Introduction: Why this guide now?

SafeITExperts presents its new Bluetooth 2025 Guide Series, your roadmap to master everything from fundamentals to advanced use cases! Bluetooth is evolving with version 6.0 (Channel Sounding, Precision Tracking) and faces critical vulnerabilities like the 2025 Airoha CVEs. Understanding these changes is now essential.

In the first article, dive into Bluetooth 6.0: history, principles, 2025 innovations, and top security practices. Stay tuned for upcoming installments:

• Article 2 – Windows diagnostics and troubleshooting
• Article 3 – macOS & Linux configuration and fixes
• Article 4 – Buying guide for adapters, headsets, and speakers
• Article 5 – Pro use cases: gaming, IoT, multiroom, and more

Don’t miss out: each article gives you the keys to optimize, secure, and fully leverage Bluetooth in 2025.

Bluetooth History: From 1.0 to 6.0, a Remarkable Evolution

Bluetooth takes its name from Harald I of Denmark, nicknamed "Bluetooth" (blue tooth), a 10th-century Viking king who unified Denmark and Norway. This symbolic choice reflects the technology's ambition: to unify electronic devices in a universal communication standard.

Summary Table: 25 Years of Bluetooth Evolution

*Via Wi-Fi for High Speed, standard Bluetooth for pairing

Key Evolutionary Milestones

Operating Principles: Understanding the Technology

Bluetooth Frequencies and Transmission

Bluetooth uses the ISM 2.4 GHz frequency band (2.4 to 2.4835 GHz), free to use without license. This band is shared between:

• 79 channels for Bluetooth Classic
• 40 channels for Bluetooth Low Energy (BLE)

Anti-interference: FHSS Technique

To avoid interference with Wi-Fi and other devices, Bluetooth uses Frequency Hopping (FHSS):

🔄 The signal CHANGES frequency
   ⚡ 1600 times per second
   🔒 According to a random sequence known only to paired devices

→ Advantages: Better interference resistance + Enhanced security

Topology: The Piconet Concept

A piconet is a Bluetooth network composed of one master device and up to 7 simultaneously active slave devices. The master controls timing and the frequency hopping sequence. Up to 255 devices can be paired, but only 7 can be active simultaneously.

Several piconets can overlap to form a scatternet, where a device can be a master in one piconet and a slave in another. This configuration enables complex network topologies, though it's rarely implemented in practice due to its complexity.

Bluetooth Profiles: Interoperability Standards

Profiles define how devices use the Bluetooth connection for specific applications. Each profile specifies the necessary protocols, commands, and behaviors.

Pairing and Connection Process

Establishing a Bluetooth connection follows a 4-step process:

┌─────────────────────────────────────────────────────────────────────┐
│                   BLUETOOTH PAIRING PROCESS                         │
└─────────────────────────────────────────────────────────────────────┘

  DEVICE A                                              DEVICE B
  (Smartphone)                                          (Headset)
      │                                                        │
      │  ① DISCOVERY                                          │
      │ ─────────────────────────────────────────────────────>│
      │     BLE/Classic advertising signals                   │
      │     Broadcasting name, services, capabilities         │
      │                                                        │
      │  ② PAIRING - Security key exchange                    │
      │<──────────────────────────────────────────────────────>│
      │                                                        │
      │   ┌───────────────────────────────────────────────┐   │
      │   │    PAIRING METHODS (based on capabilities)   │   │
      │   ├───────────────────────────────────────────────┤   │
      │   │ • Numeric Comparison: 6-digit code            │   │
      │   │   [347821] = [347821] ✓                       │   │
      │   │   → High security, screens required           │   │
      │   │                                               │   │
      │   │ • Passkey Entry: PIN entry                    │   │
      │   │   Enter PIN: [****]                           │   │
      │   │   → Medium security, one screen sufficient    │   │
      │   │                                               │   │
      │   │ • Just Works: Automatic                       │   │
      │   │   Direct connection without interaction       │   │
      │   │   → Low security, basic IoT                   │   │
      │   │                                               │   │
      │   │ • Out of Band (OOB): Via NFC/QR               │   │
      │   │   [📱]──NFC──[🎧]                             │   │
      │   │   → Maximum security, separate channel        │   │
      │   └───────────────────────────────────────────────┘   │
      │                                                        │
      │        LTK (Long Term Key) generation                 │
      │        AES-128 encryption of communications           │
      │                                                        │
      │  ③ BONDING (Memorization)                             │
      │ ──────────────────────────────────────────────────────│
      │     Secure key storage in flash memory                │
      │     Enables future automatic reconnection             │
      │                                                        │
      │  ④ CONNECTION (Secure connection)                     │
      │<══════════════════════════════════════════════════════>│
      │        Encrypted data channel established             │
      │        Ready for audio/data streaming                 │
      │                                                        │
     ◉◉◉  ACTIVE CONNECTION - FHSS 1600 hops/second        ◉◉◉

