observing messages inside the Bluetooth controller comes with the challenge to locate and extract this information.

3. Reversing the Diagnostic Protocol

Broadcom enables testing their newest chipsets with evaluation boards. The most recent available Bluetooth platform is CYW920735 Q60EVB-01, an IoT BLE/BR 5.0 evaluation kit 111Cypress recently acquired some IoT branches of Broadcom, but despite the name change firmware and features are similar., which is not only meant to offer Bluetooth connectivity but also has sufficient memory to run an IoT application within the same chip. This application can be programmed in WICED Studio (Corporation, 2019). When reversing firmware of the evaluation kit we realized that the custom application thread for the IoT platform is using the same thread setup functions as existing threads within the Bluetooth firmware, suggesting that there might be common bindings for several functions inside the Bluetooth firmware within WICED Studio. In fact, a file called patch.elf contains all symbols of the evaluation kit Bluetooth chip’s firmware CYW20735B01. In addition the library wiced_hidd_lib.a contains struct and parameter names, but correct mappings are harder to locate in this format.

3.1. Accessing the Link Layer

Being interested in lower layers, the function names diag_logTxLmpPkt, diag_logRxLmpPkt and diag_logLcpPkt stand out. All of these first check if diag_sendLmpPktFlag is set, and then copy data to call the function tran_sendDiagDataToHost. However, the opposite data flow must be found to enable logging. When checking references to the flag enabling sending LL diagnostic logging data to the host, the function diag_processCommand appears. The diagnostic command 0xf0 followed by 0x01 enables logging, while 0xf0 followed by 0x00 disables logging.

Further analysis of diag_processCommand shows that enabling LL logging is not the only diagnostic command. An overview of all commands and answers generated is shown in Table 2. An incomplete list of commands and their meanings is contained in Apple’s Packet Logger, which is part of the additional tools for Xcode. Not all MacBooks support LL logging with Xcode tools. In our experiments it worked on a MacBook Pro from 2011, but could not be enabled on a MacBook Pro from 2016.

3.2. Diagnostic Command Processing

The function actually receiving diagnostic commands turns out to be btuarth4_HandleRXFullMsgDone, which does not only parse H4 types 0x01-0x04, but accepts one documented message type 0x19 for WICED application debugging and the undocumented diagnostic message type 0x07. Upon receiving a message starting with 0x07, the function btuarth4_process_diag is called, which then calls the function of interest, diag_processCommand. A further undocumented H4 communication channel for putting messages into send queues is 0x0a, but we could only find it on Raspberry Pi 3/3+. Table 1 also lists Broadcom proprietary H4 types.

Diagnostic Control Commands

The biggest challenge is that some diagnostic commands and message contents are unknown and unnamed. The Wireshark dissector developed in Section 4.2 can be optimized by programming a first version, recording traces, analyzing missing fields, adding them to the dissector, and then recording another round of traces. Debugging and reversing of further fields takes a lot of time and some of their contents are still to be guessed, such as the statistic types 0x1a and 0x1b in Table 2. Nonetheless, we support decoding most of the outputs including BR and Enhanced Data Rate (EDR) statistics with an example given in 3(a). Statistics summarize packets transmitted and received along with errors occurred—now observable even without continuous monitoring.

Memory Access

Diagnostic memory access is similar to what is provided over HCI. Documented HCI commands are Read_RAM and Write_RAM (Corporation, 2018), which can modify memory of the ARM core inside the chip. An undocumented HCI command that can modify the Bluetooth modem BlueRF memory is SuperDuperPeekPoke (0xfc0c). The Bluetooth modem is a separate component on the chip, which is responsible for modulation.

Diagnostic memory peek (0xf1) and memory poke (0xf2) allow reading and writing single memory bytes. The first memory peek and poke argument is the access type, which can be ARM memory (0x02) or BlueRF modem memory (0x03). The second argument is a 4 byte reverse byte order address. For memory poke, this is followed with the 1 byte value written to this address. Memory hex dump (0xf3) needs always to be passed access type ARM memory (0x04) and a 4 byte address. It returns 32 bytes memory content starting from the address passed.

Diagnostic memory access has fewer message overhead and parsing steps and therefore suits better than HCI for observing variable contents while debugging firmware behavior.

Test Mode

The test command (0xf6) configures a test with similar parameters as LMP_test_control over the air. More interesting is the possibility to get a summary of a test status. The test status is received within the diagnostic test response (0x0a) and includes the number of transmitted and received test packets. To get this basic test information no external test equipment is required.

