deep knowledge technical trainings


In-Person Hands-On Hacking for BLE & NFC/RFID [4-Day Combo]

This unique hands-on course combining BLE and NFC security trainings aims to provide solid understanding of security aspects for both technologies, along with practical skills and included hardware tools for hands-on exercises.





Delivery Method




Seats Available



This 4-day course combines both BLE (2-day) and NFC/RFID (2-day).

– To join only the 2-day BLE course, click here
– To join only the 2-day NFC/RFID course, click here

ATTEND IN-PERSON: Onsite in Amsterdam 

Want to attend this class? Contact us

DATE: 17-20 April 2023

TIME: 09:00 to 17:00 CEST/GMT+2

Date Day Time Duration
17 Apr Monday 09:00 to 17:00 CEST/GMT+2 8 Hours – Presentations & Hands-on exercises
18 Apr Tuesday 09:00 to 17:00 CEST/GMT+2 8 Hours – Presentations & Hands-on exercises
19 Apr Wednesday 09:00 to 17:00 CEST/GMT+2 8 Hours – Presentations & Hands-on exercises
20 Apr Thursday 09:00 to 17:00 CEST/GMT+2 8 Hours – Presentations & Hands-on exercises


Both Bluetooth Low Energy and NFC/RFID are wireless technologies extensively used not only in IoT gadgets and toys but also in high-risk devices: access control systems, smart locks, medical, payment and banking appliances. With the growing numbers of such devices, security becomes more and more important, along with the constantly growing demand for specialists in this area.

This unique hands-on course combining BLE and NFC security trainings aims to meet this demand, providing solid understanding of security aspects for both technologies, along with practical skills and included hardware tools for hands-on exercises.

Sign up for just a single topic (2 days BLE or 2 days NFC), or sign up for both in a bundle, and get a discount!


Key Learning Objectives
  • Solid understanding of Bluetooth Low Energy, including latest versions (5).
  • Common implementation pitfalls.
  • Device assessment process.
  • Solid understanding of NFC/RFID.
  • Ability to perform in practice typical attacks: cloning, cracking, remote relays.
  • Point out common implementation pitfalls in both legacy and modern systems.
  • Analyse security of mobile access solutions.


Each student will receive


  1. Course materials – about 1000 pages, step by step instructions for hands-on exercies.
  2. All required additional files: source code, documentation, installation binaries, virtual machine images.
  3. Included hardware pack for hands-on exercises, consisting of:



  • Bluetooth 4/5 development boards.
  • Dedicated BLE device.
  • Hardware sniffer.
  • USB dongles.
  • Proxmark 3 with latest firmware.
  • Various sample tags (including “magic” ones),
  • NFC PN532 board.
  • Android phone with Bluetooth 4 and NFC support

Day 1

1. What is Bluetooth Low Energy, how it differs from previous Bluetooth versions – introduction.

2. BLE advertisements, broadcasted packets
a) Theory – BLE advertisement packets
b) Scanning for nearby BLE devices’ advertisements: smartphone, command-line, scripts, other tools.
c) BLE Beacons

  •  iBeacon, Eddystone
  •  Spoofing/cloning beacons to get rewards, free beer, or activate connected underwear


d) Tracking devices and crowdsourced location (key finders, Apple AirTags, …).
e) Apple, Microsoft devices BLE advertisements.
f) COVID-19 contact tracing / exposure notification BLE packets.
g) Other BLE advertisements – energy meters revealing current indication, sex toys revealing device model, …
h) Bleedingbit – RCE chain via improper BLE advertisements parsing.

3. BLE connections
a) Theory introduction: GATT specification, central vs peripheral device, services, characteristics, connections, …
b) Connecting to your dedicated BLE device using various tools

  • nRF Connect mobile application: read/write/notify, automation with macros.
  • BlueZ command-line
  • other tools


c) Taking control of simple, insecure devices (BLE dildo, key finder, …)

4. Sniffing BLE
a) BLE RF layer theory introduction

  • Radio modulation, channels, hopping, connection initiation
  • Why so many devices do not encrypt link-layer
  • Various sniffing hardware and software options


b) Sniffing live raw BLE packets from the air using provided hardware and Wireshark

  • Wireshark tips&tricks
  • Capture your own connection from mobile app to your BLE device
  •  How to combine multiple sniffers for better reliability


c) Sniffing demos: smart lock plain text password, banking token OTP
d) Overview of various hardware and open source sniffers: nRF Sniffer, Ubertooth, Btlejack, Sniffle, SDR, …

5. BLE HCI dump – reliably capture own packets
a) Difference from RF layer sniffing
b) Investigate BLE packets intercepted on Android phone in Wireshark
c) Linux command-line hcidump

6. BLE “Machine in the Middle” / remote relay
d) Conditions for MITM, attack scenarios, MAC address cloning
e) BLE MITM / remote relay in practice (local, via Internet), various tools (GATTacker, BtleJuice, Mirage).
f) Abusing proximity autounlock feature via remote relay.
g) Tampering BLE packets via MITM – demo using mobile Point of Sale to alter information displayed on terminal.