Technical Notes:

Bluetooth 6.0 Features: Revolutionary 2025 Innovations

Announced in September 2024 and progressively deployed in 2025, Bluetooth 6.0 brings major improvements that redefine the technology's capabilities.

Channel Sounding: Precision Positioning

The flagship feature of Bluetooth 6.0 is Channel Sounding, a revolutionary technique for secure distance measurement between devices. Unlike previous methods based on signal strength (RSSI), Channel Sounding uses Time of Flight (ToF) and Angle of Arrival (AoA) measurement to determine distance with centimeter-level precision.

Practical Applications of Channel Sounding

You at restaurant 🍽️              Thief near your car 🚙
       │                                        │
       │   📱 Bluetooth Signal                  │
       │ ────────> [Relay] ──────────>        │
       │         Amplifier                      │
       └──────────────────────────────────────→ 🔓 Car unlocked!

You at restaurant 🍽️              Theft attempt 🚙
       │                                        │
       │   📱 Signal + distance measurement     │
       │ ────────> [Relay] ─X─ REJECTED        │
       │    Delay detected (>3ms)               │
       └──────────────────────────────────────→ 🔒 ACCESS DENIED

✅ The car measures response time with nanosecond precision
✅ Calculated distance: 50m detected vs 2m expected → Attack blocked

      You are here (GPS accuracy) 📍 
                │
     ┌──────────┴──────────┐
     │     TERMINAL 2      │
     │    [~15m error]     │ ❌ "Somewhere in the hall"
     └─────────────────────┘

      VS

      You are here (Channel Sounding) 📍
                │
     ┌──────────┴──────────┐
     │  Gate 23, Row C     │
     │  8m from Starbucks  │ ✅ Exact guidance to your gate
     └─────────────────────┘

    LIVING ROOM          KITCHEN              BEDROOM
┌───────────┐        ┌───────────┐        ┌───────────┐
│           │        │           │        │           │
│  💡 100%  │───You──│  💡 OFF   │────────│  💡 OFF   │
│  🌡️ 21°C  │  here! │  🌡️ ---  │        │  🌡️ ---  │
│  🎵 ON    │   📱   │  🎵 OFF   │        │  🎵 OFF   │
│           │        │           │        │           │
└───────────┘        └───────────┘        └───────────┘

Channel Sounding Gains Summary

Decision-Based Advertising Filtering

Decision-based advertising filtering drastically improves energy efficiency of BLE devices. Instead of waking the main processor for every received advertising packet, the Bluetooth controller can now intelligently filter advertisements according to predefined criteria (service UUID, device name, signal strength).

Concrete result: Up to 50% reduction in energy consumption for IoT devices in permanent scan mode, resulting in several additional months of battery autonomy.

Monitoring Advertisers: Optimized Connection Management

Imagine a hospital with 500 temperature sensors distributed across 10 floors. Before Bluetooth 6.0, monitoring all these devices simultaneously was an energy and logistical nightmare. Monitoring Advertisers changes the game.

LE Audio Improvements: Wireless Audio Finally Mature

Bluetooth 6.0 refines LE Audio (introduced in 5.2), transforming Bluetooth audio from "acceptable compromise" to "professional quality".

