Testing Your Smart Home's Bluetooth Security With BLEShark Nano
The average smart home now has dozens of Bluetooth Low Energy devices: smart locks, bulbs, thermostats, speakers, fitness trackers, appliances with Bluetooth pairing, asset tracking tags, baby monitors. Most of these devices were designed and sold primarily on the basis of their consumer features. Security was a secondary consideration at best.
This article covers what BLE devices in your home are broadcasting, what common security issues they have, and how to use the BLEShark Nano to audit your own home's Bluetooth footprint.
What BLE devices broadcast
BLE devices advertise on three fixed channels (37, 38, and 39) in the 2.4GHz band. Advertisement packets are sent continuously - typically every 100ms to 1000ms depending on the device's power budget and use case. These packets are receivable by any BLE scanner within range, typically 10-30 meters indoors.
Advertisement packets contain some combination of:
- Device name: The human-readable name the device presents. Often includes the model name ("Kasa Smart Plug," "August Lock," "AirPods Pro").
- Manufacturer-specific data: Vendor-defined bytes. Can include device state, device identifier, firmware version, or proprietary data. Apple uses this field heavily - the Apple Nearby protocol that triggers "New AirPods detected" popups lives in manufacturer-specific data.
- Service UUIDs: Identifiers for the GATT services the device offers. These reveal what the device can do - a device advertising the HID service UUID is presenting as a keyboard or mouse.
- TX power level: Enables range estimation from RSSI.
- Flags: Whether the device is connectable, whether it is already paired, whether it is in discoverable mode.
A device that is already paired and bonded to an owner typically reduces its advertisement footprint - it may switch to directed advertising (targeting only the bonded peer) or reduce broadcast frequency. But many consumer devices continue advertising broadly regardless of pairing state.
Common smart home BLE devices and their issues
Smart locks: These are the highest-stakes BLE devices in a typical home. A smart lock that uses "Just Works" BLE pairing - the weakest pairing mode, with no Man-in-the-Middle protection - can theoretically be connected to by any device without user confirmation. Whether that connection grants any useful access depends on what GATT services the lock exposes and whether they are authenticated at the application layer. Some locks have full application-layer authentication over BLE that makes "Just Works" pairing irrelevant to security. Others do not, and GATT characteristics are exposed without authentication once connected.
The concern is not theoretical - several lock brands have had published vulnerabilities in their BLE stack. In most cases these were fixed in firmware updates, which is why firmware update discipline matters for security-relevant IoT devices.
Smart bulbs and plugs: Lower-stakes but often poorly secured. Many use "Just Works" pairing and expose GATT characteristics that control on/off state without authentication. An attacker in BLE range can turn your lights on and off. This is annoying rather than dangerous for most threat models, but it does illustrate the principle.
Bluetooth speakers: Most advertise continuously with full device name visible. They often accept any pairing request without confirmation ("Just Works"). Anyone in range can pair and take over audio output. This is occasionally an actual nuisance issue in apartment buildings.
Asset trackers (AirTags, Tile, etc.): Designed to broadcast a beacon for detection. The tracking network depends on passive BLE scanning by other phones. From a security perspective, these devices have been studied extensively for tracking potential - a stalker placing one in a car or bag creates a location tracking risk. Apple's anti-stalking measures (unwanted AirTag detection alerts) are a response to this real-world misuse pattern.
Fitness trackers and smartwatches: Continuously advertise to maintain connection with a paired phone. The advertisement includes manufacturer data that can identify the exact device model. For a device that you wear everywhere, this creates a consistent BLE identifier that can be used for tracking if the device uses a static MAC address.
Smart home hubs (Philips Hue bridge, SmartThings): These often operate over Zigbee or Z-Wave rather than direct BLE, but many have Bluetooth as an additional interface. The BLE interface is often used for setup and initial configuration, sometimes with minimal security.
graph TD
SCAN["BLE Scan"] --> FIND["Discover smart
home devices"]
FIND --> ASSESS["Assess:
Pairing security?
Encryption?
Default credentials?"]
ASSESS --> REPORT["Document findings
and mitigations"]
Running a BLE scan with the BLEShark Nano
To audit your home's BLE footprint:
- Power on the BLEShark Nano and navigate to the BLE menu.
- Select BLE Scanner (or BLE Scan from the main menu).
- Walk through each room of your home, pausing for 30-60 seconds in each location. BLE devices need time to advertise - some devices have longer advertising intervals and will not appear immediately.
- Note every device that appears. The BLEShark shows MAC address, RSSI (signal strength), device name if present, and OUI lookup (manufacturer identification from the MAC prefix).
- Check the OUI lookup to identify unknown manufacturers. An unknown device from a manufacturer you do not recognize warrants investigation.