Day 2

7. BLE insecurity case studies
a) Sample smart lock attack: decompile Android application, reverse-engineer BLE protocol commands, identify weakness in protocol, exploit in practice using mobile application
b) Various attacks on proprietary authentication/encryption protocols based on real devices (including several smart locks).
c) Abusing excessive BLE services, hard-coded credentials, remote access share functionality, cloud interface, …

8. BLE link-layer security
a) BLE link layer security mechanisms – introduction, levels, pairing, bonding, why most devices do not implement it at all.
b) Pair the provided smartphone with your dedicated BLE device, sniff the pairing process and crack it.
c) Attacks possible on paired/bonded connections.
d) BLE MAC address randomization, “silent pairing” attacks recovering Identity Resolving Key (for example leveraging contact tracing apps).
e) Abusing trust relationships of bonded devices – vulnerabilities in HID devices, Google Titan U2F token vulnerability technical analysis, attacks via other applications installed on the same mobile phone, …

9. Provided BLE development boards
a) Technical details about provided BLE devboards.
b) How to develop own firmware or adjust included training device source code.
c) Review of provided firmware images / source (sniffer, attack tools, dedicated BLE device).
d) Flashing firmware on the devkits.

10. BLE jamming and hijacking
a) Theory introduction: how to hijack BLE ongoing connections
b) Btlejack, ButteRFly – possible attacks, tools usage.

11. Web Bluetooth
a) Introduction, security design consideration, sample implementations, possible attacks
b) Interact with your BLE device via browser – run sample Web Bluetooth javascript code.

12. BLE device firmware over the air update security
a) Introduction, how the firmware update works, memory layout of BLE SoC.
b) Abuse insecure Over The Air firmware update on provided Nordic Semiconductor SoC.
c) Insecure OTA firmware upgrade in Texas Instruments SoC (taking control over wireless routers, stealing Tesla keys, …).

13. Bluetooth 5 and beyond
a) Introduction, new features, why so many devices claim to be Bluetooth 5 but are not really.
b) New physical layers: 2M, long range coded PHY.
c) New channel hopping RNG.
d) Sniffing BLE5 – current hardware, software support.

14. Bluetooth Mesh
a) Introduction, network topology, BLE4 advertisements as a transport layer, mandatory encryption.
b) Flashing sample Bluetooth Mesh device firmware on a supplied devkit.
c) Provisioning the devices in practice into your own Mesh network
d) Known vulnerabilities and possible weaknesses of Mesh implementations.

15. Other attacks on BLE devices
a) Attacking BLE devices via RF side-channel analysis (e.g. leaking AES key).
b) Vulnerabilities in BLE SDK (e.g. RCE in Nordic SoftDevice)
c) SoC vulnerabilities (memory readout protection bypass, fault injection,…). Sample attack to try out in practice on provided nRF51 development board

16. Brief review of the multitude attacks on BLE protocol and its implementations as well as attack tools (Bleedingbit, Sweyntooth, BlueFrag, KNOB, BIAS, BLESA, BLURTooth, Frankenstein, JackBNimBLE, InjectaBLE, …)

17. Summary, best practices, references, “hackme” challenges…


Day 3

1. Short introduction
a) RFID/NFC – where do I start?
b) Frequencies, card types, usage scenarios.
c) How to recognize card type – quick walkthrough.
d) Equipment, and what can you do with it – mobile phone, card reader, simple boards, Chameleon Mini, Proxmark, other hardware.

2. UID-based access control
a) Introduction – simple, still surprisingly common technologies
b) Communication between a reader and tag.
c) What is stored on the tag?
d) Low Frequency EM410X (“unique”), HID Prox, …, High Frequecy Mifare UID
e) Cloning card’s UID – cloners, Proxmark, Chameleon, mobile phone, …
f) Simulating (Proxmark, Chameleon, mobile phone,…), brute-forcing.
g) Interpreting markings on the tag, decoding UID from the picture.
h) Sample vulnerability of simple access control reader that allows to unlock it without the need to have a valid card.
i) Countermeasures against attacks

3. Wiegand – typical transmission between the reader and access controller
a) Theory introduction, signal DATA0, DATA1
b) Wiegand sniffers, implants, transmitters – hardware, open source software
c) Decoding card UID from sniffed bytes, clone the card
d) Replay card data on the wire to open lock

4. Mifare Ultralight, NTAG
a) Data structure.
b) Reading, cloning, emulating.
c) Example data stored on a hotel guest card.
d) Ultralight EV1, C.