3.3. Compatibility

After searching for similar H4 message type switch cases in other Broadcom Bluetooth firmware versions it turns out that btuarth4_HandleRX is implemented throughout multiple firmwares, such as BCM2070B0 (MacBook Pro 15” early 2011, Lenovo Thinkpad T420), BCM4335C0 (Nexus 5, Xperia Z3 Compact, Samsung Galaxy Note 3), BCM43430A1 (Raspberry Pi 3), BCM4345C0 (Raspberry Pi 3+), BCM4358A3 (Nexus 6P, Samsung Galaxy S6, Samsung Galaxy S6 edge), and CYW20735B01 (IoT BLE/BR 5.0 evaluation kit). Their build dates range from 2008 to 2018. We do not have a complete set of Broadcom and Cypress Bluetooth firmwares but assume this feature is present on all of their chips.

4. Implementation

Reversing diagnostic commands is only the first step in using them on off-the-shelf devices. Further required steps are patching the operating system’s driver to forward and process diagnostic messages, as explained in Section 4.1, displaying them human readable in a Wireshark dissector, described in Section 4.2, using them in active Bluetooth connections to do first tests (Section 4.3), and based on intermediate results improve the Wireshark dissector. Finally, we uncover security issues within LMP parsing inside Broadcom firmware we detected on various chips in Section 4.4.

4.1. Patching Bluetooth on Android

On Android 6.0.1, Android 7.2.1 and LineageOS 14.1, the Bluetooth stack is implemented similarly. The biggest design problem is that H4 types from Table 1 as well as their directions and lengths are hardcoded in multiple places. This makes the required changes 44 lines of code in Android 6.0.1, and 41 lines of code in Android 7.2.1 and LineageOS 14.1. Again, the driver needs to be compiled with the flag BT_NET_DEBUG=TRUE to enable injection and sniffing as described in Section 2. A properly compiled Bluetooth driver results in a file bluetooth.default.so, which can be copied to the according system folder as privileged user.

Android 8 introduced major changes to the Bluetooth driver. The basic driver is still using similar code. In addition, interfaces are introduced—for components that should not be changed, since changes are Application Binary Interface (ABI) breaking and might stop other programs from working properly. The code of the new interfaces IBluetoothHci and IBluetoothHciCallbacks defines functions and callbacks for H4 types 0x01-0x04 (Git, 2019b). This means introducing new H4 types to Android 8 is an ABI breaking change, so we decided to currently not support it.

4.2. Wireshark Dissector

Programming a Wireshark dissector for the Broadcom diagnostic protocol creates some challenges. To ensure a good performance along with portability, we implement the dissector as a plugin in C.

As mentioned in Section 3.2, the actual challenge in writing a dissector is to reverse engineer undocumented fields. We were able to reverse engineer almost all fields of the diagnostic protocol, the only missing part being the meanings of Synchronous Connection-Orientated (SCO) and auxiliary (AUX) statistics.

Luckily the LLs, LMP for Classic Bluetooth and LCP for BLE, are described in the Bluetooth specification (Bluetooth SIG, 2016, p. 508, p. 2589).

For LMP, a C-based dissector that can be integrated already exists (Spill, 2019). Unfortunately the Broadcom diagnostic protocol deviates from specification: it always reports the maximum length of 17 bytes for received packets. This needs to be fixed before passing these packets to the existing LMP dissector. Moreover, Broadcom implements an undefined LMP packet type 0x00 which is used for Broadcom Proprietary Control Signaling (BPCS), as listed in Table 3. This feature is only used within Broadcom Bluetooth connections, we were able to observe it during a Nexus 5 and Samsung Galaxy S8 pairing. A sample LMP trace was already explained for Figure 2.

Dissectors can also be found for LCP, but they are either not C-based or not accepting the same header format, so we decided to implement a dissector from scratch. Broadcom again added their own features, this time using LCP type 0xff with meanings listed in Table 4. A trace for a BLE enabled child toy train that can make sounds and change driving speed with an app is shown in 3(b). Overall, LCP is more simplistic than LMP and requires fewer messages exchanged to establish and manage connections. Traces include the full MAC address of the connected device.

4.3. Performance

While enabling diagnostic logging or making statistic and memory requests we did not recognize any performance issues or packet loss while a connected headset was playing music. Upon initialization of the UART interface, the operating system updates the baud rate to 3 Mbit/s. This result is not surprising as the maximum throughput of EDR is also 3 Mbit/s.

4.4. LMP Injection and Security Analysis

Broadcom not only implements an undocumented diagnostic H4 interface. The standard compliant way of allowing modifications are vendor specific HCI commands—we were able to reconstruct 259 command names and some of their parameters. In the context of LL, SendLmpPdu (0xfc58) is the most interesting—it turns our diagnostic sniffer into an LMP injector. LMP packets are still validated against standard compliant opcodes and lengths when sent with this function, but except from this limitation any active connection handle can be selected as receiver. While testing this feature we already discovered two major security issues, CVE-2018-19860 and CVE-2019-6994, and reported these to Broadcom.

