Matt Brown: Bluetooth Low Energy Hacking (Parts 1–3)
A three-part walkthrough of Bluetooth Low Energy security by Matt Brown. Work through them in order — each part builds on the last, taking you from understanding BLE to sniffing its traffic to taking control of a device.
Part 1: Intro to Bluetooth Low Energy Security
An introduction to BLE and its security model — how BLE works, the GATT layer, and where the weak points are before you start attacking devices.
Part 2: Sniffing Bluetooth Low Energy
Capturing BLE traffic over the air — setting up a sniffer, following a connection, and reading the advertisements and GATT exchanges between a device and its app.
Part 3: Interacting with Bluetooth Low Energy Devices
Actively interacting with a BLE device — enumerating GATT services and characteristics, reading and writing values, and replaying or crafting commands to control the target.