Device Enumeration and Location

The Bluetooth headers are not encrypted, which opens a range of attack possibilities to the LM (Link Manager) layer of the protocol. Taking advantage of the ===

Bluetooth location and enumeration attacks

The Bluetooth headers are not encrypted, which opens a range of attack possibilities at the L.M. (Link Manager) of the protocol. By leveraging the upper layers of the protocol stack, an attacker can:

Locate Bluetooth devices in mode visible (discoverable)
Locate devices in mode not visible (non-discoverable)
List services and detailed device information

On Linux, the suite BlueZ provides all the tools necessary for these tasks: hcitool, sdptool, hciconfig and bluetoothctl.

Prerequisites

Before we start, we need a working Bluetooth adapter and the BlueZ tools installed:

Bash

# Instalar BlueZ en Debian/Ubuntu
sudo apt install bluez bluez-tools

# Verificar que el adaptador está activo
hciconfig
# Debería mostrar algo como:
# hci0:   Type: Primary  Bus: USB
#         BD Address: AA:BB:CC:DD:EE:FF  ACL MTU: 1021:8  SCO MTU: 64:1
#         UP RUNNING

# Si el adaptador está DOWN, activarlo
sudo hciconfig hci0 up

Scanning visible devices

When a Bluetooth device is in mode discoverable (visible), responds to requests inquiry standard. The scan is direct:

Bash

# Escaneo básico: muestra MAC y nombre del dispositivo
hcitool scan
# Scanning ...
#   00:11:22:33:44:55   Nokia-N8
#   AA:BB:CC:DD:EE:FF   Galaxy-S21

# Escaneo con información extendida (clase de dispositivo)
hcitool inq
# Inquiring ...
#   00:11:22:33:44:55   clock offset: 0x1234   class: 0x5a020c
#   AA:BB:CC:DD:EE:FF   clock offset: 0x5678   class: 0x3e0100

The field class is a 24-bit value that encodes the type of device (phone, computer, headset, etc.) and its capabilities (network, audio, telephony). It can be decoded by referring to the Bluetooth specification Assigned Numbers.

Detection of invisible devices

Many manufacturers and users rely on the mode non-discoverable as a security measure: if the device does not appear in the scans, they assume it is protected. However, a hidden device still responding to direct connections if its MAC address is known (BD_ADDR).

Bash

# El escaneo estándar NO muestra dispositivos ocultos
hcitool scan
# Scanning ...
# (nada)

# Pero si conocemos la MAC, podemos obtener su nombre directamente
hcitool name 00:11:22:33:44:55
# Nokia-N8

# También podemos hacer ping L2CAP para verificar que está activo
l2ping -c 3 00:11:22:33:44:55
# Ping: 00:11:22:33:44:55 from AA:BB:CC:DD:EE:FF (data size 44) ...
# 44 bytes from 00:11:22:33:44:55 id 0 time 23.45ms
# 44 bytes from 00:11:22:33:44:55 id 1 time 18.72ms

Brute Force MAC Addresses with RedFang

If we don't know the MAC of the target device, tools like RedFang allow it to be discovered by brute force. Bluetooth addresses are formatted XX:XX:XX:YY:YY:YY, where the first three octets correspond to the manufacturer (OUI) and the last three to the specific device.

Bash

# RedFang puede usar múltiples adaptadores USB simultáneamente
# para acelerar la búsqueda
redfang -r 00:11:22:00:00:00-00:11:22:FF:FF:FF -o output.log

# Con 8 adaptadores USB, el tiempo se reduce de ~11 horas a ~90 minutos

However, in practice, MAC brute force can be optimized by knowing the OUI of the target manufacturer (queryable in the IEEE OUI database).

Enumeration of device information

Once the device is located, the next step is to extract as much information as possible. The process ascends through the protocol stack: first HCI (Link level), then SDP (application level).

HCI enumeration with hcitool

The command hcitool info extract information at link level:

Bash

# Obtener información detallada del dispositivo
hcitool info 00:11:22:33:44:55
# Requesting information ...
#   BD Address:  00:11:22:33:44:55
#   Device Name: Nokia-N8
#   LMP Version: 4.0 (0x6) LMP Subversion: 0x1234
#   Manufacturer: Nokia (1)
#   Features page 0: 0xff 0xff 0x8f 0xfe 0xdb 0xff 0x5b 0x87
#   Features page 1: 0x07

# Consultar la clase del dispositivo
hcitool class 00:11:22:33:44:55

# Consultar la versión del Link Manager Protocol
hcitool lv 00:11:22:33:44:55

The information obtained includes:

BD Address: Bluetooth MAC address
Device Name: name configured by user
LMP Version: Link Manager Protocol version (indicates the supported Bluetooth version)
Manufacturer: Bluetooth chip manufacturer
Features- device capabilities (encryption, roles, supported packet types)