LE Audio Comparative Evolution

Reduced Latency: Gaming Becomes Viable

The historical problem:

🎮 Action in game            🎧 Sound in earbuds
    (t = 0ms)                    (t = 150ms)

    [BOOM! 💥]  ──────────────────────────> [BOOM! 🔊]
                   150ms delay
                   
❌ Result: Frustrating desynchronization

With Bluetooth 6.0:

🎮 Action in game            🎧 Sound in earbuds
    (t = 0ms)                    (t = 25ms)

    [BOOM! 💥]  ──────────> [BOOM! 🔊]
                  25ms only
                   
✅ Result: Imperceptible synchronization

Practical applications:

• 🎮 Competitive gaming: FPS, rhythm games (Beat Saber, Guitar Hero)
• 🎬 Video editing: Real-time preview without lag
• 🎤 Live streaming: Podcasts, Twitch/YouTube lives without latency
• 🎸 Digital instruments: Synths, pads, wireless audio interfaces

Enhanced Multi-stream: Share Audio Without Limits

Auracast™: Revolutionary Audio Broadcast

Frame Space Update: Invisible But Powerful Optimization

Bluetooth transmits data in "packets" spaced in time. Frame Space Update dynamically optimizes these intervals.

Bluetooth Security in 2025: Threats and Protections

Bluetooth security has never been more critical. With billions of connected devices and increasingly sophisticated attacks, understanding threats is vital.

Critical Airoha Vulnerability (CVE-2024-123xx)

Context: In January 2025, security researchers discovered a zero-day flaw in Bluetooth chipsets from Airoha Technology, a Taiwanese manufacturer that equips millions of earbuds and speakers from popular brands.

Threat Magnitude

Nature of Flaw: RCE (Remote Code Execution)

┌────────────────────────────────────────────────────────────┐
│               AIROHA CVE ATTACK CHAIN                      │
├────────────────────────────────────────────────────────────┤
│                                                            │
│  1️⃣ RECONNAISSANCE (5 seconds)                            │
│     Attacker scans Bluetooth environment                   │
│     Identifies vulnerable Airoha chipset                   │
│     └─> 🎧 "Sony WF-XB700" detected (Airoha AB1562)       │
│                                                            │
│  2️⃣ EXPLOITATION (10 seconds)                             │
│     Sends special malformed Bluetooth packet               │
│     Buffer overflow in Bluetooth chipset stack             │
│     └─> 💉 Shellcode injected in memory                   │
│                                                            │
│  3️⃣ CONTROL (instant)                                     │
│     Arbitrary code execution with max privileges           │
│     └─> 🎛️ Attacker fully controls device                │
│                                                            │
│  4️⃣ MALICIOUS ACTIONS (persistent)                        │
│     │                                                      │
│     ├─> 🎤 Activate mic remotely (espionage)              │
│     ├─> 🔊 Intercept audio stream (conversations)         │
│     ├─> 📱 Attack connected smartphone (pivot)            │
│     └─> 🦠 Install persistent backdoor (botnet)           │
└────────────────────────────────────────────────────────────┘

Affected Devices (non-exhaustive list)

Immediate Actions to Take

Relay Attacks: The Invisible Threat of Contactless Keys

Anatomy of a Relay Attack on Car Key

Relay attacks exploit a fundamental weakness: blind trust in authentication without distance verification.

┌────────────────────────────────────────────────────────────┐
│            RELAY ATTACK - DOCUMENTED BMW X5 CASE           │
├────────────────────────────────────────────────────────────┤
│                                                            │
│  📍 LOCATION: Restaurant 16th arrondissement, 9:30 PM      │
│                                                            │
│  👤 Victim (Marc)              🚙 BMW X5 (parking)         │
│      │                              │                      │
│    [📱] BT Key                      │                      │
│     pocket                           │                      │
│      │                              │                      │
│      │  🕵️ Attacker A            🕵️ Attacker B           │
│      │  (next table)             (near car)               │
│      │   [📡 Relay RX]           [📡 Relay TX]            │
│      │         │                        │                  │
│      └─────────┼────────────────────────┘                  │
│                │     Amplified signal                      │
│                │     Range: 50m real                       │
│                │     = car "thinks" key at 2m              │
│                │                                           │
│  ⏱️ TIMELINE:                                              │
│    21:32 → Bluetooth car scan                              │
│    21:33 → Marc's key detected via relay                   │
│    21:33 → Car unlocked ✓                                 │
│    21:34 → Engine started ✓                               │
│    21:35 → Car gone (value €65,000)                       │
│                                                            │
│  💰 ATTACK COST: €300 equipment (AliExpress/eBay)         │
│  ⏱️ TOTAL TIME: 3 minutes                                  │
│  🎯 SUCCESS: 100% (no alert)                               │
└────────────────────────────────────────────────────────────┘

