Bulwark v1.0 - hears the popup flood

A Bluetooth LE advertising-spam detector that runs on the Flipper Zero's own radio. No extra hardware.

You know the attack even if you do not know its name: someone in the carriage has a board in their bag, and every iPhone within twenty metres starts asking about AirPods it has never met. On Android it is Fast Pair. On Windows it is Swift Pair. Bulwark is the defensive half — it transmits nothing, and listens to the three frequencies the attack has to use.

How it works

Every BLE device that wants to be found advertises on exactly three frequencies out of forty: 2402, 2426 and 2480 MHz. They were chosen in the 1990s to dodge the centres of Wi-Fi 1, 6 and 11 — and that accident of spectrum politics is the whole basis of this app.

Bulwark parks the radio on those three channels and on the three Wi-Fi centres between them, hops between all six, and asks one question: is the advertising busy, or is the band busy? A spam attack fills all three equally, from close range, without stopping. A microwave oven cannot touch 2402 MHz. An access point favours its own channel. Only advertising lights up all three.

The ceilings are the design

Seven signals across four independent families — occupancy, shape, level, persistence — and nine ceilings that are refusals to overclaim:

• A quiet band stops at 20, whatever shape it is.
• A busy band that is not Bluetooth-shaped stops at 44.
• SPAM LIKELY requires the tri-channel signature specifically (ceiling 69 without it).
• Wi-Fi gets two ceilings, 30 and 65, because "as busy as" and "twice as busy as" are different amounts of blindness.
• Nothing ever reaches 100. The ceiling is 94, and the breakdown screen always names the one that bit.

What it cannot do, said out loud

In RF test mode the radio measures energy and decodes nothing. Bulwark never sees an address, a name, a payload, or which spam family it is — and it cannot tell an attack from a shop with sixty beacons in the ceiling. That case is in the demo set, it scores SPAM LIKELY, and the app says so. It never calls a place safe.

In the app

• Watch screen: the band at its real frequency spacing, and a trend page — one column per sweep, for "is it following me".
• A breakdown that leads with why the score is not higher, then every signal and what it was worth, then the raw numbers, then a list of what was not measured.
• A stored baseline, so it knows what your own places sound like.
• Seven animated panels on how the attack works and how to turn the popups off.
• Alerts for a Flipper you are not looking at, CSV sweep logs, seven synthetic bands for use with no hardware.

Verified

8,381,945 host checks over the furi-free measurement and scoring engine, with every ceiling asserted as an invariant over randomised inputs. Builds clean on the release (API 87.1) and dev (API 88.x) SDK channels. The README screenshots are rendered from the real engine's own output.

Install

Drop bulwark.fap in /ext/apps/Bluetooth/ on the SD card. It appears under Apps → Bluetooth → Bulwark.