auditing-ble-and-gatt-authorizationlisted

# Auditing BLE and GATT authorization: the peripheral must enforce access, not the app A Bluetooth Low Energy peripheral exposes its functionality as GATT characteristics that any peer in radio range can attempt to connect to and read or write, and the security question is entirely on the peripheral: does it enforce who may touch each characteristic, or does it assume the only client is its own trusted mobile app. The common failure is trusting the app. The app shows a login and a permission model, but the peripheral itself accepts reads and writes from any connected peer, so a peer that skips the app and talks to the GATT server directly performs the sensitive action, unlocking, dumping data, changing a setting, with no check. Pairing and bonding, which establish link encryption and a persistent trust relationship, are frequently not required, or fall back to the unauthenticated Just Works association that gives encryption without authenticating who is on the other end, so a sniffer or a man in the middle reads the traffic. And commands sent without authentication can be captured over the air and replayed. The audit connects to the peripheral as an arbitrary peer, enumerates its GATT attributes, and checks whether the device, not the app, enforces authorization on each. You audit this by talking to the GATT server directly and seeing what it lets an unauthorized peer do. ## When to use - A BLE peripheral (wearable, lock, sensor, medical or IoT device) exposes GATT charact