5. Mifare Classic & its weaknesses – practical exercises based on hotel door lock system, ski lift card, bus ticket
a) Mifare Classic – data structure, access control, keys, encryption.
b) Default, leaked keys.
c) Reading and cloning card data using just a mobile phone.
d) Cracking keys using various attacks and tools (Proxmark, libnfc, Chameleon).
e) Attacks on EV1 “hardened” Mifare Classic.
f) Online attacks against the reader.


Day 4

6. Reverse-engineering data stored on a sample hotel system guest card
a) Decoding access control data (room number, date) stored on the hotel guest card.
b) Creating hotel “emergency card” to open all the hotel doors unconditionally, having only sample guest card.

7. Mifare DESFire
a) Introduction, data format, access modes.
b) Creating sample tag for DESFire access control system.
c) Publicly known attacks (misconfiguration, implementation issues) in smart locks, access control, ticketing systems.

8. ISO15693/iCode
a) Cloning ISO15693 UID on a “magic UID” card, unlocking smart lock.
b) Data of several example ski passes.

9. HID iClass
a) Cloning “legacy” / “standard security” iClass.
b) Attacks on iClass Elite.
c) Downgrade attacks.

10. Remote relay attacks against NFC/ISO1443
a) Introduction: research, tools, possibilities and limitations.
b) Practical remote relay of iClass SEOS and DESFire access control.

11. Sample Hitag2 access contol – sniffing password mode, simulating tags

12. Host Card Emulation – smartphone as NFC tag
a) Hardware Secure Element vs software Host Card Emulation
b) Protocols, commands, applications – ISO14443-4, 7816-4, APDU, AID, …
c) Example vulnerable HCE access control system (unlocking door using your NFC phone) – sample vulnerabilities.
d) NFC communication analysis: sniffing using Proxmark, dumping on the phone.

13. Intercepting card data from distance – antennas, possibilities and limits.


This 4-day course combines both BLE (2-day) and NFC/RFID (2-day).

– To join only the 2-day BLE course, click here
– To join only the 2-day NFC/RFID course, click here


National University Singapore

Dr. Wang Kailong is currently a research fellow at National University of Singapore (NUS). He received his PhD degree from School of Computing NUS in 2022. He has worked as a Research Assistant in NUS while pursuing his PhD degree from 2016 to 2021. His research interests include mobile and web security and privacy, and protocol verification. His works have appeared in the top conferences such as WWW and MobiCom.

Co-Founder & CTO


Mr. Gal Diskin is a cybersecurity and AI researcher. He was previously the VP & head of Palo Alto Networks’ Israeli site, and is a serial entrepreneur. Mr. Diskin’s research has been featured in HITB, Defcon, Black Hat, CCC, and other conferences, spanning fields from low level security research such as hardware vulnerabilities, binary instrumentation, and car hacking to high level research on AI detection methods, Enterprise security, and Identity security. Mr. Diskin was also the technical lead and co-founder of Intel’s software security organization, as well as the CTO of Cyvera and HeXponent (co-founder) before their acquisition.

Senior Security Researcher

Huajiang “Kevin2600” Chen (Twitter: @kevin2600) is a senior security researcher. He mainly focuses on vulnerability research in wireless and Vehicle security. He is a winner of GeekPwn 2020 and also made to the Tesla hall of fame 2021. Kevin2600 has spoken at various conferences including KCON; DEFCON and CANSECWEST.

Why You Should Take This Course

This unique hands-on course combining BLE and NFC security trainings aims to provide solid understanding of security aspects for both technologies, along with practical skills and included hardware tools for hands-on exercises.

Who Should Attend

  • Pentesters, red-teamers, security professionals, researchers.
  • BLE, NFC/RFID device designers, developers.
  • Anyone interested.

Key Learning Objectives


Prerequisite Knowledge

Hardware / Software Requirements

  • Laptop capable of running Kali Linux in virtual machine (VirtualBox or VMWare), and at least two USB ports available for VM guest.
  • Android smartphone with at least Bluetooth 4 support : This will be provided to you in your Training Pack
  • (basically all the phones with Android > 5.0). Bluetooth 5 support will be an advantage (most current phones) and with NFC support (most current phones, with a few small exceptions of incompatible devices: https://github.com/ikarus23/MifareClassicTool /blob/master/INCOMPATIBLE_DEVICES.md). Root option will be an advantage, but not crucial.