Zum Hauptinhalt springen

Quellen & Referenzen

Diese Seite listet alle verwendeten Quellen, weiterführende Literatur und nützliche Ressourcen.

Offizielle Spezifikationen​

Bluetooth SIG​

DokumentVersionLink
Bluetooth Core Specification5.4bluetooth.com/specifications
GATT Specification-bluetooth.com/specifications
Assigned Numbers-bluetooth.com/specifications/assigned-numbers
Security Manager Specification-Teil der Core Spec

Zitierweise​

@techreport{bluetooth_core_5_4,
  title = {Bluetooth Core Specification},
  version = {5.4},
  year = {2023},
  institution = {Bluetooth SIG},
  url = {https://www.bluetooth.com/specifications/specs/core-specification-5-4/}
}

Security Standards & Frameworks​

OWASP​

DokumentBeschreibungLink
OWASP ISTG v1.0IoT Security Testing Guideowasp.org/istg
OWASP IoT Top 10Häufigste IoT-Schwachstellenowasp.org/iot-top-10
OWASP Mobile SecurityMobile App Testingowasp.org/mastg
@techreport{owasp_istg,
  title = {OWASP IoT Security Testing Guide},
  version = {1.0},
  year = {2024},
  institution = {OWASP Foundation},
  url = {https://owasp.org/www-project-iot-security-testing-guide/}
}

NIST​

DokumentBeschreibungLink
NIST SP 800-213IoT Device Cybersecuritynist.gov
NIST SP 800-183Networks of Thingsnist.gov
NISTIR 8259IoT Device Manufacturersnist.gov
@techreport{nist_sp800_213,
  title = {IoT Device Cybersecurity Guidance for the Federal Government},
  number = {SP 800-213},
  year = {2021},
  institution = {NIST},
  url = {https://csrc.nist.gov/publications/detail/sp/800-213/final}
}

BSI​

DokumentBeschreibungLink
BSI TR-03148Secure Broadband Routerbsi.bund.de
BSI-GrundschutzIT-Grundschutz-Kompendiumbsi.bund.de

EU/ETSI​

DokumentBeschreibungLink
ETSI EN 303 645Cyber Security for Consumer IoTetsi.org
EU CRA 2024/2847Cyber Resilience Acteur-lex.europa.eu
@techreport{etsi_en_303645,
  title = {Cyber Security for Consumer Internet of Things: Baseline Requirements},
  number = {ETSI EN 303 645},
  version = {2.1.1},
  year = {2020},
  institution = {ETSI},
  url = {https://www.etsi.org/deliver/etsi_en/303600_303699/303645/}
}

Wissenschaftliche Publikationen​

BLE Security Research​

TitelAutorenJahrKonferenz/Journal
Breaking BLE Beacons for Fun but Mostly ProfitZuo et al.2019WiSec
SweynTooth: Unleashing Mayhem over Bluetooth Low EnergyGarbelini et al.2020USENIX Security
KNOB AttackAntonioli et al.2019USENIX Security
BLESA: Spoofing Attacks against Reconnections in BLEWu et al.2020WOOT
Method Confusion Attack on Bluetooth Pairingvon Tschirschnitz et al.2021IEEE S&P
@inproceedings{sweyntooth2020,
  title = {SweynTooth: Unleashing Mayhem over Bluetooth Low Energy},
  author = {Garbelini, Matheus E. and others},
  booktitle = {USENIX Security Symposium},
  year = {2020}
}

@inproceedings{knob2019,
  title = {The KNOB is Broken: Exploiting Low Entropy in the Encryption Key Negotiation of Bluetooth BR/EDR},
  author = {Antonioli, Daniele and Tippenhauer, Nils Ole and Rasmussen, Kasper},
  booktitle = {USENIX Security Symposium},
  year = {2019}
}

@inproceedings{blesa2020,
  title = {BLESA: Spoofing Attacks against Reconnections in Bluetooth Low Energy},
  author = {Wu, Jianliang and others},
  booktitle = {WOOT},
  year = {2020}
}

IoT Security​

TitelAutorenJahrKonferenz/Journal
Internet of things Security: A SurveyAlaba et al.2017IJCSI
IoT Security: Review, Blockchain Solutions, and Open ChallengesKhan & Salah2018Future Generation Computer Systems

