CYBER

SECURITY
N A T I O N A L H I G H E R S C H O O L

BLUETOOTH
“science is but a perversion of itself unless it has as its ultimate goal the betterment of humanity”
-NIKOLA TESLA.

JANUARY 2025

“The goal of Bluetooth was always to provide a simple and inexpensive way to connect devices
without cables , making everyday life easier ”

-Jaap Haartsen

“Smart radar security based on Bluetooth “

This was the title of the scientific paper published on the o cial IEEE website during the
2023 7th international conference on Electronics ,communication, and Aerospace
Technology(ICECA) . The Article discussed the advancements made by communication
scientists in the field of security and sensor devices by using Bluetooth technology and
integrating it with radar to provide a better user experience .It also involves sending
real-time alerts to smartphones or connected devices when any unauthorized
movement is detected . The Bluetooth -based system primarily meets modern security
needs and also opens the doors for other scientific attempts to exploit this modern
technology in various other fields.

THE HISTORY PROTOCOLS USES

What is the history of What is the protocols that Where can we use
Bluetooth? are used in it? Bluetooth?

HISTORY OF BLUETOOTH

The inventors of Bluetooth are a team of engineers at the Swedish company ERICSSON in 1994

The invention of Bluetooth technology came as a response to the

problem of cable clutter, and since the 1980s, there have been various
attempts to replace wired communication technologies with wireless
alternatives. Infrared technology was one of the promising competitors;
however, its relatively high energy consumption, as well as the need for
direct line-of-sight connections between devices to establish and
maintain communication, prevented the widespread adoption of this
technology. Bluetooth technology was first developed by Jaap Haartsen,
the Chief Technology Officer at Ericsson, in 1989, with the goal of
Jaap Haartsen led the invention of
Bluetooth® wireless technology
creating wireless headsets. The actual design and development began in
1994, and by 1997, the team had a working solution. In the same year,
Jim Kardach from Intel suggested the name "Bluetooth," inspired by the
Viking history and the 10th-century Danish king Harald Bluetooth. The
name was initially meant to be a placeholder until a more suitable name
could be found, but it quickly became widespread in the industry and
became synonymous with short-range wireless technology.
 In 1997, Adalio Sanchez from IBM reached out to Niels Rydbeck to discuss the possibility of
connecting mobile phones to IBM's ThinkPad laptop. Atier evaluating the idea, the engineers
concluded that the power consumption of mobile phone technology at the tme was too high to be
feasibly integrated into the laptop while maintaining an acceptable battery life. Instead, the two
companies agreed to integrate Bluetooth technology into both an IBM ThinkPad laptop and an
Ericsson mobile phone. Since neither the ThinkPad laptops nor Ericsson phones were popular in the
market at the time, it was decided that Bluetooth technology should be made an open industry
standard, allowing all players in the market to have maximum access to the technology. In May
1998, the Bluetooth Special Interest Group (SIG) was formed by Ericsson, IBM, Intel, Nokia, and
Toshiba to develop technological solutions for Bluetooth. The first Bluetooth device was unveiled in
1999, which was a wireless headset. This device won the "Best of Show" technology award at the
Comdex conference.

“Bluetooth is not just a means of transferring data ; it is a

universal language for communication between smart devices
”
-comment from technology experts during a CES conference.

Annual Bluetooth
device shipments
(in billions).

Bluetooth Versions
 was released in November 2004, with a data transfer speed of up to 2.1 Mbps
Bluetooth and a communication range of up to 10 meters, along with the Adaptive
2.0
Frequency Hopping (AFH) feature to enhance data transfer speed.

was launched in April 2009, o ering data transfer speeds of up to 24

Mbps and a communication range of up to 100 meters, along with the
Bluetooth High Speed (HS) feature to improve transfer rates.
3.0

debuted in December 2010, maintaining a data transfer speed of 24

Mbps but introducing Bluetooth Low Energy (BLE) to save power.

Bluetooth
4.0

was released in December 2016, supporting data transfer speeds of up

to 50 Mbps and a communication range of up to 400 meters, along with
Bluetooth
new features such as Bluetooth Mesh and Direction Finding
5.0
 The Types of Bluetooth

Currently, there are two standards in use for Bluetooth technology:

Traditional Bluetooth Low energy Bluetooth

The commonly used standard in various

An improved standard for low power
devices.
consumption .
Used for larger data transfers and
Designed for applications requiring small data
continuous connections, such as
transfers at intervals, like sensors and wearables.
wireless audio devices.

Power Consumption Power Consumption

Higher power consumption, Significantly lower, ideal for

reducing battery life in battery-powered devices
portable devices with long life

Common Applications Common Applications

Wireless headphones, speakers, file Fitness trackers, smart lights, beacons,

transfers. IoT devices.

How does Bluetooth work ?

