Wireless Lab 02 — BLE / IoT Posture Evaluator
WARMUP: Chapters 6–8 (Bluetooth/BLE, NFC/RFID, IoT).
Threat model
Cheap, long-lived, rarely-patched IoT devices set your wireless security floor. The weaknesses are predictable: BLE Just Works pairing (encrypted but no MITM protection), no application-layer auth ("paired" ≠ "authenticated" — anyone nearby drives the device), default credentials, unsigned or absent OTA (can't patch / attacker pushes firmware), static-ID RFID/NFC tags (clonable), hardcoded keys, and trackable MACs. This engine turns device metadata into a severity-ranked findings list.
What you build (lab.py)
evaluate(device)—ble-no-pairing(critical),ble-just-works(high),no-app-layer-auth,default-credentials(critical),hardcoded-keys,no-ota/unsigned-ota/ota-no-antirollback,clonable-static-id,trackable-mac— severity-sorted.is_secure(device)— nothing medium-or-above.
Attack cases the tests cover
- A device with Numeric-Comparison pairing, app auth, and signed+anti-rollback OTA is clean.
- Just Works = high; no pairing = critical; default creds = critical (first); each OTA tier flagged correctly; static-ID tag clonable while crypto-challenge is clean; BLE checks skipped for non-BLE devices; severity-sorted output.
Run
pip install -r requirements.txt
LAB_MODULE=solution pytest -q
pytest -q
Hardening / extensions
- Add a segmentation check (is the device on an isolated VLAN?) — the blast-radius control.
- Model known CVE/protocol-downgrade exposure (KNOB, BleedingTooth) by firmware version.
- Evaluate sub-GHz remotes for static/rolling-code replay/roll-jam exposure.
Interview / resume
"Built a BLE/IoT posture evaluator flagging Just Works pairing, missing app-layer auth, default credentials, unsigned OTA, and clonable static-ID tags — encoding that 'paired' is not 'authenticated' and that the cheapest device sets the wireless security floor."
Limitations: metadata analysis only; no live BLE/NFC interrogation; rule set is the common high-value weaknesses, not exhaustive.