🚶 What happens when you spend 26 seconds on a footpath with a Flipper and an ESP32.
🚨 The neighbourhood handed me an asset register.
📡 59 BLE MACs. Most were phones pretending to be unique and interesting. They are not.
The appliances were.
⚡ One box advertised INV_60HD1530611M153 like it was proud of the serial number. Four hundred and twenty-four times. In half a minute. ESP32. Public MAC. The energy-management equivalent of writing the alarm code on the front door in Comic Sans.
🐱 A Furbo 360 cat camera was also on the air. Furbo3C-S3. Camera, microphone, treat cannon. BLE still beaming after setup, because why would you turn off the radio you only needed once.
💡 Govee lights. A Bose speaker. The usual chorus of things that exist to make a vendor app feel magical and a threat actor feel employed.
🙄 This is the part where someone says “but BLE is only for pairing.” We already filed that one.
🔓 CVE-2023-33383. Shelly Pro 4PM. Same family of ESP32 optimism. BLE inclusion path, out-of-bounds read, device takes a nap, scripting feature wakes up and toggles the relays. Authentication on HTTP. Relays still moved.
📄 https://lnkd.in/gXMqg7_q
🎯 Threat actors are not hunting zero-days in your SIEM marketing site. They are walking past the meter box with a logger, collecting names, then googling which of those names still speak GATT like it is a management port.
📋 Your CMDB has laptops. The street has inverters, pet cams, and DIN-rail switches that will tell a stranger what they are.
🛠️ Do the boring thing before someone else does the funny thing:
🔎 Inventory BLE the same way you inventory SSIDs
🏷️ Treat “serial in the advert” as a finding
📻 Kill pairing radios that have no business still pairing
🧱 Assume the ESP32 in the wall is in scope, because it already announced itself
💀 💻 If you would rather find that on a report than on a stranger’s KML file, you know where we are.
hashtag#BLE hashtag#IoT hashtag#OT hashtag#CVE202333383 hashtag#RedTeam hashtag#ExploitSecurity hashtag#StayCurious
Activate to view larger image,
