{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,20]],"date-time":"2026-09-20T19:11:01Z","timestamp":1789931461672,"version":"4.0.1"},"publisher-location":"New York, NY, USA","reference-count":63,"publisher":"ACM","license":[{"start":{"date-parts":[[2020,10,30]],"date-time":"2020-10-30T00:00:00Z","timestamp":1604016000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"National Science Foundation","award":["1750809,1834215"],"award-info":[{"award-number":["1750809,1834215"]}]},{"DOI":"10.13039\/100000185","name":"Defense Advanced Research Projects Agency","doi-asserted-by":"publisher","award":["N6600120C4020"],"award-info":[{"award-number":["N6600120C4020"]}],"id":[{"id":"10.13039\/100000185","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100007297","name":"Office of Naval Research","doi-asserted-by":"publisher","award":["N00014-17-1-2995"],"award-info":[{"award-number":["N00014-17-1-2995"]}],"id":[{"id":"10.13039\/100007297","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2020,10,30]]},"DOI":"10.1145\/3372297.3423344","type":"proceedings-article","created":{"date-parts":[[2021,3,4]],"date-time":"2021-03-04T16:20:06Z","timestamp":1614874806000},"page":"167-180","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":45,"title":["FirmXRay: Detecting Bluetooth Link Layer Vulnerabilities From Bare-Metal Firmware"],"prefix":"10.1145","author":[{"given":"Haohuang","family":"Wen","sequence":"first","affiliation":[{"name":"Ohio State University, Columbus, OH, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhiqiang","family":"Lin","sequence":"additional","affiliation":[{"name":"Ohio State University, Columbus, OH, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yinqian","family":"Zhang","sequence":"additional","affiliation":[{"name":"Ohio State University, Columbus, OH, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2020,11,2]]},"reference":[{"key":"e_1_3_2_2_1_1","unstructured":"16\n    bit uuids for members. https:\/\/www.bluetooth.com\/specifications\/assigned-numbers\/16-bit-uuids-for-members\/. (Accessed on 09\/20\/2020).  16 bit uuids for members. https:\/\/www.bluetooth.com\/specifications\/assigned-numbers\/16-bit-uuids-for-members\/. (Accessed on 09\/20\/2020)."},{"key":"e_1_3_2_2_2_1","unstructured":"Ble-stack bluetooth low energy. https:\/\/www.ti.com\/tool\/BLE-STACK. (Accessed on 09\/20\/2020).  Ble-stack bluetooth low energy. https:\/\/www.ti.com\/tool\/BLE-STACK. (Accessed on 09\/20\/2020)."},{"key":"e_1_3_2_2_3_1","unstructured":"Bluetooth sig inc. https:\/\/www.bluetooth.com\/. (Accessed on 09\/20\/2020).  Bluetooth sig inc. https:\/\/www.bluetooth.com\/. (Accessed on 09\/20\/2020)."},{"key":"e_1_3_2_2_4_1","unstructured":"Core bluetooth background processing for ios apps. https:\/\/developer.apple.com\/library\/archive\/documentation\/NetworkingInternetWeb\/Conceptual\/CoreBluetooth_concepts\/CoreBluetoothBackgroundProcessingForIOSApps\/PerformingTasksWhileYourAppIsInTheBackground.html. (Accessed on 09\/20\/2020).  Core bluetooth background processing for ios apps. https:\/\/developer.apple.com\/library\/archive\/documentation\/NetworkingInternetWeb\/Conceptual\/CoreBluetooth_concepts\/CoreBluetoothBackgroundProcessingForIOSApps\/PerformingTasksWhileYourAppIsInTheBackground.html. (Accessed on 09\/20\/2020)."