BLECrypto: Automatic Detection of Cryptographic API Misuses in BLE Communication

Bluetooth Low Energy (BLE) is increasingly used in domains such as smart homes, wearable devices, and healthcare systems to support short-range wireless communication. To protect sensitive data transmitted over BLE, BLE application-layer encryption is often adopted as a complement to the built-in link-layer security. The effectiveness of such encryption, however, heavily relies on correct cryptographic implementation. Previous studies suggest that cryptographic misuses are common in practice, yet remain underexplored in BLE scenarios due to analysis challenges. Existing cryptographic misuse analysis tools either lack the ability to assess BLE-specific data flows or fail to associate cryptographic parameters at the instance level. In this paper, we present BLECrypto, a static analysis framework to detect cryptographic misuses in the application-layer encryption of BLE devices. Instead of analyzing BLE devices directly, which are often proprietary or hard to access, BLECrypto analyzes their Android companion apps as proxies. BLECrypto combines control-flow and semantics-guided data-flow analysis to trace propagation of BLE data and assess the correctness of associated encryption configurations. It employs a two-stage pipeline and a confidence-level mechanism to balance detection coverage and precision. We evaluate BLECrypto on 67,509 real-world Android apps, where only 7,283 (10.8%) apps have applied application-layer encryption for BLE communication. BLECrypto reported 5,332 (73.2%) with at least one cryptographic misuse. These findings suggest that cryptographic misuses are widespread in BLE ecosystems and demonstrate the practical value of BLECrypto for large-scale security assessment.