BISON: Attacking Bluetooth’s Broadcast Isochronous Streams

Summary

Demonstrates takeover of a Bluetooth broadcast packet stream on development boards and explains why a shared broadcast code cannot distinguish a legitimate sender from another code holder; audio-data exploitation remains future work.

Key findings

• Sections 2 and 3 distinguish open broadcasts from encrypted broadcasts whose receivers share a Broadcast_Code. Public synchronization information exposes the timing and radio channels even when the audio is encrypted.
• Sections 3 and 4 explain that an attacker who can overpower the legitimate signal at a receiver can replace unencrypted packets; for encrypted content the attacker needs the shared Broadcast_Code. The described takeover diverts a receiver to a forged stream while the original transmitter continues broadcasting.
• Section 5 demonstrates the attack with two Nordic nRF5340 audio development kits acting as sender and receiver and one nRF52840 development kit acting as attacker, running modified Zephyr software.
• Section 8, Conclusions and Future Work (proceedings page 261; PDF page 6), leaves extending the attack to exploit audio data and demonstrating its impact on finished LE Audio devices to future work. Section 5 establishes redirection and reception of forged packets; it does not report a listener hearing a substituted announcement.
• Section 6 discusses stronger code exchange, digital signatures and monitoring received signal strength. It cautions that signatures add processing demands and that signal-strength changes are hard to interpret in mobile settings. These are proposed countermeasures, not established venue protections.

Limits

Three development boards, no listener study, installed venue trial, attack prevalence estimate or product-wide success rate. The encrypted-stream analysis assumes access to the code; the demonstration does not establish that encryption can be bypassed without it. The paper's broad description of control information as plaintext should be read alongside Core 6.0 Volume 6 Part E, which protects non-empty encrypted control payloads too. Publication date and peer-review status checked against the university's publication record; DOI 10.5555/3639940.3639973.

Read the original

www.carloalbertoboano.com/documents/gasteiger23bison.pdf

Link checked 13 October 2026. We link to the original and do not host copies.

Cited in

• Can venue broadcasts be spoofed, hijacked or jammed, and what protects them?Partly answered

Cite this source

The accessed date is when this library last checked the link; use the date you read it. To point readers to this summary instead, link to https://assistivelisteningknowledgebase.org/evidence/gasteiger-2023-bison/

Every finding here cites its source, and who funded each source is labelled. This site does not recommend products. Found an error or a missing study? Suggest a correction.