# Frankenstein: Advanced Wireless Fuzzing to Exploit New Bluetooth Escalation Targets

> Frankenstein emulates Bluetooth firmware dumps and fuzzes a virtual modem. It evaluates Broadcom and Cypress stacks, finding three zero-click vulnerabilities, host escalation issues, and BlueFrag on Android.

- Authors: Jan Ruge; Jiska Classen; Francesco Gringoli; Matthias Hollick
- Venue: USENIX Security 2020
- Status: Conference accepted
- Publication / posting date: June 17, 2020
- Date source: First arXiv submission date; the arXiv comment names the venue.
- First arXiv submission: June 17, 2020
- arXiv: 2006.09809
- Reviewed arXiv version: v1
- Sources reviewed: 2026-11-06
- Added to the catalog: 2026-11-06
- Original paper: <https://arxiv.org/abs/2006.09809>
- PDF: <https://arxiv.org/pdf/2006.09809>
- BibTeX: <https://awesomerea.org/papers/citations/paper-frankenstein.bib>
- Catalog page: <https://awesomerea.org/papers/paper-frankenstein/>
- Record JSON: <https://awesomerea.org/papers/paper-frankenstein/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/papers/paper-frankenstein/index.md)

## Scope and limitations

The evaluation covers Broadcom and Cypress Bluetooth stacks, Wi-Fi/Bluetooth coexistence, a Bluetooth 5.2 link-key flaw, and Android devices.

## Why it fits this collection

It uses emulation of closed-source firmware dumps to examine Bluetooth behavior and find vulnerabilities.

## Publication and review notes

The arXiv comment reads: To be published at USENIX Security

## Primary sources

1. <https://arxiv.org/abs/2006.09809>

## About this entry

Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.