Master Thesis Proposal

1 Problem Statement

Auracast is a broadcast audio technology that allows a transmitter to stream
audio to multiple nearby receivers, including headphones, earbuds, and hearingaids. It relies on Bluetooth Audio, a widely popular technology, making it highly compatible with most electronic devices, while inheriting security and privacy concerns from Bluetooth’s track record. For example, known attacks on Auracast include impersonation and denial-of-service [1], as implemented in the Auracast Hackers Toolkit [2]. However, more vulnerabilities and attacks might be possible in this relatively new (i.e., 2022) technology.

2 Project Plan

1. Literature Review: The student will study prior research on Bluetooth
   LE Audio and Auracast, focusing on known attacks against Broadcast
   Isochronous Streams (BIS), existing security mechanisms, and available
   tools such as the Auracast Hacker’s Toolkit.
2. Security and Privacy Analysis: The student will analyze the Auracast
   specification and reverse engineer proprietary protocol behavior, investigating how devices handle broadcast discovery, synchronization, encryption, and receiver configuration.
3. Auracast Testbed: The student will utilize the Auracast Hacker Toolkit,
   and possibly real Auracast-compatible devices, in a security testbed designed to evaluate Auracast security and privacy.
4. Attacks and Vulnerabilities: The student will design, implement, and
   evaluate attacks against Auracast either at the protocol-level or at the
   implementation-level.
5. Countermeasures: The student will propose countermeasures to mitigate them, and potentially responsibly disclose their findings to the Bluetooth SIG.

3 Ideal Background

You are interested in IoT security and privacy. This project builds upon research works authored by the supervisor (Marco Casagrande). You will have a chance to test your skills, add an impactful project to your CV, learn state-of-the-art Bluetooth analysis techniques, and break real-world IoT devices. Relevant Skills. Proficiency in programming and scripting languages, such as Python, Java, and JavaScript. Basic knowledge of security and privacy, wireless networks, and IoT. Optionally, experience with Bluetooth and Wireshark.

4 Thesis Supervisor

Marco Casagrande is a postdoc in cybersecurity at Orebro University. He specializes in Android security and reverse engineering. He is passionate about hands-on, hacking-oriented research. In addition to his academic publications, he has been invited to speak at several prominent hacking conferences, including Black Hat USA, DEF CON, and Hardwear.io. He is deeply involved in bug hunting, reporting vulnerabilities to market leaders such as Google, Xiaomi, and the FIDO Alliance.

References

[1] Theo Gasteiger, Carlo Alberto Boano, and Kay R¨omer. “BISON: Attacking Bluetooth’s Broadcast Isochronous Streams”. In: Proceedings of the
20th International Conference on Embedded Wireless Systems and Networks (EWSN). 2023, pp. 256–261. doi: 10.5555/3639940.3639973.
[2] ERNW Bluetooth Research. Auracast Hacker’s Toolkit. https://github.
com/auracast-research/auracast-hackers-toolkit. Accessed October
2026.