  To defeat security threats such as man-in-the-middle (MITM) attacks,
Bluetooth Low Energy (BLE) 4.2 and 5.x introduce the Secure Connections Only
mode, under which a BLE device accepts only secure paring protocols including
Passkey Entry and Numeric Comparison from an initiator, e.g., an Android
mobile. However, the BLE specification does not explicitly require the Secure
Connection Only mode of the initiator. Taking the Android's BLE programming
framework for example, we found that it cannot enforce secure pairing,
invalidating the security protection provided by the Secure Connection Only
mode. The same problem applies to Apple iOS too.
  Specifically, we examine the life cycle of a BLE pairing process in Android
and identify four severe design flaws. These design flaws can be exploited by
attackers to perform downgrading attacks, forcing the BLE pairing protocols to
run in the insecure mode without the users' awareness. To validate our
findings, we selected and tested 18 popular BLE commercial products and our
experimental results proved that downgrading attacks and MITM attacks were all
possible to these products. All 3501 BLE apps from Androzoo are also subject to
these attacks. For defense, we have designed and implemented a prototype of the
Secure Connection Only mode on Android 8 through the Android Open Source
Project (AOSP). We have reported the identified BLE pairing vulnerabilities to
Bluetooth Special Interest Group (SIG), Google, Apple, Texas Instruments (TI)
and all of them are actively addressing this issue. Google rated the reported
security flaw a High Severity.