},{"key":"e_1_3_2_2_5_1","unstructured":"Developing a bluetooth low energy application. http:\/\/software-dl.ti.com\/simplelink\/esd\/simplelink_cc13x0_sdk\/2.20.00.38\/exports\/docs\/blestack\/software-developers-guide\/ble-stack-2.x\/index.html. (Accessed on 09\/20\/2020).  Developing a bluetooth low energy application. http:\/\/software-dl.ti.com\/simplelink\/esd\/simplelink_cc13x0_sdk\/2.20.00.38\/exports\/docs\/blestack\/software-developers-guide\/ble-stack-2.x\/index.html. (Accessed on 09\/20\/2020)."},{"key":"e_1_3_2_2_6_1","unstructured":"Dialog semiconductor. https:\/\/www.dialog-semiconductor.com. (Accessed on 09\/20\/2020).  Dialog semiconductor. https:\/\/www.dialog-semiconductor.com. (Accessed on 09\/20\/2020)."},{"key":"e_1_3_2_2_7_1","unstructured":"Gatt overview. https:\/\/developer.android.com\/reference\/android\/bluetooth\/BluetoothGatt. (Accessed on 09\/20\/2020).  Gatt overview. https:\/\/developer.android.com\/reference\/android\/bluetooth\/BluetoothGatt. (Accessed on 09\/20\/2020)."},{"key":"e_1_3_2_2_8_1","unstructured":"Ghidra. https:\/\/ghidra-sre.org\/. (Accessed on 09\/20\/2020).  Ghidra. https:\/\/ghidra-sre.org\/. (Accessed on 09\/20\/2020)."},{"key":"e_1_3_2_2_9_1","unstructured":"Instruction sets - arm developers. https:\/\/developer.arm.com\/architectures\/instruction-sets. (Accessed on 09\/20\/2020).  Instruction sets - arm developers. https:\/\/developer.arm.com\/architectures\/instruction-sets. (Accessed on 09\/20\/2020)."},{"key":"e_1_3_2_2_10_1","unstructured":"Memory layout. https:\/\/infocenter.nordicsemi.com\/index.jsp?topic=%2Fcom.nordic.infocenter.sdk5.v11.0.0%2Fbledfu_memory.html. (Accessed on 09\/20\/2020).  Memory layout. https:\/\/infocenter.nordicsemi.com\/index.jsp?topic=%2Fcom.nordic.infocenter.sdk5.v11.0.0%2Fbledfu_memory.html. (Accessed on 09\/20\/2020)."},{"key":"e_1_3_2_2_11_1","unstructured":"Nordic semiconductor. https:\/\/www.nordicsemi.com. (Accessed on 09\/20\/2020).  Nordic semiconductor. https:\/\/www.nordicsemi.com. (Accessed on 09\/20\/2020)."},{"key":"e_1_3_2_2_12_1","unstructured":"Nordic semiconductor infocenter. https:\/\/infocenter.nordicsemi.com\/topic\/struct_nrf52\/struct\/nrf52_softdevices.html?cp=4_5. (Accessed on 09\/20\/2020).  Nordic semiconductor infocenter. https:\/\/infocenter.nordicsemi.com\/topic\/struct_nrf52\/struct\/nrf52_softdevices.html?cp=4_5. (Accessed on 09\/20\/2020)."},{"key":"e_1_3_2_2_13_1","unstructured":"nrf52 dk - development kit for bluetooth low energy and bluetooth mesh. https:\/\/www.nordicsemi.com\/Software-and-Tools\/Development-Kits\/nRF52-DK. (Accessed on 09\/20\/2020).  nrf52 dk - development kit for bluetooth low energy and bluetooth mesh. https:\/\/www.nordicsemi.com\/Software-and-Tools\/Development-Kits\/nRF52-DK. (Accessed on 09\/20\/2020)."},{"key":"e_1_3_2_2_14_1","unstructured":"Supervisor call interface. https:\/\/infocenter.nordicsemi.com\/index.jsp?topic=%2Fcom.nordic.infocenter.sdk5.v14.1.0%2Flib_svc.html. (Accessed on 09\/20\/2020).  Supervisor call interface. https:\/\/infocenter.nordicsemi.com\/index.jsp?topic=%2Fcom.nordic.infocenter.sdk5.v14.1.0%2Flib_svc.html. (Accessed on 09\/20\/2020)."},{"key":"e_1_3_2_2_15_1","unstructured":"Texas instruments. http:\/\/www.ti.com. (Accessed on 09\/20\/2020).  Texas instruments. http:\/\/www.ti.com. (Accessed on 09\/20\/2020)."