Bluetooth is a protocol for two-way communication. Every device with Bluetooth has an
antenna and a chip that allow two-way communication between devices. The method
transmits data using frequency-hopping spread spectrum (FHSS). In order to transmit
radio signals, FHSS quickly switches frequencies, sending data chunks on all of the
spectrum's frequencies. Bluetooth devices use frequencies that fall between 2402 and
2480 MHz. The band is regulated and utilized for Industrial, Scientific, and Medical (ISM)
reasons even though it does not have a worldwide license. As previously mentioned,
Bluetooth transmits data using FHSS. The data is separated into packets and sent over a
single channel. Every one of the 79 Bluetooth channels has a bandwidth of one
 A small group of eight devices—seven slave devices and one master device—can
communicate using Bluetooth. It is possible to switch the master device. For instance,
when two smartphones are paired for data transfer, both devices are able to send and
.receive data (slave protocol and master protocol, respectively)

All devices that are enabled (and have the Bluetooth protocol
enabled) send out a discovery signal so that other devices can find them.
Once a device finds another, they can pair, which allows the two devices
to communicate over Bluetooth. Devices may or may not be configured
to be discoverable. They can be found and communicated with by other
devices that have an active connection when they are in discoverable
mode. Bluetooth speakers are one example of a device that cannot be
concealed because they typically act as slaves that are controlled by
.other devices

Protocols of the Bluetooth

The Bluetooth architecture has its own independent model with

a stack of protocols, instead of following the standard OSI model
or TCP/IP model. Another unique feature is that it is not
mandatory for all the devices in the Bluetooth system to use all
the protocols in the stack. This is because Bluetooth is designed
to be used by myriad applications and the application
designates which part of the protocol stack is to be used ,
Protocols in the Bluetooth Protocol Stack :
 Core Protocols − This Cable Replacement Adopted Protocols −
includes Bluetooth radio, Protocol − This includes These are the protocols
Baseband, Link Manager Radio Frequency that are adopted from
Protocol (LMP), Logical Communications standard models. The
Link Control and (RFComm) protocol. It is commonly adopted
Adaptation Protocol short for Radio Frontend protocols used in
(L2CAP), and Service Component. It provides a Bluetooth are Point-to-
Discovery Protocol (SDP). serial interface with WAP. Point Protocol (PPP),
Internet Protocol (IP),
User Datagram Protocol
(UDP), Transmission
Control Protocol (TCP),
and Wireless Application
Protocol (WAP)

Telephony Control Protocol − TCS-BIN is the protocol used here which is a bit
oriented one. It specifies call control signals and mobility management
procedures. These signals take care of establishing speech and data calls.
 Layers in the BLE Protocol Stack
AS we said before LE (Bluetooth Low Energy) is wireless PAN technology designed and
maintained by Bluetooth Special Interest Group (SIG). The version 4.2 and above is
referred to as BLE from the versions of BT. BLE is introduced to reduce power
consumption and the costs while maintaining the range. All BLE devices use the GATT
profile (Generic Attribute Profile). The GATT protocol provides a series of commands for
the client to discover information about the BLE server. The BLE protocol stack
architecture consists of two parts viz. controller and host. Both are interfaced using HCI
(Host to Controller Interface) .
SO ITS LAYERS...

Physical Layer : Using this layer, BLE o ers data rates of 1 Mbps (Bluetooth v4.2)/2
Mbps (Bluetooth v5.0).
Link Layer : It is responsible for advertising, scanning, and creating/maintaining
connections.
HCI : It provides communication between controller and host through standard
interface types.
L2CAP :This layer o ers data encapsulation services to upper layers. This allows
logical end to end data communication.
SMP :This security Manager layer provides methods for device pairing and key
distributions.
GAP : This layer directly interfaces with the application layer and/or profiles on it. It
handles device discovery and connection related services for BLE devices.
GATT : This layer is a service framework which specifies sub-procedures to use ATT.
Data communications between two BLE devices are handled through these sub-
procedures.
ATT : This layer allows BLE devices to expose certain pieces of data or attributes.
Application Layer : It helps to interact with applications and profiles as desired. Any
profiles/applications run on top of GAP/GATT layers of BLE protocol stack. It handles
device discovery and connection related services for the BLE device.

