Pith. sign in

REVIEW 4 major objections 7 minor 34 references

Stealtooth: Breaking Bluetooth Security Abusing Silent Automatic Pairing

T0 review · 4 major / 7 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Automatic Bluetooth pairing can be silently abused to overwrite a paired device's link key, letting an attacker hijack sessions and, in an extended form, act as a man-in-the-middle.

desk verdict A plausible new attack surface, but the central claim of silent link-key overwrite is asserted from pass/fail device tests rather than demonstrated at the protocol level. read the letter →

arxiv 2507.00847 v2 pith:UOCGTZ4B submitted 2025-07-01 cs.CR cs.NI

Keiichiro Kimura , Hiroki Kuzuno , Yoshiaki Shiraishi , Masakatu Morii This is my paper
classification cs.CRcs.NI
keywords BluetoothBR/EDRsecurityautomaticpairinglinkkeyoverwriteimpersonationattackman-in-the-middleA2DPaudiointerceptionconsumerdevicesStealtooth
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that Bluetooth's convenience feature of automatic pairing is a security hole that can be exploited from off-the-shelf hardware. The Stealtooth attack impersonates a previously paired device; when the real paired device is off and the victim headphone or speaker tries to reconnect, it silently enters pairing mode and accepts the impostor as a new partner. This overwrites the link key that had been shared with the legitimate device, and the victim gets no notification or prompt. In tests against 10 commercial audio devices from major manufacturers, 8 fell to the attack, and 4 also fell to a man-in-the-middle extension that intercepts or replaces audio. The paper argues this reveals a systematic, implementation-level weakness in automatic pairing, not a flaw in the Bluetooth specification alone.

What carries the argument

The mechanism that carries the attack is the automatic pairing mode implemented in Bluetooth audio device firmware: a state the device enters on its own after a failed reconnection to a previously paired device, in which it will complete pairing with any device bearing the remembered name and address. The attacker's counterpart machinery is address and name spoofing, which the paper demonstrates with commodity hardware and the standard Linux Bluetooth stack. The decisive step is that the victim device treats a failed authentication as a trigger to re-pair rather than as a reason to stop, and does so without surfacing any confirmation UI.

What would settle it

Run the paper's reproduction scenario with a Bluetooth protocol analyzer in front of the same ten devices and check whether any of the eight claimed-vulnerable models shows a user-visible prompt, emits a notification, or refuses the pairing unless an explicit pairing command is entered; any such observation for a device listed as vulnerable would refute the silent-overwrite claim for that device.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that many Bluetooth audio devices, after failing to reconnect to a previously paired device, transition into a pairing mode that accepts a new link key with no user confirmation and no notification. An attacker only needs to copy the name and Bluetooth address of the legitimate paired device, make the adapter discoverable, and wait for the reconnection attempt. In the first pattern Bob, the audio device, actively initiates pairing with the impersonator; in the second, Bob disconnects after an authentication failure and then pairs when the impersonator sends a connection request. In both cases the old link key is invalidated and replaced by one shared with the attacker, so the legitimate device can no longer reconnect. Combined with the sleep-mode Breaktooth attack, the same mechanism becomes a man-in-the-middle attack: the attacker holds separate link keys with both victims and can intercept or substitute audio traffic.

Load-bearing premise

The load-bearing premise is that the tested devices really do enter automatic pairing mode after a failed reconnection and accept a spoofed device's pairing without any user prompt or notification; the paper asserts this behavior from its device evaluations rather than showing the raw Bluetooth traffic, and the attack also depends on the legitimate paired device being powered off or out of range at the moment of the reconnection attempt.

Editorial extensions

If this is right

  • If the paper is right, an attacker with a commodity single-board computer and open-source Bluetooth software can silently take over the pairing relationship of most off-the-shelf Bluetooth headphones, earbuds, and speakers, and the legitimate paired device will be locked out until users notice and re-pair.
  • The man-in-the-middle variant means audio streams can be intercepted and, on some devices, swapped with different audio, without jamming or any user-visible interruption.
  • Because the vulnerability is in firmware behavior rather than the Bluetooth specification, patching requires device vendors to change automatic pairing policies; the paper reports that Sony has already released patches for the tested devices it notified.
  • Protocol-level defenses such as standardizing automatic pairing behavior and validating link key replacement would close the whole class of attacks across manufacturers, but would require industry coordination and backward-compatible design.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension is to test non-audio peripherals with automatic pairing, such as keyboards, mice, and car hands-free systems; the paper's device list is all audio, but the vulnerability pattern is tied to firmware behavior rather than to the audio profile itself.
  • The attack's dependence on the legitimate device being off or unreachable suggests an attacker can time deployment with session monitoring, which strengthens the paper's claim that silent takeover is realistic rather than merely theoretical.
  • A concrete testable extension would be to run the attack with a Bluetooth protocol analyzer to see whether the silent re-pairing happens through a standard Secure Simple Pairing exchange or through a fallback legacy authentication; that distinction would tell where the fix belongs in the protocol stack.
  • The paper's own device-level evidence leaves open the possibility that some devices may resist the attack after firmware updates, so a longitudinal re-test of the same models would clarify whether the vulnerability is a persistent design pattern or a transient implementation bug.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. The paper introduces Stealtooth, an attack that claims to silently overwrite the Bluetooth link key shared between two previously paired devices by abusing automatic pairing modes in commercial Bluetooth audio devices. In the threat model, an attacker Mallory impersonates Alice, makes herself discoverable, and waits for Bob to attempt reconnection while Alice is unavailable. The paper describes two patterns, depending on whether Bob or Mallory initiates the connection, and claims that Bob enters automatic pairing mode after authentication failure and pairs with Mallory without user notification. The attack is then extended into a MitM attack by combining it with the authors' prior Breaktooth attack. The evaluation reports that 8 of 10 commercial headsets are vulnerable to Stealtooth and 4 of those are vulnerable to the MitM variant, with A2DP audio interception demonstrated. The paper also proposes device-level and protocol-level defenses and reports responsible disclosure.

Significance. If the central mechanism were convincingly demonstrated, this would be a significant contribution: it identifies a new attack surface in automatic pairing implementations, shows that it affects devices from multiple major manufacturers, and demonstrates a low-cost, low-skill attack path. The work is also strengthened by the practical evaluation with commodity hardware, the open-source Breaktooth toolkit used for the MitM extension, and the reported vendor disclosure with acknowledged patches. However, the current evidence does not yet establish the load-bearing claim of silent, automatic link-key overwriting at the protocol level, so the significance is conditional on the mechanism being substantiated with proper traces and controls.

major comments (4)
  1. [Section 6.4.1 and Table 4] The central claim of silent link-key overwriting is supported only by a binary pass/fail table. There are no repeated trials, no defined success criteria, no HCI/LMP packet captures, no indication of what was observed at the user interface, and no evidence that the stored link key was actually replaced. The text 'the successful attacks demonstrate complete link key overwriting without any user notification or intervention' is therefore an assertion, not a demonstrated result. To substantiate this claim, the paper should provide at least one btsnoop/HCI log per pattern showing a failed authentication followed by a successful Secure Simple Pairing exchange, a method for verifying that LK_AB was invalidated (e.g., by showing that Alice can no longer reconnect until re-pairing), and evidence that no visible or audible notification was presented on Bob.
  2. [Section 4.2, Pattern#1 and Pattern#2] The root-cause description asserts that Bob 'actively executes pairing' after authentication failure, or that Bob 'transitions to automatic pairing mode' and then pairs with Mallory. This causal link is not demonstrated. The observed outcome is equally consistent with Bob entering pairing mode on power-on or on reconnect timeout independently of Mallory, or with Bob establishing a legacy or unauthenticated connection that did not overwrite the link key. The paper should include control experiments, for example: does Bob enter automatic pairing mode when Alice is absent but Mallory is not spoofing Alice? Does the same pairing occur with a device that merely has Alice's name and address but no impersonation of the audio profile? Does the timing of Bob's entry into pairing mode correlate with Mallory's presence? Without such controls, the claimed vulnerability in automatic pairing mode is not distinguished from normal device behavior.
  3. [Section 7.2.1 and Section 4.1.1] The paper's own limitations section states that success 'depends on specific timing conditions' and that 'the probabilistic nature of these timing dependencies means that attacks may require multiple attempts to succeed.' This is in tension with the abstract's and Section 4.1.1's claims of a 'completely silent' attack with 'no user awareness.' If multiple attempts are needed, or if the attack requires Alice to be off and Bob to be powered on at precisely the right moment, these conditions and their observability should be stated in the attack model. Similarly, Section 6.4.2 reports that for WH-1000XM4 and WF-1000XM4, AS#2 was achieved only after 'establishing the connection, disconnecting briefly, and reconnecting to properly grant profile access permissions.' That procedure is itself observable behavior and should be reconciled with the 'silent' characterization.
  4. [Section 6.4.2 and Figure 5] The MitM Stealtooth attack depends on the same unproven automatic-pairing overwrite mechanism for Step#2-4, and its evaluation is incomplete: AS#3 is reported as only partially achieved because the forwarded audio 'could not be properly encoded,' so the claim that Mallory can 'intercept, modify, and relay communications' is only partially evidenced. The paper should clearly separate which of the three claimed MitM capabilities (AS#1, AS#2, AS#3) are fully demonstrated and which remain experimental limitations, rather than summarizing all as successful in Section 6.4.3.
minor comments (7)
  1. [Table 3] The manufacturer name 'Xaomi' is a typo and should be 'Xiaomi.'
  2. [Section 6.4.2] The word 'vulnerabile' should be 'vulnerable.'
  3. [Figures 2 and 3] The label 'Improver Authentication' should be 'Improper Authentication' for consistency with the text.
  4. [Header block] The placeholder text 'Do, Not, Us, This, Code, Put, the, Correct, Terms, for, Your, Paper' and the unpopulated copyright/DOI fields must be completed before submission.
  5. [Table 2] The caption says 'Specifications of device used as Alice in the Breaktooth attack,' but the evaluation is for the MitM Stealtooth attack; the caption should be corrected.
  6. [Section 4.3.1 and reference [15]] The text dates Breaktooth to 2025, while reference [15] is a 2024 Cryptology ePrint paper; this should be made consistent.
  7. [Table 4] The table uses symbols to indicate success, partial success, and failure, but the symbols are not defined in the table caption or in a directly preceding legend; the legend should be part of the table presentation.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the silent link-key overwrite claim rests on direct device evaluation, and the sole self-citation (Breaktooth) is backed by an open-source toolkit, making it non-load-bearing.

full rationale

The paper's central claim is empirical: certain commercial Bluetooth audio devices enter an automatic pairing state after a failed reconnection, letting an impersonating device silently replace the stored link key. This is evidenced by a direct evaluation against ten commercial devices (Section 6.4.1, Table 4), not derived from an equation, a fitted parameter, or an imported uniqueness theorem. The attack preconditions (Alice powered off or Bluetooth disabled, Bob powered on, Mallory spoofing Alice's address and name and set discoverable) are stated independently of the outcome, and the evaluation reports both successes and failures (Pixel Buds Pro and Bose QuietComfort Ultra were not vulnerable), which gives the claim falsifiable content. The only self-referential element is the MitM extension, which reuses Steps #2-1 to #2-3 from the authors' own Breaktooth attack (Sections 4.3.1-4.3.2 and 5). This self-citation is not load-bearing because Breaktooth is released as an open-source tool and has been evaluated against commercial keyboards, mice, and audio devices, providing independent, code-reproduced support. There is no renaming of a known result, no ansatz smuggled via citation, and no fitted input relabeled as a prediction. The paper also acknowledges limitations (timing dependence, firmware variability, and partial AS#3 success) that further show the results are not forced by construction. Accordingly, the derivation chain is self-contained and no circular step is present.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The paper's central claims rest on assumptions about undocumented vendor firmware behavior (automatic pairing) and on the validity of the authors' prior Breaktooth attack. There are no numeric fits or newly posited physical entities.

assumptions (4)
  • domain assumption Commercial Bluetooth audio devices implement an automatic pairing mode that activates after a failed reconnection to a previously paired device, and this mode accepts pairing without user consent.
    Section 4.2 states that Bob's automatic pairing mode is triggered when Bob attempts to reconnect with Alice but cannot confirm the connection. This is the core vulnerability premise; it is asserted from the device evaluation, not demonstrated with protocol-level evidence.
  • domain assumption An attacker can change a Bluetooth adapter's BD_ADDR and name to match the victim device using commodity tools on a Raspberry Pi.
    Section 4.1.1 instructs the attacker to change her own Bluetooth address and adapter name to match Alice's settings, and Section 5 says hciconfig and hcitool are used. The specific mechanism for address overwrite on Raspberry Pi with stock BlueZ is not provided.
  • domain assumption When Alice is powered off or has Bluetooth disabled, Bob will automatically attempt to reconnect to Alice upon being powered on, rather than requiring the user to initiate a connection.
    The attack timing in Section 4.1.1 and Figures 2 and 3 depends on Bob initiating a reconnection to the spoofed Alice address when Alice is unavailable.
  • domain assumption Bluetooth power-saving Sleep mode causes temporary disconnections that can be detected via l2ping, and the Master accepts connection requests from Slaves after disconnection, as described in Breaktooth's Vuln.#1 and Vuln.#2.
    The MitM Stealtooth attack (Section 4.3.2, Steps 2-1 to 2-3) is built on the authors' previous Breaktooth paper; the current paper does not re-validate these claims.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Stealtooth: Breaking Bluetooth Security Abusing Silent Automatic Pairing." pith.science (2026). https://pith.science/paper/UOCGTZ4B

@misc{pith2026250700847,
  author       = {Pith},
  title        = {Pith review of: Stealtooth: Breaking Bluetooth Security Abusing Silent Automatic Pairing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/UOCGTZ4B}},
  note         = {Machine review of arXiv:2507.00847}
}
read the original abstract

Bluetooth is a pervasive wireless communication technology used by billions of devices for short-range connectivity. The security of Bluetooth relies on the pairing process, where devices establish shared long-term keys for secure communications. However, many commercial Bluetooth devices implement automatic pairing functions to improve user convenience, creating a previously unexplored attack surface. We present Stealtooth, a novel attack that abuses unknown vulnerabilities in the automatic pairing functions in commercial Bluetooth devices to achieve completely silent device link key overwriting. The Stealtooth attack leverages the fact that Bluetooth audio devices automatically transition to pairing mode under specific conditions, enabling attackers to hijack pairing processes without user awareness or specialized tools. We also extend the attack into the MitM Stealtooth attack, combining automatic pairing abuse with power-saving mode techniques to enable man-in-the-middle attacks. We evaluate the attacks against 10 commercial Bluetooth devices from major manufacturers, demonstrating widespread vulnerabilities across diverse device types and manufacturers. Our practical implementation requires only commodity hardware and open-source software, highlighting the low barrier to entry for attackers. We propose defenses both device and protocol levels, including enhanced user notifications and standardized automatic pairing guidelines. Our findings reveal a critical tension between security and usability, showing that current automatic pairing implementations create systematic vulnerabilities. We responsibly disclosed our findings to affected vendors, with several already releasing patches.

Figures

Figures reproduced from arXiv: 2507.00847 by the authors.

Figure 1
Figure 1. Threat model: Alice and Bob share a link key in [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Improper Authentication Sequences (Bob is the con [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 4
Figure 4. The Breaktooth attack sequences: The Breaktooth [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figures from the paper (2 more)
Figure 5
Figure 5. Figure 5: The MitM Stealtooth attack strategy: Alice and Bob have already paired and share [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Evaluation model for the MitM Stealtooth attack: [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

34 extracted references · 25 canonical work pages

  1. [1]

    Mingrui Ai, Kaiping Xue, Bo Luo, Lutong Chen, Nenghai Yu, Qibin Sun, and Feng Wu. 2022. Blacktooth: Breaking through the Defense of Bluetooth in Silence. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security (Los Angeles, CA, USA)(CCS ’22). Association for Computing Machinery, New York, NY, USA, 55–68. doi:10.1145/354860...

    arXiv 2022

  2. [2]

    Yoo, and Kwangjo Kim

    Muhamad Erza Aminanto, Rakyong Choi, Harry Chandra Tanuwidjaja, Paul D. Yoo, and Kwangjo Kim. 2018. Deep Abstraction and Weighted Feature Selection for Wi-Fi Impersonation Detection. IEEE Transactions on Information Forensics and Security 13, 3 (2018), 621–636. doi:10.1109/TIFS.2017.2762828

    work page arXiv 2018

  3. [3]

    Daniele Antonioli. 2023. BLUFFS: Bluetooth Forward and Future Secrecy Attacks and Defenses. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (Copenhagen, Denmark) (CCS ’23). Association for Computing Machinery, New York, NY, USA, 636–650. doi:10.1145/3576915. 3623066

    doi:10.1145/3576915 2023

  4. [4]

    Daniele Antonioli and Mathias Payer. 2022. On the Insecurity of Vehicles Against Protocol-Level Bluetooth Threats. In 2022 IEEE Security and Privacy Workshops (SPW). 353–362. doi:10.1109/SPW54247.2022.9833886

    arXiv 2022

  5. [5]

    Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen. 2020. BIAS: Bluetooth Impersonation AttackS. In2020 IEEE Symposium on Security and Privacy (SP). 549–562. doi:10.1109/SP40000.2020.00093

    arXiv 2020

  6. [6]

    Rasmussen

    Daniele Antonioli, Nils Ole Tippenhauer, and Kasper B. Rasmussen. 2019. The KNOB is Broken: Exploiting Low Entropy in the Encryption Key Negotiation Of Bluetooth BR/EDR. In 28th USENIX Security Symposium (USENIX Security 19). USENIX Association, Santa Clara, CA, 1047–1061. https://www.usenix.org/ conference/usenixsecurity19/presentation/antonioli

    work page 2019

  7. [7]

    Eli Biham and Lior Neumann. 2019. Breaking the Bluetooth Pairing – The Fixed Coordinate Invalid Curve Attack. In Selected Areas in Cryptography – SAC 2019: 26th International Conference, Waterloo, ON, Canada, August 12–16, 2019, Revised Selected Papers (Waterloo, ON, Canada). Springer-Verlag, Berlin, Heidelberg, 250–273. doi:10.1007/978-3-030-38471-5_11

    work page doi:10.1007/978-3-030-38471-5_11 2019

  8. [8]

    Eric Blancaflor, Harold Kobe Billo, John Michael Dignadice, Philip Domondon, Mico Ruiz Linco, and Christie Valero. 2025. Bluetooth Simulated Reconnaissance Attack Through the Use of HCITool: A Case Study. In2nd International Conference on Cloud Computing and Computer Networks , Lei Meng (Ed.). Springer Nature Switzerland, Cham, 133–143

    work page 2025

Show all 34 references
  1. [10]

    Marc Fischlin and Olga Sanina. 2024. Fake It till You Make It: Enhancing Security of Bluetooth Secure Connections via Deferrable Authentication. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security (Salt Lake City, UT, USA) (CCS ’24). Asso...

    2024

  2. [11]

    Garbelini, Vaibhav Bedi, Sudipta Chattopadhyay, Sumei Sun, and Ernest Kurniawan

    Matheus E. Garbelini, Vaibhav Bedi, Sudipta Chattopadhyay, Sumei Sun, and Ernest Kurniawan. 2022. BrakTooth: Causing Havoc on Bluetooth Link Man- ager via Directed Fuzzing. In 31st USENIX Security Symposium (USENIX Security 22). USENIX Association, Boston, MA, 1025–1042. https...

    2022

  3. [12]

    Gore, Himashri Kour, Mihit Gandhi, Deepaknath Tandur, and Anitha Varghese

    Rahul N. Gore, Himashri Kour, Mihit Gandhi, Deepaknath Tandur, and Anitha Varghese. 2019. Bluetooth based Sensor Monitoring in Industrial IoT Plants. In 2019 International Conference on Data Science and Communication (IconDSC) . 1–6. doi:10.1109/IconDSC.2019.8816906

    2019

  4. [13]

    Tzipora Halevi and Nitesh Saxena. 2013. Acoustic Eavesdropping Attacks on Constrained Wireless Device Pairing. IEEE Transactions on Information Forensics and Security 8, 3 (2013), 563–577. doi:10.1109/TIFS.2013.2247758

    2013

  5. [14]

    Mohit Jangid, Yue Zhang, and Zhiqiang Lin. 2023. Extrapolating Formal Analysis to Uncover Attacks in Bluetooth Passkey Entry Pairing. In 2023, Network and Distributed System Security Symposium (NDSS) . doi:10.14722/ndss.2023.23119

    2023

  6. [15]

    Keiichiro Kimura, Hiroki Kuzuno, Yoshiaki Shiraishi, and Masakatu Morii. 2024. Breaktooth: Breaking Security and Privacy in Bluetooth Power-Saving Mode. Cryptology ePrint Archive, Paper 2024/900. https://eprint.iacr.org/2024/900

    2024

  7. [16]

    Changseok Koh, Jonghoon Kwon, and Junbeom Hur. 2022. BLAP: Bluetooth Link Key Extraction and Page Blocking Attacks. In 2022 52nd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) . 227–238. doi:10.1109/DSN53405.2022.00033

    2022

  8. [17]

    Grigorios Koulouras, Stylianos Katsoulis, and Fotios Zantalis. 2025. Evolution of Bluetooth Technology: BLE in the IoT Ecosystem. Sensors 25, 4 (2025). doi:10. 3390/s25040996

    2025

  9. [18]

    Elke Mackensen, Matthias Lai, and Thomas M. Wendt. 2012. Bluetooth Low Energy (BLE) based wireless sensors. In SENSORS, 2012 IEEE. 1–4. doi:10.1109/ ICSENS.2012.6411303

    2012

  10. [19]

    2002-2024

    Linux man page. 2002-2024. l2ping(1). https://linux.die.net/man/1/l2ping. Ac- cessed: 2025-06-01

    2002

  11. [20]

    Maja Pušnik, Mitja Galun, and Boštjan Šumak. 2020. Improved Bluetooth Low Energy Sensor Detection for Indoor Localization Services. Sensors 20, 8 (2020). doi:10.3390/s20082336

    2020 doi

  12. [21]

    Poonam Shelke, Saurav Gupta, and Sukumar Nandi. 2024. BlueDoS: A Novel Approach to Perform and Analyse DoS Attacks on Bluetooth Devices. In Proceed- ings of the 21st International Conference on Security and Cryptography - Volume 1: SECRYPT. INSTICC, SciTePress, 838–843. doi:10...

