BLE Security Testing: Survey of Attacks and Evaluation of Tools and Frameworks

Nowadays, more and more areas of our lives are becoming ‘smart,’ including homes, industrial sites, and medical devices. Since sensitive data is transmitted over various protocols, manufacturers must ensure that the data is adequately secured. To do so, penetration testing on these devices is an option, ideally before market launch. Depending on the protocol, various tools and frameworks exist. We chose the Bluetooth Low Energy (BLE) protocol for analysis due to its widespread use and started our work by classifying possible threats to BLE into four categories based on the attacks executable by the identified tools and frameworks. Threats targeting BLE Mesh and BLE privacy and localization were identified through a literature review and added to the corresponding categories of our taxonomy.

Subsequently, we conducted an in-depth evaluation of these tools and frameworks targeting BLE (excluding BLE Mesh, and BLE privacy and localization) on four medical devices to empirically determine which tools and frameworks remain usable for pentesting BLE devices. Furthermore, we analyzed which threats in our taxonomy remain feasible. Our results show that only eight out of 21 (38%) attacks can still be carried out. The tools and frameworks capable of conducting these attacks are mostly still maintained, emphasizing the importance of keeping such tools and frameworks up to date for future use. Nevertheless, current BLE pentesting requires a patchwork of multiple, often unmaintained frameworks to realize all known attacks — this demonstrates an urgent need for a single, extensible, actively maintained framework that allows attacks to be integrated modularly.

Published in IEEE Open Journal of the Communications Society, Vol. 7, pp. 5774–5799, 2026 (Open Access, CC BY 4.0). DOI: 10.1109/OJCOMS.2026.3691569