BTFuzzer: A Profile-Based Fuzzing Framework for Bluetooth Protocols

Bluetooth vulnerabilities have become increasingly popular in recent years due to, in part, the remote exploitability of Bluetooth. Unfortunately, in practice, security analysts often rely on manual analysis to identify these vulnerabilities, which is challenging. Specifically, testing various workloads while maintaining reliable Bluetooth connections between devices requires complicated network configuration settings. This paper introduces BTFuzzer, a profile-based fuzzing framework for Bluetooth devices. BTFuzzer eliminates the need for complex network configurations by feeding Bluetooth packets directly into the target device’s Bluetooth library without going through the Over-The-Air (OTA) transmissions. BTFuzzer carefully crafts test inputs based on protocol profiles and specifications to maximize code coverage efficiently. Our evaluation results show that BTFuzzer is highly effective. In particular, the framework has identified two security bugs in the latest Android versions (i.e., 10 and later): CVE-2020-27024 and a publicly unknown information leak vulnerability. The first is an out-of-bounds read vulnerability (CVE-2020-27024). The second vulnerability allows attackers to connect to a victim’s device and leak sensitive data without the user’s awareness, as the adversary is not shown in the list of connected Bluetooth devices.