Relay Attack Theft Statistics (France 2024-2025)

Protection with Bluetooth 6.0 Channel Sounding

BEFORE BT 6.0 (vulnerable)         WITH BT 6.0 (Channel Sounding)
─────────────────────────────      ──────────────────────────────
Car: "Key detected?"               Car: "Key detected?"
   ↓                                  ↓
Key: "Yes, it's me! [auth]"        Key: "Yes, it's me! [auth]"
   ↓                                  ↓
Car: "OK, unlock"                  Car: "At what distance?"
   ↓                                  ↓
✅ OPENED                           ToF time measurement
                                      └─> Response: 47ns
                                      └─> Calculated distance: 14.1m
                                      └─> Expected: <2m
                                      ↓
                                   ❌ REJECTED - Attack detected!
                                   🚨 Owner smartphone alert

Detection precision:

• Error margin: ±10 cm on distances <5m
• Reaction time: <50 milliseconds
• False positives: <0.01% (quasi-null)

Immediate Protections (awaiting widespread BT 6.0)

BlueBorne and Successors: Ghosts of the Past

BlueBorne (2017): The Brutal Awakening

BlueBorne demonstrated that an unpaired, even invisible Bluetooth device could be compromised remotely. 8 critical vulnerabilities affecting Android, iOS, Windows, Linux.

What an attacker could do:

• Take full control of smartphone
• Steal data (contacts, photos, passwords)
• Install persistent malware
• Propagate to nearby Bluetooth devices (worm)

2025 situation: Largely corrected, but millions of legacy devices still vulnerable (industrial IoT, medical equipment, Android 7 and earlier).

Modern Attacks: KNOB, BIAS, BLURtooth

KNOB (Key Negotiation of Bluetooth) - Technical Detail

NORMAL NEGOTIATION (secure)
────────────────────────────────────────────
Device A: "I support 128-256 bit keys"
Device B: "Me too, let's use 128 bits"
   ↓
🔐 AES-128 encryption (2^128 combinations)
   = Impossible to crack (10^20 years)

KNOB ATTACK (Man-in-the-Middle)
────────────────────────────────────────────
Device A: "I support 128-256 bit keys"
   ↓ [INTERCEPTED by attacker]
Attacker → Device B: "A supports only 1 byte"
Device B: "OK, let's use 1 byte then"
   ↓
🔓 8-bit encryption only (256 combinations)
   = Crackable in <1 second by modern CPU
   
Attacker decrypts ALL communications

BIAS (Bluetooth Impersonation AttackS) - Identity Spoofing

An attacker can impersonate an already paired device by exploiting a weakness in the reconnection process.

┌────────────────────────────────────────────────────────────┐
│                   BIAS ATTACK - STEPS                      │
├────────────────────────────────────────────────────────────┤
│                                                            │
│  1️⃣ RECONNAISSANCE PHASE                                  │
│     Attacker observes existing pairings                    │
│     📱 Smartphone ↔ 🎧 AirPods (MAC address captured)     │
│                                                            │
│  2️⃣ DISCONNECTION PHASE                                   │
│     Attacker forces disconnection (jamming, DoS)           │
│     🎧 AirPods temporarily disconnected                    │
│                                                            │
│  3️⃣ SPOOFING PHASE                                        │
│     Attacker spoofs AirPods MAC address                    │
│     Initiates reconnection WITHOUT full authentication     │
│     └─> Flaw: BT assumes "already authenticated" = trust  │
│                                                            │
│  4️⃣ COMPROMISE PHASE                                      │
│     📱 Smartphone accepts "fake AirPods"                   │
│     Attacker intercepts audio stream                       │
│     Can inject malicious audio (voice phishing)            │
└────────────────────────────────────────────────────────────┘

Summary: 2025 Bluetooth Risk Matrix

Security Action Plan: Your Roadmap

IMMEDIATE Actions (< 1 week)

SHORT TERM Actions (< 1 month)

• Advanced security: Car key (Faraday pouch + night disable), IoT segmentation (guest VLAN)
• Training & awareness: Read manufacturer security guides, Share best practices, Subscribe to security alerts (CERT, CISA)
• Enterprises: Draft/update Bluetooth policy, Complete MDM inventory, Mandatory employee training

LONG TERM Actions (< 6 months)

• Infrastructure modernization: Replace unpatchable legacy devices, Migration to Bluetooth 6.0
• Defense in depth strategy: Strict network segmentation, Enhanced encryption, Automated key rotation
• Continuous monitoring & improvement: Subscribe to Bluetooth CVE feeds, Participate in security communities, Regular testing

Bluetooth Classic vs Bluetooth Low Energy: Which Choice?

