Snippet 17: Sweyntooth Introduction

SweynTooth is a family of 2019 BLE vulnerabilities, named for the son who overthrew King Bluetooth, found by sending malformed packets to Bluetooth Low Energy chips to trigger deadlocks, crashes, and buffer overflows. The researchers worked through 13 system-on-chips used in at least 480 end devices, including MRI machines, glucose monitors, and smart locks, exposing how vendor-left implementation gaps turn spec complexity into exploitable bugs.

Key Takeaways

• SweynTooth is a 2019 set of BLE vulnerabilities triggered by malformed over-the-air packets
• It spans 13 system-on-chips found in at least 480 devices, including MRI machines, glucose monitors, Fitbits, and smart locks
• The attacks cause deadlocks, crashes, and buffer overflows when target chips mis-parse bad packets
• The root cause is the Bluetooth spec leaving complex corner cases to each vendor’s own C implementation

Video Transcript

Sweyntooth. So this one got a lot of press and maybe some of the audience is familiar with it. It's a Bluetooth Low Energy set of vulnerabilities. You can see they've got quite a few vulnerabilities. In 2019, CVEs released based on this. Real quick backstory on the weird name.

So in the '90s, when the inventors of Bluetooth working for various industry partners, people like Intel, big companies like that, were trying to converge on a PAN, a personal area network, technology, the ringleader, one of the ringleaders, was a student of Scandinavian history. And it turned out King Bluetooth was able to unite the Viking kingdoms under one command. And so the joke was, once they were able to herd the cats and create Bluetooth, they should name it Bluetooth in honor of what King Bluetooth did.

Sweyntooth is a riff on that because Sweyntooth was King Bluetooth's son. And Sweyntooth overthrew his dad, King Bluetooth, to take over the kingdom. So the joke here is that Sweyntooth, the vulnerability is finding some pretty big vulnerabilities into Bluetooth, which I thought was a cute story. So Sweyntooth is not a compliant attack. It depends on sending malformed packets to Bluetooth Low Energy SoCs/System-on-Chips and actuating various bad things like deadlocks, crashes, and buffer overflows.

So they went meticulously through 13 different SoCs, and they noted those were in at least 480 different end devices, including things like MRI machines and glucose monitors, Fitbits, smart locks. The reason Sweyntooth is possible is because the Bluetooth spec leaves many features up to the vendor to implement. Just like any spec, it specifies the packet structure and some of the state machines, but ultimately, somebody's got to write some C code to deal with how all that works and make it reduce it to practice on a chip.

And because the spec is so complicated, there's tons of corner cases, and it's easy to imagine. In this case, it was proven that whoever's writing this, the SoC code missed corner cases and that causes these deadlocks and crashes and whatnot. So the gist of all the attacks is you're transmitting faulty packets over the air. And when the target system receives those packets and tries to parse them with the code on the system and chip, it ends up crashing or locking up the device.

So one example attack from their paper in this plot here is changing the link layer length field. So here, even though the link layer is only 5 bytes, they indicated it was going to be 247 bytes. And that leaves this big padding here where there's extra data, and that basically confuses the parsing logic in certain SoCs and causes them to crash.