Security BSides Las Vegas 2025

The Perfect BLEnd: Reverse engineering a bluetooth controlled blender for better smoothies
2025-08-04 , Firenze

Have you ever gone to make a smoothie, only to have the blades spin fruitlessly while the fruit sticks just out of reach on the walls of the cup? I’ve wrestled with a “smart” blender over this and other issues on many occasions, often resorting to tossing the single serving cup to dislodge stubborn pieces of fruit. Or perhaps you have another smart device that one day stops working because the vendor decided to stop updating the app for newer phones.
In this talk, I’ll share how I learned to reverse engineer BLE (bluetooth low energy) devices in order to control the exact settings used by the blender, including initial failures and how I overcame them -- along with quickly creating an alternative for controlling the blender when the app stopped working after an iOS update. And in the end, we’ll create a custom blending profile for the perfect blend!


This is a hobby project (not work related) where I've been poking at a Nutribullet Smart Balance blender on and off for several years. Late last summer I finally got around to pulling together the notes I had on the different parts of the BLE (bluetooth low energy) protocol for controlling the blender and put the pieces together to create an open source web app using WebBluetooth for controlling the blender. Using a variety of tools (listed below), I'll step go through the process I followed in learning to sniff bluetooth communications and how bluetooth low energy works. This will include my initial attempts using an nRF52 devkit prior to leveraging bluetooth logging features included in smart phones (and laptops). If there is time, a brief peek at decompiling the Android app revealed blenders and smart scales from other companies that might share the same protocol and could be future devices to look at.

Tools:
* nRF52 DevKit
* WireShark
* Variety of free BLE scanner apps
* PacketLogger (free tool included with Xcode utilities)
* libimobiledevice idevicebtlogger (open source alternative to PacketLogger)
* https://github.com/nightlark/nutribullet (WebBluetooth app developed based on findings)

Ryan is a software engineer working on open source projects to make the electric grid more reliable. His interests include software security, niche video games, poking at random "smart" devices, and reverse engineering audio/video hardware used in live productions.