  Bluetooth Low Energy (BLE) is a short-range wireless communication technology
for resource-constrained IoT devices. Unfortunately, BLE is vulnerable to
session-based attacks, where previous packets construct exploitable conditions
for subsequent packets to compromise connections. Defending against
session-based attacks is challenging because each step in the attack sequence
is legitimate when inspected individually. In this paper, we present BlueSWAT,
a lightweight state-aware security framework for protecting BLE devices. To
perform inspection on the session level rather than individual packets,
BlueSWAT leverages a finite state machine (FSM) to monitor sequential actions
of connections at runtime. Patterns of session-based attacks are modeled as
malicious transition paths in the FSM. To overcome the heterogeneous IoT
environment, we develop a lightweight eBPF framework to facilitate universal
patch distribution across different BLE architectures and stacks, without
requiring device reboot. We implement BlueSWAT on 5 real-world devices with
different chips and stacks to demonstrate its cross-device adaptability. On our
dataset with 101 real-world BLE vulnerabilities, BlueSWAT can mitigate 76.1% of
session-based attacks, outperforming other defense frameworks. In our
end-to-end application evaluation, BlueSWAT patches introduce an average of
0.073% memory overhead and negligible latency.