},{"key":"e_1_3_2_2_16_1","volume-title":"https:\/\/www.bluetooth.org\/DocMan\/handlers\/DownloadDoc.ashx?doc_id=286439","author":"Bluetooth","year":"2014"},{"key":"e_1_3_2_2_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00013"},{"key":"e_1_3_2_2_18_1","first-page":"551","volume-title":"28th USENIX Security Symposium (USENIX Security 19)","author":"Alrawi Omar","year":"2019"},{"key":"e_1_3_2_2_19_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.pmcj.2016.01.002"},{"key":"e_1_3_2_2_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/3338507.3358617"},{"key":"e_1_3_2_2_21_1","volume-title":"Hacking into internet connected light bulbs. https:\/\/www.contextis.com\/us\/blog\/hacking-into-internet-connected-light-bulbs","author":"Chapman Alex","year":"2014"},{"key":"e_1_3_2_2_22_1","volume-title":"are you listening? https:\/\/www.contextis.com\/us\/blog\/hacking-into-internet-connected-light-bulbs","author":"Chapman Alex","year":"2017"},{"key":"e_1_3_2_2_23_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23415"},{"key":"e_1_3_2_2_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/3143361.3143385"},{"key":"e_1_3_2_2_25_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23159"},{"key":"e_1_3_2_2_26_1","volume-title":"Proceedings of the 29th USENIX Security Symposium (USENIX Security 20)","author":"Clements Abraham","year":"2020"},{"key":"e_1_3_2_2_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/2873587.2873594"},{"key":"e_1_3_2_2_28_1","first-page":"463","volume-title":"22nd USENIX Security Symposium (USENIX Security 13)","author":"Davidson Drew","year":"2013"},{"issue":"11","key":"e_1_3_2_2_29_1","first-page":"2418","article-title":"Location fingerprinting with bluetooth low energy beacons. IEEE journal on Selected Areas","volume":"33","author":"Faragher Ramsey","year":"2015","journal-title":"Communications"},{"key":"e_1_3_2_2_30_1","first-page":"1205","volume-title":"25th USENIX Security Symposium (USENIX Security 16)","author":"Fawaz Kassem","year":"2016"},{"key":"e_1_3_2_2_31_1","volume-title":"Proceedings of the 29th USENIX Security Symposium (USENIX Security 20)","author":"Feng Bo","year":"2020"},{"key":"e_1_3_2_2_32_1","volume-title":"Security analysis of bluetooth technology","author":"Filizzola Daniel","year":"2018"},{"key":"e_1_3_2_2_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2019.2939526"},{"key":"e_1_3_2_2_34_1","doi-asserted-by":"publisher","DOI":"10.3390\/s120911734"},{"key":"e_1_3_2_2_35_1","first-page":"2245","volume-title":"Proceedings of the 24th ACM SIGSAC Conference on Computer and Communications Security","author":"Hernandez Grant","year":"2017"},{"key":"e_1_3_2_2_36_1","volume-title":"Bluetooth pairing part 4: Le secure connections - numeric comparison. https:\/\/blog.bluetooth.com\/bluetooth-pairing-part-4","author":"Ren Kai","year":"2017"},{"key":"e_1_3_2_2_37_1","doi-asserted-by":"publisher","DOI":"10.1145\/3176258.3176313"},{"key":"e_1_3_2_2_38_1","volume-title":"18th Network and Distributed Systems Security Symposium (NDSS)","author":"Lee JongHyup","year":"2011"},{"key":"e_1_3_2_2_39_1","volume-title":"Proceedings of the 17th Annual Network and Distributed System Security Symposium (NDSS'10)","author":"Lin Zhiqiang","year":"2010"},{"key":"e_1_3_2_2_40_1","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2019-0057"},{"key":"e_1_3_2_2_41_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICACCS.2019.8728448"},{"key":"e_1_3_2_2_42_1","first-page":"431","volume-title":"41st