DissPair

DissPair - Bluetooth Security Toolkit

DissPair is an innovative educational toolkit designed for exploring the intricacies of Bluetooth Classic (RFCOMM) and Bluetooth Low Energy (BLE GATT) protocols in controlled lab environments. This native Android application built with Kotlin and Jetpack Compose empowers students, hardware developers, and security researchers to engage with Bluetooth technology at a low level, revealing the real behavior of devices as compared to their advertised capabilities.

Key Features

• Multi-Platform Support: Available on both Android and Linux, catering to users’ varying preferences.

  • Android: A mobile application enabling on-device Bluetooth analysis and environment exploration.
  • Linux CLI: A Python-based command-line tool employing native Bluetooth sockets, allowing for in-depth protocol analysis.

• Device Discovery and Interaction:

  • Scan for nearby Bluetooth devices, including both Classic and BLE.
  • Utilize probing techniques to interact with RFCOMM channels and GATT services, providing insights into the protocols' behaviors.

• Advanced Analysis Tools:

  • Conduct RFCOMM channel enumeration and payload injections to test the robustness of Bluetooth implementations.
  • Perform GATT analysis with capabilities to read and write characteristics, facilitating a deeper understanding of BLE interactions.

Workflow Overview

Scan   →  Discover nearby Bluetooth devices (Classic BR/EDR and BLE)
  ↓
Sweep  →  Probe RFCOMM channels (1–30) on your own device
  ↓
Map    →  Identify active vs advertised services
  ↓
Analyze → Interact with protocols (RFCOMM / GATT) to study behavior

Security Advisory

DissPair is strictly intended for authorized use only. It is imperative that users only test on devices that they own or have explicit permission to examine. Unauthorized access to third-party devices can violate legal statutes globally.

CVEs Discovered with DissPair

This toolkit has facilitated the discovery of various vulnerabilities, such as:

• CVE-2026-31280: Vulnerability in the RFCOMM service of specific Bluetooth devices leading to Denial of Service (DoS).
• CVE-2025-67133: Local denial-of-service vulnerability found in a BLE component of certain devices.

Use Cases

DissPair is suitable for:

• Students aiming to learn the internal workings of Bluetooth protocols.
• Hardware developers validating their Bluetooth implementations.
• Security researchers focused on analyzing and testing Bluetooth-related vulnerabilities in controlled settings.

Conclusion

In summary, DissPair bridges the gap between theoretical knowledge and practical application for Bluetooth technologies. With its comprehensive features for device analysis, it serves as a valuable resource for anyone interested in understanding Bluetooth protocols in depth.