Live connection hijacking

Mechanism

Connection hijacking follows the hop sequence of an established connection, stabilises over several connection events, then injects link-layer traffic as the master role. The original central desynchronises and is evicted; the peripheral now answers to the attacker. Because no pairing key is needed when the link is unencrypted, Just-Works/unencrypted devices have no cryptographic barrier to this. The clean operational pattern is hijack → terminate → reconnect: rather than fight the phone for the link, send LL_TERMINATE_IND as the new master, let the device re-advertise, and reconnect for full, uncontested GATT control.

Three families of takeover are documented in the literature. Jam-and-hijack (Btlejacking) follows the connection, jams the original central out, and assumes the master role using low-cost hardware such as a BBC micro:bit. Injection-based takeover (InjectaBLE) exploits the predictability of connection-event timing to inject link-layer frames into the live connection, enabling a slave-role hijack or a man-in-the-middle; the authors describe this as inherent to the BLE specification rather than to any single implementation. A distinct reconnection-spoofing variant (BLESA) targets stacks that do not enforce authentication on reconnection, letting an attacker impersonate a previously-paired peer after forcing a reconnect.

Procedure

1. Sniff the target connection and learn the control handle and command format from legitimate traffic (RFSAM-RES-04).
2. Stabilise following over N connection events, then hijack the master role (RFSAM-RES-06).
3. Verify takeover by writing the learned command and observing device response.
4. Optionally terminate (LL_TERMINATE_IND) and reconnect cleanly for full GATT access.
5. Document the desynchronisation of the original central.

Field case

Against the ELK-BLEDOM LED controller: sniffing the vendor app setting a colour revealed handle 0x000E with format 7e 07 05 RR GG BB 10 ef. After hijacking the live connection (DATA→CENTRAL), writing w 0x000e 7e 07 05 03 ff 00 00 10 ef drove the strip to the attacker’s colour. The same technique applies unchanged to locks and medical devices — the LED strip is merely the harmless, vivid demonstration. A real implementation detail: the decoder’s current Access Address must be set to the connection AA only after reaching CENTRAL (with a flush first), because advertisements seen during INITIATING reset it to the advertising AA and silently break data-PDU decoding.

Remediation

Encrypt the link with LE Secure Connections — the InjectaBLE authors recommend exactly this as the primary countermeasure (LESC pairing with authentication and 128-bit keys), and it is the strongest single mitigation here. Note the precise effect: the timing-based injection itself is inherent to the BLE specification and is not stopped by encryption, but on an encrypted link any injected data PDU carries no valid MIC and is rejected by the peer, so forged commands and payloads do not take effect (cayre2021injectable). Add application-layer command authentication so a hijacked or injected link still cannot issue trusted commands. Enforce reconnection authentication to close the BLESA class (wu2020blesa). Treat the link as untrusted by default.