Pay particular attention to:
- Devices you do not recognize (unexpected advertising devices could be covertly placed trackers or unauthorized hardware)
- Smart locks advertising with high signal strength (confirms they are connectable and discoverable from outside your home)
- Devices using static MAC addresses (trackable; privacy-sensitive devices should use MAC randomization)
- Devices advertising from the exterior of your home that are visible from the street
Pairing modes and why they matter
BLE pairing has several modes with different security characteristics:
Just Works: No user confirmation required on either side. Any device can pair with a Just Works device without the owner's knowledge or approval. Provides no protection against Man-in-the-Middle attacks during pairing. Appropriate only for devices where physical access and use are already unrestricted (like a public kiosk).
Passkey Entry: A 6-digit passkey is displayed on one device and entered on the other, or generated randomly and matched. Protects against passive eavesdropping of the pairing exchange. The security depends on the passkey being random rather than predictable ("000000" or "123456" defeats the purpose).
Numeric Comparison: Both devices display the same 6-digit number and the user confirms it matches on both. Requires a display on both devices. Provides strong MITM protection.
Out-of-Band (OOB): Pairing data is exchanged through a non-BLE channel (NFC tap, QR code scan). Very strong security if the OOB channel is secure.
LE Secure Connections: A more modern variant that improves the cryptographic strength of all pairing modes. Supported by BLE 4.2+ devices.
The pairing mode used by a device is a significant indicator of its security posture. A smart lock using Just Works pairing with no application-layer authentication is meaningfully less secure than one requiring Passkey entry. Checking the manufacturer documentation or a published security analysis for your specific lock model is worthwhile.
Open GATT services
After pairing with a BLE device, the GATT (Generic Attribute Profile) protocol defines how you interact with it. Services contain characteristics, which are the actual data endpoints. Some characteristics require authentication to read or write; others are open to any connected device.
For smart home devices, the concern is characteristics that control device behavior without requiring authentication after pairing. In a "Just Works" pairing model where any device can connect, open GATT characteristics mean open device control.
A more thorough audit of smart home device GATT services uses a tool like nRF Connect (mobile app) rather than the BLEShark directly. The workflow:
- Use the BLEShark scanner to identify the device and its MAC address.
- Open nRF Connect on your phone.
- Connect to the device.
- Enumerate all services and characteristics.
- Note which characteristics have read/write permissions without an explicit authentication step.
- Test whether writing to control characteristics (on/off, lock/unlock) succeeds without authentication.
Do this only on your own devices. Connecting to a neighbor's BLE lock to enumerate its GATT services is not authorized access.
BLESpam interactions with smart home devices
The BLEShark's BLESpam feature broadcasts BLE advertisements that trigger pairing prompts on iOS, Android, and Windows devices. In the context of smart home devices, this is less about attacking the devices themselves and more about what it reveals.
If you run BLESpam in your home and your smart TV starts displaying "New headphones found" popups, that tells you the TV is running iOS or a similar proximity protocol implementation and is susceptible to these advertisement-triggered notifications. This is the kind of practical discovery that a BLE scan alone would not reveal - you can see the device is advertising, but you might not know it is susceptible to popup-based confusion until you test it.
BLESpam also reveals whether devices on your home network are watching for BLE advertisements in a way that could be exploited for device discovery. A speaker that pops up a "Want to connect?" notification when it sees a spoofed advertisement is revealing information about its connection behavior.
Practical hardening for smart home BLE
Audit and inventory. Know what BLE devices you have. The scan walkthrough above gives you a complete inventory. Unknown devices are a red flag that deserves investigation before hardening anything else.
Update firmware on all BLE devices. Most published BLE vulnerabilities in consumer devices were fixed in firmware updates. Devices running years-old firmware may have known, publicly documented vulnerabilities. Check each device manufacturer's site for firmware update procedures - many smart home devices update OTA automatically if configured.
Prefer devices with strong pairing modes. When buying new smart home hardware, look for documentation of the pairing mode used. "Passkey" or "Numeric comparison" or "NFC tap to pair" are all better than "Just Works." For security-critical devices like locks, this should be a purchase criterion.
Check smart lock BLE range from outside. Walk to the street or front of your property with the BLEShark BLE scanner. If your smart lock is still advertising at usable signal strength from outside, an attacker does not need to be at your door to interact with it. Some smart locks have range adjustment settings; others do not.
Disable BLE advertising on devices that do not need it. Some devices have a setting to reduce advertising or enter a non-discoverable mode when already paired. Smart speakers, for example, often have a pairing mode toggle - when not in pairing mode, they should not be advertising broadly.
MAC address randomization. For privacy-sensitive devices, check whether they support and use MAC address randomization. A device with a static MAC that you carry everywhere is a reliable tracking identifier. Apple devices randomize MAC addresses per network; many Android devices do the same. Fitness trackers and smartwatches often do not.
The BLEShark Nano gives you a practical view into your home's BLE environment for $36.99. Running the scan once a month takes about 10 minutes and tells you whether anything new has appeared in your BLE landscape. For households with security-relevant BLE devices (smart locks, alarm systems with BLE interfaces), it is a useful periodic check.