Bluetooth PHYs and Ranges – Part 1

Summary

Excerpt From Bluetooth Vulnerabilities (Part 1) Webinar
Watch CTO Dr. Brett Walkenhorst on Bluetooth PHYs and Ranges
It’s easy to picture the relatively short range for a connection between two personal devices like a cellphone and a headset and come to the conclusion that Bluetooth only works over these kinds of very short distances. However, as Brett described in this video, Bluetooth can actually work over significant distances. He shares examples of organizations that were able to amplify the connectivity range even as much as 5x the average expected range. This has security implications due to the fact that Bluetooth related attacks do no necessarily need to be actioned by a malicious actor who is in close range.

Video Transcript

The physical layer, the Bluetooth classic has one, two, and three megabit per second raw data rates, l e for a long time had one megabit per second, but a few years later in version five of the spec, a couple of new fine modes were introduced a two m mode that doubled that raw data rate for a reduced range and coded phi which introduced redundancy into the data structure for a reduced data rate but a much longer range.

Approximately four times what you can get with the standard BOE. Now, typical link ranges are on the order of fifty to a hundred meters. But in testing that various groups have done, including Vasteel, we've discovered that you can go much much farther than that. And we do this by some combination of three things, directional antennas, signal amplifiers, and or coded phi.

That that five that introduces redundancy. So this is a combination of hardware and software or just one of those. And and we can we can get links that that we've tested that can go as high as two hundred seventy four meters, five hundred meters, seventeen seventy meters. So over a mile, this one group was able to demonstrate a hack.

Using some additional hardware on the hacker device.