The Bluetooth Attack Surface You Forgot About

Bluetooth is in everything. The phone in your pocket. The watch on your wrist. The AirTag in your bag. The conference room sensor counting occupants. The badge reader at the office door. The fitness band on the gym goer next to you. The toothbrush you bought last month. The total number of Bluetooth devices shipped in 2025 was around 4.5 billion by some industry estimates. It will be closer to 5.5 billion in 2026.

Most security teams have not patched a Bluetooth vulnerability in years. The threat model does not include it. The vulnerability scanner does not see it. The EDR does not see it. The endpoint inventory does not include it. The Bluetooth attack surface has been quietly growing while the rest of the security stack has been watching the network.

The threat model gap

When security teams build a threat model for an office, the assets are laptops, phones, servers, maybe printers. The threats are phishing, credential theft, lateral movement, ransomware. Bluetooth is not in the model. The reasoning is that Bluetooth is short range, requires physical proximity, and is therefore not a high-probability vector for a serious attack.

That reasoning is roughly accurate for the 2010s version of Bluetooth. It is not accurate for the 2026 version.

Modern Bluetooth Low Energy (BLE) is used in a way that the threat model did not anticipate. The AirTag is a BLE device. It broadcasts a rotating identifier to nearby Apple devices, which then relay its location back to Apple servers. That same protocol, called Find My, with similar implementations from Samsung, Google, and Tile, is now built into headphones, laptops, key finders, and a growing list of consumer devices. The attacker who can spoof or replay these broadcasts can manipulate the location data that flows through the relay network.

Conference room sensors are BLE. They count occupants, control lighting, and feed the HVAC system. They are managed by facilities teams, not IT. The firmware is rarely updated. The default credentials are documented and publicly available. They are on the same network as the badge readers, which are on the same network as the user directory, which is on the same network as everything else.

The fitness band is BLE. It broadcasts heart rate data to the paired phone. The paired phone may auto-sync to a cloud service. The cloud service may share data with a third party for analytics. The data flow is opaque to the user, let alone the security team.

The vulnerabilities that prove the point

BlueBorne, disclosed in 2017, showed that Bluetooth implementations on major operating systems could be remotely compromised without any user interaction. The attack worked against phones, laptops, and IoT devices. The patches came out. The lesson did not stick, because the threat model still said Bluetooth was not a priority.

SweynTooth, 2019, found 11 vulnerabilities in BLE software development kits used in 480 products. Many of those products are still deployed. Some of them cannot be patched because the manufacturer is out of business.

BrakTooth, 2021, found 16 vulnerabilities in the Bluetooth stack used in a billion-plus devices. Cars, medical devices, industrial controllers. Some of the affected devices are still in production.

In 2024 and 2025, several researchers demonstrated BLE-based tracking attacks against the Find My network. The attacks did not require compromising the target device. They spoofed a Find My broadcast and made the target location appear somewhere it was not, or tracked a device movement by the Apple devices that picked up its broadcast.

In 2026, the trend is not improving. The number of BLE devices is growing faster than the number of people who can patch them. The skill required to find a Bluetooth vulnerability is high. The skill required to deploy a publicly available Bluetooth attack is low and dropping. Exploit code for BlueBorne-class issues has been in Metasploit for years. The implementations of Find My relay attacks are in academic papers with public proof-of-concept code.

What defenders are missing

Three things, mostly.

Asset inventory. A lot of organizations do not know how many BLE devices are in their environment. The badge readers are known. The conference room sensors are partially known. The fitness bands, the AirTags, the personal devices brought in by staff and visitors, are not. A walk-around with a BLE scanner (a $20 USB dongle and a free app) will turn up dozens of devices in a typical office. The security team did not know about most of them.

Network segmentation. BLE devices that need network connectivity are usually connected through the closest available network, which is the corporate WiFi. The badge readers are on the same VLAN as everything else. A compromised conference room sensor can talk to the user directory. The fix is to put these devices on a separate, isolated network with no path to the corporate environment. Most organizations have not done this.

Patch management. The supply chain for BLE devices is long. The chip vendor writes the stack. The device vendor integrates it. The system integrator builds the product. The customer buys the product. A vulnerability in the chip vendor stack can persist in the customer product for years if the device vendor does not push a firmware update and the customer does not have a way to deploy one. Some devices cannot be patched at all, and the customer does not find out until the next vulnerability disclosure.

What to do about it

Start with inventory. A BLE scan of the office will produce a list of devices that surprises the security team and the facilities team. The list is the basis for the rest of the work.

Then segment. BLE devices that need network access get their own VLAN. No path to the corporate network. No path to the user directory. No path to the internet unless they need it for a specific reason.

Then update the threat model. The threat model is a living document, not a one-time project. Add the BLE attack surface. Add the device categories that are part of it. Add the known vulnerabilities. Add the threat actors who would use them. The threat model without Bluetooth is a 2015 threat model.

The bottom line

The Bluetooth attack surface is bigger than the threat model acknowledges. The skill required to exploit it is dropping. The skill required to defend it is the same as the skill required to defend any other part of the network, plus a $20 USB dongle. The organizations that figure this out first will be the ones whose threat models get updated this year. The rest will be the ones answering questions in 2027 about why a compromised conference room sensor led to a credential database exposure.

Spotted an error? Email the editor. Corrections are issued with a visible correction note.

Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.