Using Protocol State Fuzzing to Test Bluetooth Low Energy Implementations

Protocol state fuzzing is a black-box testing technique that can be used to learn state machines describing the behavior of a system, such as a protocol implementation. In previous work, this has been successfully done for protocols like SSH, DTLS or EDHOC to find bugs where the implementation's behavior deviates from the specification. This thesis demonstrates that protocol state fuzzing can also be applied to wireless network protocols by learning the models of multiple Bluetooth Low Energy network stacks. Two different test setups for open-source and closed-source stacks are being implemented and compared. With one of them, tests are run entirely in software, where the wireless connection is being simulated, while the other runs tests on real hardware, where packets are sent over the air. The learned models are compared and deviations from the specification are identified. One of them is a bug with possible security consequences that was reported and confirmed by the developers. Non-deterministic behavior is discussed as the main challenge when testing hardware targets.