{"package_name":"org.disspair.disspair","name":"DissPair","summary":"Audit Bluetooth Classic and BLE devices: RFCOMM, GATT and advertisements","category":"Security","icon_url":"/api/icon/org.disspair.disspair","latest_version_code":4,"latest_version_name":"2.2.0","apk_url":"/api/apk/org.disspair.disspair","apk_size":12865267,"apk_sha256":"5bb6242b34e17ca275259d743c7a88f1e1c75414cb872579abfa7cc0c0812711","source_kind":"fdroid-repo","repo_slug":"fdroid-main","last_updated":1792119621,"release_timestamp":1792083575,"description":"<p>DissPair is an open-source Bluetooth security toolkit for auditing <b>Bluetooth Classic (RFCOMM)</b> and <b>Bluetooth Low Energy (BLE)</b> devices you own or are authorized to test. Instead of trusting what a device advertises, it actively probes how the device really behaves. Two CVEs have been found with it (CVE-2026-31280, CVE-2025-67133).</p>\n\n<p><b>Discovery</b></p>\n<ul>\n<li>Scan Classic (BR/EDR) and BLE devices, plus already-paired devices</li>\n<li>Device class tags, RSSI and filters for unnamed and paired devices</li>\n</ul>\n\n<p><b>Bluetooth Classic (RFCOMM)</b></p>\n<ul>\n<li>Sweep RFCOMM channels 1-30 and see which accept unpaired (insecure) or paired connections</li>\n<li>Send AT commands and OBEX payloads, with automatic HFP handshake handling</li>\n<li>Flood test to stress a channel's buffer handling</li>\n</ul>\n\n<p><b>BLE advertisement inspector (GAP)</b></p>\n<ul>\n<li>Decodes every advertising field: flags, service UUIDs, names, TX power, appearance, service and manufacturer data</li>\n<li>Vendor formats: Apple Continuity (iBeacon, AirDrop, Handoff, Nearby Info, Find My), Eddystone, Google Fast Pair</li>\n<li>Privacy checks: public vs rotating addresses, identifiers in device names, tracker beacons (Find My, SmartTag, Tile)</li>\n<li>Advertising interval estimate, RSSI graph, legacy/extended PDU, PHY and connectable flags</li>\n</ul>\n\n<p><b>BLE GATT analysis</b></p>\n<ul>\n<li>Full service and characteristic map with standard and vendor names</li>\n<li>Read and write (with or without response), hex or text</li>\n<li>Subscribe to notifications and indications with a live log</li>\n<li>Automatic maximum MTU negotiation</li>\n</ul>\n\n<p><b>GATT access audit</b></p>\n<ul>\n<li>One tap tests what every characteristic allows without pairing: read, subscribe and write</li>\n<li>Results marked OPEN, AUTH, ENC, AUTHZ, KEY or DENY</li>\n<li>Optional write test: echo the value just read, or commit a chosen payload</li>\n<li>Exportable text report for vendor disclosure</li>\n</ul>\n\n<p","categories":["Security","System"]}