For a school assignment we have to talk about a certain topic within IoT. We chose security, and have to make a sort of live demo for it. So we 'hacked' up an rc-car, and attached an arduino to it that is controllable with a ps3,xbox controller and/or mobile phone.

The premise of the demo is to show a vulnerability in IoT security and the only wireless protocol that is sending out 'sensitive' data to the user, is Bluetooth. So in total we are making 2 rc-cars, one that is protected from outside control/hacks and one that is completely vulnerable to that.

So my question is, what are some (common) vulnerabilities of Bluetooth that we can demonstrate. And it can't just be stuff like "make a stronger password" or "just hide the ssid". There has to be like an exploit like zigbee has/had.

Thank you for considering my question.

ps: Let me know if this is the right stackexchange to ask this question.

  • Is this still pending? What did you end up doing? If the demo is still in your future, this is not a vulnerability of Bluetooth per se, but you can talk about the importance of encrypting what gets sent over the wire. Your insecure car can be sending out its position, drive status and so on, while the secure car is just sending out encrypted packets. – Omniwombat Mar 24 '16 at 21:04
  • @Omniwombat, I updated my question with an answer – Edward Mar 24 '16 at 21:28

We ended up creating a thermostat out of 2 Arduino Uno's. One used to receive and send data through bluetooth and the other one purely for encryption and decryption of the data, they both were connected through I2C.

We demonstrated data being sent and received with and without cryptography. And sniffed it by using the Ubertooth One. Only problem we stumbled upon was that Bluetooth itself used its own encryption to encrypt the packets. So it was actually hard to show it, but we got the message across.

Using HCISnoop or something likely on Android we could show the packets being sent and received. But of course this was a bit of a cheat because the point was to demonstrate someone, a third party, sniffing your data / codes etc.


In theory the encrypted packets with Bluetooth encryption could easily be decrypted using crackle, I believe.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.