1- A beacon broadcast a UUID.
2- The users should install my app, the app reads the UUID.
3- The app requests the picture or video related to this UUID from my server.
If an attacker can access the beacon and modify it, then my app is not going to find the UUID's i added to the server.
-evul haxor learns about those beacons at the target location
-finds a weakness in remote firmware update
-prepares special firmware with added Microsoft/logitech mouse/keyboard emulation (nRF52 can do this). Bonus points if he can make one beacon flash other beacons in range.
-infects one beacon using long range setup (yagi, amp)
-profit
"Estimote Beacon is a small computer. Its 32-bit ARM® Cortex M0 CPU is accompanied by accelerometer, temperature sensor, and what is most important—2.4 GHz radio using Bluetooth 4.0 Smart, also known as BLE or Bluetooth low energy."
And from here: http://makezine.com/2014/01/03/reverse-engineering-the-estim...
"The Estimote is built around the Nordic Semiconductor nRF51822, which explains their presence on the Nordic booth at CES. It’s a nice chip, basically a 32-bit ARM Cortex M0 CPU with 256KB of flash and 16KB of RAM with a built-in 2.4GHz radio supporting both Bluetooth LE as well as 2.4GHz operation—where the 2.4GHz mode is on air compatible with the nRF24L series products from Nordic."
They might not be "easily programmable", but how much would you be against Travis Goodspeed being able to do something similar to what he's done here with an Estimote beacon? http://travisgoodspeed.blogspot.com.au/2011/02/promiscuity-i... (You can't see it very well in the image in the Makezine article of the board, but under the "CH3" in the label for the smaller chip is a 4 pin header that I'm 99.9% sure will be a jtag header...)
Both the 51 and 52 can have a BLE DFU programmed into the chip, allowing over the air firmware updates, so you wouldn't need a JTag. Most companies lock this down with a secure boot loader, meaning you would need to be able to flash the device using a JTag (only $500!)
If the "remote updating for fleet management" can be attacked, you don't even need to buy them; you can take over other people's.
[1] http://www.computerworld.com/article/3037377/security/mousej...