Lego NXT Exploitation or Vulnerabilities?
Is this even slightly possible or a waste of time?


It might be possible but requires effort and probably a fair amount of research and hacking on your part. I'm not saying I know for sure if an exploit exists, either in the communications protocol or the BT firmware, but exploits are always possible. And it's not like LEGO is incentivized to look for obscure security issues in this stuff -- it just isn't that important.

Exploits come in different flavours, as do attacks. One place to start looking is the vendors that LEGO sourced for the various pieces of the NXT platform, and not just Bluetooth. We are looking for manufacturers that have released security notices for their hardware and drivers in the hopes that an exploit is still in the wild in an unpatched device used on NXT.

Another trick is to decide what sort of attack payloads are available. For example, even if you can't get debug access to the device, maybe you could keep the device so busy with bogus or specially crafted connection attempts that you gain some advantage. A denial-of-service attack is often just as effective as a direct hack.

You want to start looking at all the I/O that NXT uses, and then see how you can exploit it for direct access or some sort of leverage that gives you an advantage of some other sort.

And often exploits are leveraged in concert to get the access the hacker wants. So, you want to collect as much information as possible, and then start hacking your Kobayashi Maru solution.



Well, I recently ran across this answer, which shows that the LEGO Group sometimes patches security holes. The best part about knowing about patches is knowing some version has a security hole.