Bücher​

BLE-Entwicklung​

TitelAutorJahrISBN
Getting Started with Bluetooth Low EnergyTownsend et al.2014978-1491949511
Bluetooth Low Energy: The Developer's HandbookHeydon2012978-0132888363
Inside Bluetooth Low EnergyGupta2016978-1630810894
@book{townsend2014ble,
  title = {Getting Started with Bluetooth Low Energy},
  author = {Townsend, Kevin and Cufí, Carles and Davidson, Robert},
  year = {2014},
  publisher = {O'Reilly Media},
  isbn = {978-1491949511}
}

Security & Reverse Engineering​

TitelAutorJahrISBN
The IoT Hacker's HandbookGupta2019978-1484242995
Practical IoT HackingChantzis et al.2021978-1718500907
Android Security InternalsElenkov2014978-1593275815
Practical Reverse EngineeringDang et al.2014978-1118787311
@book{practical_iot_hacking,
  title = {Practical IoT Hacking: The Definitive Guide to Attacking the Internet of Things},
  author = {Chantzis, Fotios and others},
  year = {2021},
  publisher = {No Starch Press},
  isbn = {978-1718500907}
}

Tools & Dokumentation​

BLE-Analyse​

ToolBeschreibungLink
blatannPython BLE Library für nRF52blatann.readthedocs.io
WiresharkNetzwerk-Protokollanalysewireshark.org
nRF SnifferBLE Packet Sniffernordicsemi.com
BlueZLinux Bluetooth Stackbluez.org
UbertoothOpen-Source BLE Sniffergreatscottgadgets.com

Reverse Engineering​

ToolBeschreibungLink
JADXAndroid APK Decompilergithub.com/skylot/jadx
GhidraNSA Reverse Engineering Suiteghidra-sre.org
FridaDynamic Instrumentationfrida.re
APKToolAPK Unpackerapktool.org
Radare2Reverse Engineering Frameworkradare.org

Vulnerability Databases​

RessourceBeschreibungLink
CVECommon Vulnerabilities and Exposurescve.mitre.org
NVDNational Vulnerability Databasenvd.nist.gov
FIRST CVSSCVSS Calculatorfirst.org/cvss
CWECommon Weakness Enumerationcwe.mitre.org
CAPECAttack Pattern Enumerationcapec.mitre.org

Rechtliche Grundlagen​

Deutschland​

GesetzBeschreibungLink
StGB §202aAusspähen von Datengesetze-im-internet.de
StGB §202bAbfangen von Datengesetze-im-internet.de
StGB §202cVorbereiten des Ausspähensgesetze-im-internet.de
DSGVODatenschutz-Grundverordnungeur-lex.europa.eu
BDSGBundesdatenschutzgesetzgesetze-im-internet.de

Gesetzentwurf zur Modernisierung​

DokumentDatumLink
RefE Modernisierung ComputerstrafrechtNov 2024bmj.de

Disclosure & Koordination​

OrganisationBeschreibungKontakt
BSIKoordinierte Schwachstellenoffenlegung[email protected]
CERT/CCUS-CERT Coordination Center[email protected]
FIRSTForum of Incident Response Teamsfirst.org
ZDIZero Day Initiativezerodayinitiative.com

Online-Ressourcen​

Tutorials & Blogs​

RessourceBeschreibungLink
Bluetooth SIG BlogOffizielle Newsbluetooth.com/blog
Nordic DevZonenRF Developmentdevzone.nordicsemi.com
Adafruit BLE GuideEinsteiger-Tutoriallearn.adafruit.com
Reverse Engineering BLEBlog-SerieDiverse

CTF & Challenges​

RessourceBeschreibungLink
HackTheBoxSecurity Challengeshackthebox.com
DVIDDamn Vulnerable IoT Devicegithub.com/Vulcainreo/DVID

Hardware-Bezugsquellen​

HändlerProduktPreisLink
MousernRF52840 Dongle~10€mouser.de
DigiKeynRF52840 Dongle~10€digikey.de
NordicDirekt~10€nordicsemi.com
Hinweis

Alle Links wurden zuletzt im November 2025 überprüft. Bei toten Links bitte Issue erstellen.