I'm thinking about man-in-the-middle attacks on a BLE connection ... normally when people talk about MITM attacks it's a separate device that sits between the mobile phone/tablet and the BLE device, which immediately limits its effectiveness (the attacker must be physically near the two devices). Can an attacker write an app that gets installed on the same mobile phone/tablet as the real app, and somehow intercepts the BLE SDK calls and thus becomes a man-in-the-middle that is always there?
I'm writing an ionic cordova app and stumbled upon this. I'm trying to simply connect my bluetooth headset to my android and set up a SCO channel (for HFP bluetooth), but every time I do, a Spotify Service interjects and sets the connection to A2DP. It seems like Spotify wrote a service to hack the bluetooth SDK to ensure that its bluetooth connections are always compatible with its music listening service. When I delete Spotify this does not happen. So in short, yes, I believe it is possible.