IEEE Symposium on Security and Privacy (SP)","author":"Redini Nilo"},{"key":"e_1_3_2_2_43_1","volume-title":"Bypassing passkey authentication in bluetooth low energy. IACR Cryptology ePrint Archive","author":"Rosa Tomas","year":"2013"},{"key":"e_1_3_2_2_44_1","volume-title":"Presented as part of the 7th USENIX Workshop on Offensive Technologies","author":"Ryan Mike","year":"2013"},{"key":"e_1_3_2_2_45_1","doi-asserted-by":"publisher","DOI":"10.1109\/WCRE.2002.1173063"},{"key":"e_1_3_2_2_46_1","volume-title":"Quarterly presentation q4","author":"Semiconductor Nordic","year":"2019"},{"key":"e_1_3_2_2_47_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2015.23294"},{"key":"e_1_3_2_2_48_1","doi-asserted-by":"publisher","DOI":"10.5555\/3361338.3361340"},{"key":"e_1_3_2_2_49_1","doi-asserted-by":"publisher","DOI":"10.1145\/3176258.3176945"},{"key":"e_1_3_2_2_50_1","volume-title":"REcon conference","author":"Skochinsky Igor","year":"2010"},{"key":"e_1_3_2_2_51_1","volume-title":"18th Network and Distributed Systems Security Symposium (NDSS)","author":"Slowinska Asia","year":"2011"},{"key":"e_1_3_2_2_52_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23176"},{"key":"e_1_3_2_2_53_1","first-page":"209","volume-title":"Workshop on Home Usable Privacy and Security (HUPS)","volume":"29","author":"Ur Blase","year":"2014"},{"key":"e_1_3_2_2_54_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.1984.5010248"},{"key":"e_1_3_2_2_55_1","first-page":"253","volume-title":"29th USENIX Security Symposium (USENIX Security 20)","author":"Xiong Yan","year":"2020"},{"key":"e_1_3_2_2_56_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23229"},{"key":"e_1_3_2_2_57_1","volume-title":"Exploiting bluetooth low energy pairing vulnerability in telemedicine","author":"Zegeye Wondimu K","year":"2015"},{"key":"e_1_3_2_2_58_1","first-page":"37","volume-title":"29th USENIX Security Symposium (USENIX Security 20)","author":"Zhang Yue","year":"2020"},{"key":"e_1_3_2_2_59_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-63086-7_4"},{"key":"e_1_3_2_2_60_1","first-page":"1099","volume-title":"28th USENIX Security Symposium (USENIX Security 19)","author":"Zheng Yaowen","year":"2019"},{"key":"e_1_3_2_2_61_1","doi-asserted-by":"publisher","DOI":"10.1587\/transinf.2015EDP7217"},{"key":"e_1_3_2_2_62_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00009"},{"key":"e_1_3_2_2_63_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354240"}],"event":{"name":"CCS '20: 2020 ACM SIGSAC Conference on Computer and Communications Security","location":"Virtual Event USA","acronym":"CCS '20","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3372297.3423344","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3372297.3423344","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3372297.3423344","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T22:02:20Z","timestamp":1750197740000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3372297.3423344"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,10,30]]},"references-count":63,"alternative-id":["10.1145\/3372297.3423344","10.1145\/3372297"],"URL":"https:\/\/doi.org\/10.1145\/3372297.3423344","relation":{},"subject":[],"published":{"date-parts":[[2020,10,30]]},"assertion":[{"value":"2020-11-02","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}