    2024 doi

  13. [22]

    Cavallaro

    Guanxiong Shen, Junqing Zhang, Alan Marshall, and Joseph R. Cavallaro. 2022. Towards Scalable and Channel-Robust Radio Frequency Fingerprint Identification for LoRa. IEEE Transactions on Information Forensics and Security 17 (2022), 774–

    2022

  14. [23]

    Bluetooth SIG. 2023. 2023 Bluetooth ® Market Update. https://www.bluetooth. com/2023-market-update/. Accessed: 2025-06-01

    2023

  15. [24]

    Bluetooth SIG. 2024. 2024 Bluetooth ® Market Update. https://www.bluetooth. com/2024-market-update/. Accessed: 2025-06-01

    2024

  16. [25]

    Bluetooth SIG. 2025. 2025 Bluetooth ® Market Update. https://www.bluetooth. com/2025-market-update/. Accessed: 2025-06-01

    2025

  17. [26]

    Da-Zhi Sun, Yi Mu, and Willy Susilo. 2018. Man-in-the-middle attacks on Secure Simple Pairing in Bluetooth standard V5.0 and its countermeasure. Personal Ubiquitous Comput. 22, 1 (Feb. 2018), 55–67. doi:10.1007/s00779-017-1081-6

    2018 doi

  18. [27]

    Da-Zhi Sun and Li Sun. 2019. On Secure Simple Pairing in Bluetooth Standard v5.0-Part I: Authenticated Link Key Security and Its Home Automation and Entertainment Applications. Sensors 19, 5 (2019). doi:10.3390/s19051158 Breaking Bluetooth Security Abusing Silent Automatic Pai...

    2019 doi

  19. [28]

    Maximilian Tschirschnitz, Ludwig Peuckert, Moritz Buhl, and Jens Grossklags

  20. [29]

    Tyler Tucker, Hunter Searle, Kevin Butler, and Patrick Traynor. 2023. Blue’s Clues: Practical Discovery of Non-Discoverable Bluetooth Devices. In 2023 IEEE Symposium on Security and Privacy (SP) . 3098–3112. doi:10.1109/SP46215.2023. 10179358

    2023

  21. [30]

    Maximilian von Tschirschnitz, Ludwig Peuckert, Fabian Franzen, and Jens Grossklags. 2021. Method Confusion Attack on Bluetooth Pairing. In 2021 IEEE Symposium on Security and Privacy (SP) . 1332–1347. doi:10.1109/SP40001.2021. 00013

    2021

  22. [31]

    Jianliang Wu, Yuhong Nan, Vireshwar Kumar, Dave (Jing) Tian, Antonio Bianchi, Mathias Payer, and Dongyan Xu. 2020. BLESA: Spoofing Attacks against Recon- nections in Bluetooth Low Energy. In 14th USENIX Workshop on Offensive Tech- nologies (WOOT 20). USENIX Association. https:...

    2020

  23. [32]

    Jianliang Wu, Ruoyu Wu, Dongyan Xu, Dave Jing Tian, and Antonio Bianchi. 2022. Formal Model-Driven Discovery of Bluetooth Protocol Design Vulnerabilities. In 2022 IEEE Symposium on Security and Privacy (SP) . 2285–2303. doi:10.1109/ SP46214.2022.9833777

    2022

  24. [33]

    Tuğrul Yüksel, Ömer Aydın, and Gökhan Dalkılıç. 2022. Performing DoS Attacks on Bluetooth Devices Paired with Google Home Mini. SSRN Electronic Journal 18 (01 2022), 53–58. doi:10.2139/ssrn.4171322

    2022 doi

  25. [787]

    doi:10.1109/TIFS.2022.3152404

    2022

  26. [2025]

    In 2025, Network and Distributed System Security Symposium (NDSS)

    Rediscovering Method Confusion in Proposed Security Fixes for Bluetooth. In 2025, Network and Distributed System Security Symposium (NDSS) . doi:10. 14722/ndss.2025.240310

    2025

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.