BitChat iOS BLE Mesh Cache Poisoning via RSR and TTL Authent...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://barghest.asia/blog/bitchat-cache-poisoning
• Blog Title: BitChat iOS BLE Mesh Cache Poisoning via RSR and TTL Authentication Bypasses
• Suggested Section: Mobile Pentesting > iOS Pentesting > BLE Mesh and Gossip Protocol Attacks, with a cross-reference from Radio Hacking > Pentesting BLE - Bluetooth Low Energy

🎯 Content Summary

Overview

BARGHEST discovered a self-propagating cache-poisoning vulnerability chain in BitChat iOS 1.15.0, a decentralized offline messaging application that discovers peers and relays data through a Bluetooth Low Energy (BLE) gossip mesh. The issue was identified on January 26, 2026, responsibly disclosed on January 28, 2026, and patched in production and the Apple App Store on January 28, 2026 through PR fix iOS BLE mesh authentication issues in BLEService#998...

🔧 Technical Details

Transport identity confusion: Never use an identity copied from attacker-controlled packet fields as the authoritative identity for authorization, replay-window, synchronization, or freshness decisions. Bind the protocol identity to the observed or authenticated transport connection. Otherwise, an attacker can spoof a peer ID and access security state maintained for another identity.

Synchronization-response window abuse: A valid discovery or announcement message may be abused to deliberately create a temporary response window. If a response flag causes timestamp or replay checks to be skipped, an attacker can mark arbitrary packets as synchronization responses during that window. Responses should be cryptographically tied to a specific request, transport peer, authenticated identity, and nonce rather than accepted from a self-declared packet ID and flag.

Attacker-controlled metadata used as proof of local origin: Fields...

🤖 Agent Actions

Implemented the HackTricks update.

Changes

• Added BLE mesh and gossip protocol cache poisoning to:
  • src/todo/radio-hacking/pentesting-ble-bluetooth-low-energy.md
• Added an iOS pentesting cross-reference in:
  • src/mobile-pentesting/ios-pentesting/README.md
• Documented:
  • Transport identity confusion
  • Synchronization-window abuse
  • TTL/local-origin authentication bypasses
  • Cache-before-validation poisoning
  • Autonomous gossip propagation
  • Reusable testing workflow and packet constructor
  • Technical regression testing and telemetry
• Added numbered citations for the BARGHEST research, PoC, and remediation PR.

Validation

• git diff --check passed.
• Citation and reference numbering validated.
• Internal cross-reference and heading anchor validated.
• Packet constructor parsed and produced the expected wire format.
• mdbook was not installed, so a full build could not be run.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://barghest.asia/blog/bitchat-cache-poisoning

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting > iOS Pentesting > BLE Mesh and Gossip Protocol Attacks, with a cross-reference from Radio Hacking > Pentesting BLE - Bluetooth Low Energy".

Repository Maintenance:

• MD Files Formatting: 989 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0