SDP enumeration with sdptool

The protocol SDP (Service Discovery Protocol) allows you to discover the services offered by a Bluetooth device. This is the most revealing phase for an attacker:

Bash

# Listar TODOS los servicios del dispositivo remoto
sdptool browse 00:11:22:33:44:55
# Browsing 00:11:22:33:44:55 ...
# Service Name: Dial-Up Networking
# Service RecHandle: 0x10001
# Service Class ID List:
#   "Dialup Networking" (0x1103)
# Protocol Descriptor List:
#   "L2CAP" (0x0100)
#   "RFCOMM" (0x0003)
#     Channel: 1
#
# Service Name: OBEX Object Push
# Service RecHandle: 0x10002
# Service Class ID List:
#   "OBEX Object Push" (0x1105)
# Protocol Descriptor List:
#   "L2CAP" (0x0100)
#   "RFCOMM" (0x0003)
#     Channel: 9
#   "OBEX" (0x0008)

# Buscar un servicio específico
sdptool search SP 00:11:22:33:44:55   # Serial Port
sdptool search DUN 00:11:22:33:44:55  # Dial-Up Networking
sdptool search FTP 00:11:22:33:44:55  # File Transfer
sdptool search NAP 00:11:22:33:44:55  # Network Access Point

The most interesting services from an offensive point of view are:

Serial Port (SP): access to serial channel, potential execution of AT commands
Dial-Up Networking (DUN): access to mobile data connection
OBEX Object Push: sending files to the device (social engineering vector)
OBEX File Transfer (FTP)- access to the device's file system
Headset/Handsfree: Audio control (remote listening on vulnerable devices)

Modern tools: bluetoothctl

In modern distributions, bluetoothctl progressively replaces hcitool:

Bash

# Iniciar bluetoothctl
bluetoothctl

# Dentro de bluetoothctl:
[bluetooth]# power on
[bluetooth]# scan on
# [NEW] Device 00:11:22:33:44:55 Nokia-N8
# [NEW] Device AA:BB:CC:DD:EE:FF Galaxy-S21

[bluetooth]# info 00:11:22:33:44:55
# Device 00:11:22:33:44:55
#   Name: Nokia-N8
#   Alias: Nokia-N8
#   Class: 0x005a020c
#   Paired: no
#   Trusted: no
#   RSSI: -45
#   UUIDs: Serial Port, OBEX Object Push, ...

[bluetooth]# scan off
[bluetooth]# exit

Automated enumeration script

We can automate the entire process with a Bash script:

Bash

#!/bin/bash
# bt-enum.sh — Enumeración Bluetooth automatizada
# Uso: ./bt-enum.sh [MAC_opcional]

echo "[*] Bluetooth Device Enumerator"
echo "================================"

if [ -n "$1" ]; then
    # Enumerar un dispositivo específico
    TARGETS="$1"
else
    # Escanear dispositivos visibles
    echo "[*] Escaneando dispositivos visibles (10s)..."
    TARGETS=$(hcitool scan --flush | tail -n +2 | awk '{print $1}')
fi

for MAC in $TARGETS; do
    echo ""
    echo "[+] Dispositivo: $MAC"
    echo "----------------------------"

    # Nombre del dispositivo
    NAME=$(hcitool name "$MAC" 2>/dev/null)
    echo "    Nombre: ${NAME:-desconocido}"

    # Información HCI
    echo "    [*] Información HCI:"
    hcitool info "$MAC" 2>/dev/null | grep -E "LMP|Manufacturer|Features" | \
        sed 's/^/    /'

    # Servicios SDP
    echo "    [*] Servicios SDP:"
    sdptool browse "$MAC" 2>/dev/null | grep "Service Name" | \
        sed 's/^/    /'

    # Ping L2CAP
    echo "    [*] L2CAP ping:"
    l2ping -c 1 -t 2 "$MAC" 2>/dev/null | tail -1 | sed 's/^/    /'
done

echo ""
echo "[*] Enumeración completada."

Countermeasures

To minimize exposure to Bluetooth enumeration attacks:

Disable Bluetooth when not actively being used
Set the device as not visible (although it is not enough on its own)
Wear Bluetooth 4.2+ with LE Privacy, which rotates MAC addresses periodically
Reject pairing requests from unknown devices
Disable unnecessary Bluetooth services (OBEX, FTP, DUN) if the device allows it

It is important to understand that hidden mode does not equate to security: it is simply darkness. A determined attacker with the right tools can discover and enumerate any active Bluetooth device in range.

:wq!

Bluetooth location and enumeration attacks

Prerequisites

Scanning visible devices

Detection of invisible devices

Brute Force MAC Addresses with RedFang

Enumeration of device information

HCI enumeration with hcitool

SDP enumeration with sdptool

Modern tools: bluetoothctl

Automated enumeration script

Countermeasures

Comments