The Battle of Two Protocols

*With LE Audio (BT 5.2+), BLE latency becomes competitive

Selection Guide: Which Bluetooth for Your Project?

Choose Bluetooth Classic if...

Choose Bluetooth LE if...

Dual Mode: Best of Both Worlds

Modern chipsets (smartphones, tablets, PCs) integrate both protocols simultaneously:

┌─────────────────────────────────────────────────────────┐
│               INTELLIGENT DUAL MODE STRATEGY                │
├─────────────────────────────────────────────────────────┤
│                                                             │
│  📱 Dual Mode Smartphone                                    │
│      │                                                      │
│      ├──🟢 BLE ──────────> 🏃 Smartwatch (notifications)   │
│      │   (100 µW)          ⏱️ Battery: 3 days              │
│      │                                                      │
│      ├──🟢 BLE ──────────> 🌡️ Home sensors (scan)         │
│      │   (1 mW)            🔋 Autonomy: 2 years            │
│      │                                                      │
│      └──🔵 Classic ──────> 🎧 Headset (audio streaming)    │
│          (50 mW)            🎵 Quality: AAC 256 kbps       │
│                             🔋 Autonomy: 30h                │
└─────────────────────────────────────────────────────────┘

Quick Decision Table

Special Case: LE Audio (Bluetooth 5.2+)

With the arrival of LE Audio in 2020-2025, BLE becomes viable for audio:

Result: True Wireless 2025+ earbuds/headsets gradually migrate to LE Audio for autonomy gains without quality loss.

Conclusion: Master Bluetooth to Better Secure It

Bluetooth 6.0 represents a major evolution that addresses security and precision challenges of previous years. Channel Sounding marks a turning point in the fight against relay attacks, while energy optimizations (Monitoring Advertisers, Frame Space Update) and continuous LE Audio improvement further extend the autonomy and quality of connected objects.

However, like any ubiquitous technology, Bluetooth remains a prime target for attackers. The continuous discovery of vulnerabilities like those in Airoha chipsets, sophisticated relay attacks on car keys, and persistence of historical flaws (KNOB, BIAS) remind us of the importance of constant vigilance.

The 3 Pillars of Sustainable Bluetooth Security

For IT professionals and security managers, deep Bluetooth mastery is no longer optional. With billions of deployed devices and growing presence in critical infrastructure (healthcare, industry, smart buildings, connected vehicles), every vulnerability can have serious consequences on privacy, physical security, and business continuity.

The technical fundamentals covered in this article allow you to understand how Bluetooth really works, beyond the "magic" of wireless connection. This understanding is the necessary foundation for effectively diagnosing problems, anticipating security flaws, and designing robust architectures.

Your Next Concrete Actions

1. Today: Audit your Bluetooth devices and launch critical updates
2. This week: Implement immediate protections (Faraday, night BT disable)
3. This month: Formalize your Bluetooth security strategy (personal or enterprise policy)
4. This year: Plan migration to Bluetooth 6.0 for your critical equipment

Sources & References

Official Bluetooth & Security Sources

• Bluetooth SIG - Core Specification 6.0 (2024): bluetooth.com/specifications
• NIST Special Publication 800-121r2: Guide to Bluetooth Security
• CVE Airoha Bluetooth Stack 2025: CVE-2025-20700, CVE-2025-20702
• Armis Security Research Papers: BIAS (2020), KNOB (2020), BLUFFS (2023)
• ANSSI - Bluetooth Recommendations: cyber.gouv.fr
• IEEE Papers - Channel Sounding: Silicon Labs Technical Documentation
• Bluetooth 6.0 Feature Overview: bluetooth.com
• Dell Security Advisory DSA-2025-303

Recommended Reading SafeITExperts

• Tutorial 2025: Install KDE Unstable Plasma on Tumbleweed
• Tech News
• Security and Privacy Linux, Windows, macOS
• End of Windows 10 support – transition guide