BLE CONNECTION MECHANISM

Discovery phase: Initially the discovery process takes place. As a result

devices are aware of each other's presence.
Connecting phase : Then scanner selects preferred advertiser based on
advertising data which include device name, service UUID, RSSI etc. Now
the device is called "Initiator" which responds to advertising packets with
"CONNECT_REQ" packet.
Once the CONNECT_REQ packet is transmitted by initiator, received by
advertiser, advertiser sends CONNECT_RES and the BLE devices are said
to be connected.
Connected phase : Once connection is established between "master" and
"slave", they can start exchange of data using data packets at regular
intervals known as "connection events"
Uses of Bluetooth
 Remote Controls Transfer Files GPS Device Control Smart
Between Two
Devices Home System

A Bluetooth- Bluetooth connects

Bluetooth enables
Bluetooth offers enabled device is smart home devices
fast file transfer
faster, responsive crucial for voice like Amazon Echo and
between
remote control, communication, Google Home to
smartphones and
eliminating line of locating phones, enabling
PCs, offering a
sight, but is expensive addresses and wireless control of
convenient
and battery- using voice connections, skills,
alternative to cables
consuming, making it commands to routines, and home
and connecting two
less visible in some display security features like
Bluetooth-enabled
areas. instructions on door locks and alarm
PCs.
the screen. systems.

How Secure Bluetooth Is?

 Bluetooth technology is considered secure wireless technology when used with
safety measures. It uses radio frequencies to prevent attacks and o ers settings to
control connection limits. Service-level settings limit activities allowed on a device.
However, there are safety risks, such as hacker attacks like bluesnarfing, which can
compromise the security of Bluetooth connections.

Simulation of a Small Network Using Packet Tracer

The image above illustrates a simulation of a Bluetooth-based wireless network

using Cisco Packet Tracer. The network connects IoT devices and end-user
equipment to demonstrate their interaction and functionality in a short-range
communication environment.
Network
Design
.1 Topology
The network uses a star and point-to-point topology for Bluetooth communication:
-A central PC (PC-PT) connects to multiple webcams via Bluetooth.
-A portable music player is paired with a Bluetooth speaker.
-Smartphones are connected in a peer-to-peer setup via Bluetooth.

2 Devices Used
- Webcams (IoT6, IoT7, IoT8, IoT9, IoT10): Connected to PC-PT (PC7) for monitoring
purposes.
- PCs (PC3, PC7): Serve as endpoints for connecting peripherals.
- Portable Music Player (IoT5): Streams audio to a Bluetooth Speaker (IoT4).
- Smartphones (Smartphone5, Smartphone8, Smartphone9): Communicate via
Bluetooth in a peer-to-peer setup

Bluetooth Protocol ensures secure, reliable communication between

devices over short distances. IoT Protocols support efficient control of
Protocols
devices like group
webcams. Low Energy (BLE) variant uses HTTP/HTTPS for
Used Member of the :B4
web-based communication. Security protocols include encryption and
authentication.

Bluetooth Packets Analysis

To understand the behavior of some packets while traveling in the network, we use the Wireshark application to
analyze packets After picking up the packages we are shown several pieces of information :
 SO as we can see from the picture Bluetooth communication
involves multiple protocols that help in managing data flow
between devices. Among these protocols, HCI_EVT, HCI_CMD,
and L2CAP play distinct roles .

Example: When transmitting data

Real Example
over Bluetooth, L2CAP divides the
data into smaller chunks and sends
them over the appropriate channel.
The receiving device then
reassembles the data upon arriva

Here is a well-
organized
explanation based
on the analysis of
Frame 13 from
Wireshark capture

General Information:
Protocol: Bluetooth HCI Event - Command Complete
Frame Size: 9 Bytes (72 bits)
Direction: Received (from Controller to Host)
Event type: Command Complete (Opcode: 0x04)
Frame Brekdown:
Frame Layer The frame represents the entire packet captured, including metadata
such as time, size, and raw data. 3
 Bluetooth HCI H4 Layer Direction:
Received (Rcvd), meaning the packet is sent from the controller to
the host. HCI Packet Type: Event (0x04), indicating the packet is part
of an event notification. Bluetooth HCI Event -Command Complete
Layer: This layer confirms that a command previously sent by the
host has been successfully completed by the controller. Opcode:
The specific operation being confirmed is identified by an opcode
value. Example: The opcode in the raw data field (visible as 0e 06...)
indicates the exact command type and associated parameters.

Raw Data in Hexadecimal: The raw data section contains the hexadecimal
representation of the packet:
0e: Indicates an event packet.
06: Specifies the payload length.
The remaining bytes provide details about the event, such as the command status
or additional parameters.
Source and Destination: Source: Controller Destination: Host

Sump Up : Frame 13 is a Bluetooth HCI Event packet that signals the

completion of a command previously sent by the host. It is received by the
host from the controller and includes metadata, opcode details, and raw
data for further analysis. On other hand The information varies based on
each packet sent and each protocol used Comparing packages enables us
to perform several analyzes such as data transfer speed Efficiency of
sending and receiving
Study possible errors Whether data is lost or not Discover
vulnerabilities and secure information.
 Member of the group :B4

Laifaoui Marya Tesnim.

Mekci Raihan.
Mayana Selsabil.
Nourreddine Malak .

The name of the supervising professor is : MOUZAI .