A "wormable" Bluetooth attack on humanoid robots
Plus: Bluetooth LE to orbit in 13 bytes and Auracast lands in a Pixel beta
This Week in Bluetooth & UWB |
Sep 4, 2026 |
|
In This Issue
→ “Wormable” root RCE on a robot
→ 13-byte payloads, via satellite → Pixel turns into a PA system → Channel Sounding in a car key → nRF52840 meets UWB ranging |
|
New Series Testing a Bluetooth LE Device Without a Phone I've started a series on testing Bluetooth LE devices without reaching for a phone. Part one covers where a phone stops being the right tool, then walks through a first scripted scan, advertising as a peripheral, and closing the loop on a connection with no phone in sight. More parts to follow.
|
Bluetooth LE
|
Olivier Laflamme (boschko.ca)
Root on a $20,000 humanoid robot from Bluetooth range. One chain crossing Bluetooth, Unitree's cloud, mobile, and the firmware running the G1 itself. The G1 accepted the connection without requesting pairing, exposed 0xFFE1 for notifications, and exposed 0xFFE2 for writes. UniBLEed is wormable, meaning once one G1 is compromised, it can spread the same exploit to the next G1 in range, and so on indefinitely.
|
|
WIoT Group
Hubble Network is building satellite connectivity for devices equipped with Bluetooth Low Energy radios. During a predicted satellite pass, the device temporarily leaves normal Bluetooth LE operation and transmits using Hubble's proprietary low-data-rate satellite protocol at approximately 125 bit/s. A satellite pass typically lasts three to five minutes, and Hubble currently supports payloads of 0, 4, 9 or 13 bytes.
|
|
SoundGuys
Google's new Voice Broadcast feature now appears directly in the Quick Settings menu on the latest Android 17 QPR2 beta, without requiring users to dive into hidden developer menus. The feature, SoundGuys writes, “leverages Bluetooth Low Energy Audio and Auracast broadcast technology to transmit real-time microphone input from your phone to nearby audio receivers.”
|
Ultra-Wideband (UWB)
|
PR Newswire
On August 28, 2026, YFORE Technology officially rolled off its first U.S.-manufactured Digital Key at its facility in Suwanee, Georgia. The company's release says the digital key “leverages Bluetooth 6.0 Channel Sounding and UWB technology,” and that “by combining Phase-Based Ranging (PBR) and Round-Trip Time (RTT), the system achieves bidirectional, centimeter-level spatial precision while operating independently of cellular networks and mitigating relay-attack vulnerabilities.”
|
|
LinuxGizmos
Makerfabs has showcased an nRF52840 development board combining Bluetooth connectivity with a DW3000-series ultra-wideband radio for ranging and positioning applications. The board includes a 1.3-inch OLED display, dual USB Type-C connections, LiPo battery support, a fuel gauge, and expansion headers, while accompanying Arduino examples cover single- and multi-node UWB ranging.
|
|
Learn by Doing
Bluetooth LE Unplugged builds up to running your own GATT server. The GATT Services & Characteristics module walks through the GATT hierarchy, discovering the GATT database, UUIDs, handles and properties, and creating a custom GATT service of your own. From $199, with two BleuIO Standard dongles shipped to your door, lifetime access, and a 30-day money-back guarantee if you return the dongles.
|
P.S. Read that Hubble figure carefully: 125 bits per second, not the 125 kb/s of the Coded PHY at S=8. Designing inside 13 bytes and a three-to-five minute pass is a genuinely different problem. I've had boards on the bench for a while now, and there's a full walkthrough coming. What would you put in 13 bytes?
— Mohammad Afaneh
Don't miss what's next. Subscribe to Novel Bits:
