WS5 - Learning to Hack Bluetooth Low Energy with BLE CTF

Instructed by:  Ryan “Hackgnar” Holeman

Level of Difficulty: Beginner, Intermediate, Advanced

Abstract:

BLE CTF is a series of Bluetooth Low Energy challenges in a capture-the-flag format, created to teach the fundamentals of interacting with and hacking BLE services. Each flag interactively introduces a new concept.

Over the years, BLE CTF has expanded across platforms and skill levels. Books, workshops, trainings, and conferences have adopted it as both an educational platform and CTF. As an open source, low-cost, extensible solution, it has helped advance Bluetooth security research.

This workshop teaches the fundamentals of hacking BLE through hands-on exercises that introduce beginners to new concepts while giving experienced users a chance to try new tools and techniques. After completing it, you will have a solid understanding of how to hack BLE devices in the wild.

New for DEF CON 34: the workshop uses a brand new variant of BLE CTF built specifically for this event. Returning students will face fresh challenges they have not seen before, and the new exercises are designed to resist online walkthroughs and LLM-assisted shortcuts. We will also introduce new client tools, including gratttool, a modern replacement for gatttool (which has been deprecated from most Linux distributions). Whether this is your first BLE CTF or your eighth, you will leave with new skills and tools.

Pre-Requisites:

·      Basic Linux CLI experience

To prepare for the workshop, please follow the setup documentation that will be published at a custom GitHub page for this specific class (link to be provided via email closer to the event). It will walk through installing BlueZ, gratttool, and other client tooling, and verifying your laptop can talk to a BLE peripheral before you arrive. All ESP32 BLE CTF modules will be preflashed and provided at the workshop, so no hardware prep is required.