The Internet of Things (IoT) comprises heterogeneous embedded devices that exchange sensitive data through wireless technologies such as Bluetooth. These systems span constrained devices, mobile platforms, resource-rich embedded systems, hardware components, firmware, software, and product lifecycles. Securing them is challenging because threats can arise at different points in this stack: before deployment, during protocol execution, after a software compromise, or from interactions between protocol design and implementation behavior.
A recurring problem in Bluetooth-enabled IoT systems is that security assumptions made during threat modeling may be violated at the protocol design or implementation level. A threat model may omit hardware, firmware, or lifecycle risks; a protocol may remain secure only while endpoint software is uncompromised; a deployed device may expose vulnerable behavior that is not captured by the specification; and a patch may fix one attack without removing the design flaw that enabled it. For this reason, securing such systems requires connecting the main stages of the security lifecycle: proactive threat modeling, vulnerability testing of concrete devices, protocol-level vulnerability analysis and discovery, hardening against software compromise, and the design, implementation, and evaluation of new security protocols.
The five contributions of this thesis address these cross-level failures across that lifecycle. First, we introduce the AttackDefense Framework (ADF), a novel threat-modeling approach that unifies hardware, software, protocol, and lifecycle threats into a structured, machine-checkable data format. Second, we present BlueToolkit, a black-box Bluetooth security testing framework for design- and implementation-level vulnerabilities. We evaluate BlueToolkit through a case study involving Bluetooth-enabled cars. Third, we expose new critical design flaws in BLE security protocols, demonstrating that they are vulnerable to BLE re-pairing (BLERP) impersonation and Man-in-the-Middle attacks. Fourth, we show that the BLE specification and its implementations do not protect secrets from software compromise. To mitigate this, we propose HardaBLE, a backward-compatible architecture that isolates secret keys within a hardware-enforced Secure Processing Environment (SPE) using integrity-bound authorization. Finally, we show how Bluetooth security protocols have carried vulnerabilities for years without proper patching, and we present BlueBrothers, a formally verified, clean-slate redesign of Bluetooth security protocols that eliminates recurring design flaws while improving latency and energy consumption on constrained devices.