Security Issues within Broadcom Firmware

The first security issue CVE-2018-19860 is related to boundary checking of LMP opcodes. Handler tables define which function to execute upon receiving a packet with a certain opcode. When implementing the vendor specific BPCS packet type, Broadcom forgot to apply an opcode range check. Any opcode larger than 0x05, the maximum defined in Table 3, potentially executes a function. Compilers tend to put multiple handler tables after each other. On Nexus 5 (BCM4335C0), the LMP BPCS handler table is followed by HCI handler tables. With this vulnerability, an attacker can issue HCI commands over the air, which should only be possible as privileged user on the host. For example the LMP BPCS opcode 0x95 is mapped to the command HCI_enable_device_under_test_mode. Executing test mode can be used make the target device jam selected frequencies and drains battery. Depending on the firmware version memory contents differ, but limited code execution is probably possible on most chips. If invalid addresses are executed, the Bluetooth of the device under attack simply crashes. Vulnerable devices include MacBook Pro 2016 and Raspberry Pi 3. Even the iPhone 6 was vulnerable to this issue until it was fixed in iOS 12.1.3.

The second vulnerability CVE-2019-6994 happens on out of order execution of LMP commands. An attacker initiates SSP but does not wait for user confirmation or cancellation of the pairing procedure. Instead he directly sends an LMP_start_encryption_req, which causes the Bluetooth firmware of the device under attack to crash. The crash happens within the bignum_xormod calculation. This issue only is present on very old chips such as Nexus 5 (BCM4335C0).

To exploit any of the vulnerabilities above, Bluetooth must be turned on. The attack can be performed by anyone connecting to the device, previous pairing is not required. An attacker only needs to know the MAC address, the device can be invisible.

Commercial Bluetooth Stack Issues

Discovery of the LMP issues inspired us to implement an MAC address based firewall that only allows connections from previously paired devices such as the user’s headset. Any LMP request originating from an untrusted MAC address is answered with LMP_not_accepted. This patch performs well on the protected device.

When testing this filter in the wild we found that on iOS devices Bluetooth restarts exactly one minute after trying to establish a connection to a firewalled device. The cause for this is bluetoothd, the Bluetooth host implementation on iOS, which decides to restart upon unexpected behavior—in this case a timeout from the HCI create connection command, which does not return an HCI event as expected. Restarting Bluetooth is not necessary in this context and terminates currently established connections. Most likely Apple implemented this as a workaround for instabilities inside the Bluetooth firmware. We reported this bug to Apple in December 2018 but did not get any feedback yet.

5. Discussion

Integrating diagnostic features into a Bluetooth chip is something probably all Bluetooth chip manufacturers require in their development process. Leaving these in production level firmware builds in combination with obscuring them by not documenting the corresponding interfaces can be considered a bad practice and only provides security by obscurity.

Our previous work already enables LMP monitoring and injection on the BCM4335C0 chip in Nexus 5 (Mantz, 2018). We used assembly firmware patches and recompiled Android drivers, with the former making it hard to port to other devices. It did not include LCP logging and the other diagnostic features listed in Table 2.

Security issues in the LMP handler were discovered while actually trying to reverse engineer and explore features. Code execution within LMP BPCS parsing was found when trying to figure out what this proprietary handler is doing. An LMP_start_encryption_req was sent accidentally when confusing the maximum valid LMP length field with the opcode field, which both are 17. Most likely Bluetooth LLs did not experience proper testing due to lack of openly available tools—a gap we aim to close with this paper.

6. Conclusion

Once reverse engineered, the Broadcom diagnostic protocol offers a lot of options and is easy to use. In future releases of Bluetooth stacks this could become a debug feature integrated by default.

Future work will be porting Broadcom diagnostics to further protocol stacks, such as BlueZ in Linux (Holtmann, 2019). Linux integration should be straightforward, sockets for interception and injection are provided by default. Diagnostic commands are filtered, hence some code changes are required. Our reverse engineering results already confirm Broadcom diagnostics exist in Bluetooth chips of Raspberry Pi 3/3+, which are even cheaper than Android smartphones.

Bluetooth plays an important role in security critical application areas such as the IoT. By reverse engineering the Broadcom diagnostic protocol and providing an open source analysis framework, we enable advanced on-device analysis of lower layer Bluetooth protocols—the remote device under test can be from any vendor.

During the development process, we already discovered critical vulnerabilities in the implementation of the LL protocols in widely deployed Bluetooth firmware. It is to be expected that LL parsing in Bluetooth firmwares of other vendors has similar bugs. We encourage researchers to dig deeper into wireless firmware in general, especially if little is known or documented.

Acknowledgements.

We thank Broadcom for providing patches to vendors. This work has been funded by the dfg within sfb 1119 crossing and sfb 1053 maki, and the bmbf and the State of Hesse within crisp-da.