Bluetooth LE MITM Proxy

Overview

Many BLE peripherals trust a paired connection implicitly, with little verification of the data flowing over it. Working in a group with other students, we built a GATT-level man-in-the-middle proxy that sat between a BLE peripheral and its companion app, relaying traffic transparently by default and selectively rewriting it on the fly.

Approach

• Used BlueZ and D-Bus on Linux to advertise a cloned GATT server while simultaneously connecting to the real peripheral as a client with the Bleak library, one adapter on each side of the proxy,
• Forwarded GATT notifications transparently between both sides by default, JSON sensor data (temperature, heart rate, steps, battery) sent every few seconds over an unencrypted characteristic,
• Rewrote values in transit using simple pattern matching before forwarding them on, since the device required no encryption, authentication, or integrity checks,
• Attempted the same MITM setup against a real BLE mouse, a HID device with far more services and characteristics to mirror, but didn’t get it fully working within the project’s time constraint.

Takeaway

The exercise demonstrated how easily BLE connections can be intercepted and modified when a device pairs without encryption or mutual verification, a gap that BLE 4.2’s LE Secure Connections was designed to close, but one that’s still common in consumer IoT hardware.