How secure is Windows Bluetooth pairing request?

andrew129260 said:

But I currently don't know of any way where modern bluetooth can be connected to a device without the pairing process being in effect.

Click to expand...

Windows and ChromeOS have proper validation of the Simple Secure Pairing (SSP) protocol. As a result, these two OSs remain unaffected by CVE-2023-45866. However, even though it is true that Bluetooth version 4.2 or later was thought to be safe because they added LE Secure Connections (LESC), these features are not necessarily enabled by default. Oftentimes, SDK examples use Legacy pairing to make things easier, and no one makes sure LESC is actually used or working. Many of the attacks on Bluetooth Low Energy (BLE) assume that LESC is being used, because otherwise the security of the device is already compromised. Several vulnerabilities were discovered not so very long ago that clearly demonstrate these risks: CERT/CC Vulnerability Note VU#799380
So, just because these vulnerabilities can be patched, does not necessarily also mean that they have already been patched. Most Windows 10/11 users don't know how to make sure that the internal Bluetooth capability of their laptop has the latest firmware in it. They rarely even understand the importance of keeping drivers always up-to-date, anyway in the first place, so... the "modern" in "modern laptops" is still going to be heavily overrated, especially when you consider the fact that a lot of these people believe that even a 5 year-old laptop is still modern as modern can be.

hdmi said:

Windows and ChromeOS have proper validation of the Simple Secure Pairing (SSP) protocol. As a result, these two OSs remain unaffected by CVE-2023-45866. However, even though it is true that Bluetooth version 4.2 or later was thought to be safe because they added LE Secure Connections (LESC), these features are not necessarily enabled by default. Oftentimes, SDK examples use Legacy pairing to make things easier, and no one makes sure LESC is actually used or working. Many of the attacks on Bluetooth Low Energy (BLE) assume that LESC is being used, because otherwise the security of the device is already compromised. Several vulnerabilities were discovered not so very long ago that clearly demonstrate these risks: CERT/CC Vulnerability Note VU#799380
So, just because these vulnerabilities can be patched, does not necessarily also mean that they have already been patched. Most Windows 10/11 users don't know how to make sure that the internal Bluetooth capability of their laptop has the latest firmware in it. They rarely even understand the importance of keeping drivers always up-to-date, anyway in the first place, so... the "modern" in "modern laptops" is still going to be heavily overrated, especially when you consider the fact that a lot of these people believe that even a 5 year-old laptop is still modern as modern can be.

Click to expand...

That is a fair point and good to know. Thanks for the info.

Perhaps I downplayed it because just like anything else, you have to be targeted, you have to be in range, and you have to have bluetooth enabled on your pc at all times.

And if your being specifically targeted by someone they will get in eventually no matter what. Phones also almost always have bluetooth on, and with their being so many multiple bluetooth signals in a public place I just think its a can of worms.

While a lot of these methods exist to attack bluetooth I doubt it is happening at a mass scale.

Maybe it's just me but if you're at a point about being paranoid about turning off bluetooth in a public place because your worried about the slim chance of something like this happening, you need to stay off the internet and have nothing connected to your machine at all.

There is being aware of good security practices and then there is going overboard about every little thing. There are a million vulnerabilities that don't get patched or even known about every day. It's a big world out there.

Into_Oblivion1 said:

If the hacker has skill to bypass the pairing request, I assume, that the hacker would also have skill to hide the connected malicious device in "Connected devices" aswell?

Click to expand...

I think you're being a bit paranoid here.

andrew129260 said:

While a lot of these methods exist to attack bluetooth I doubt it is happening at a mass scale.

Click to expand...

If it's happening at a mass scale, then if you were among those who are aware that this is what's happening, I think you'd probably want to keep it secret.

markw51 said:

I think you're being a bit paranoid here.

Click to expand...

"Just because you're paranoid, doesn't mean they aren't after you." — Joseph Heller

hdmi said:

If it's happening at a mass scale, then if you were among those who are aware that this is what's happening, I think you'd probably want to keep it secret.

Click to expand...

Usually the point of gathering peoples data is to sell it on the black market (which would be discovered eventually), perhaps governments maybe but there is easier ways & methods for them to do that.

Bluetooth is just one of the millions of options of vulnerabilities.

andrew129260 said:

Usually the point of gathering peoples data is to sell it on the black market (which would be discovered eventually), perhaps governments maybe but there is easier ways & methods for them to do that.

Click to expand...

Ask yourself what exactly it is that makes the easier ways easier. Large botnets definitely are very high on the list of possible answers to this question. So then your next question becomes, what are easy ways to expand botnets. Those who choose to believe the old myth that having mediocre/low security shouldn't be a real problem to worry about if you aren't a very high valued target often are those who are very high on the list of possible answers to that question.

Lower valued targets are more vulnerable on average, exactly because lower valued targets are so much more numerous in comparison to high valued ones, as that in fact is what makes it possible to attack them in bulk, i.e. by searching for the easy targets, also in bulk. Hackers use specialized tool software for this, which they use also in conjunction with their botnets. Gathering people's data also makes this continuous search easier to hackers. The more the hackers know about you, the easier it is for them to lure you into their trap, and, many hackers do this in bulk also. Again, the botnets play an important role as for what the hackers are capable to achieve when it comes to attacking all those easy targets that are sitting out there unsuspecting, just waiting to be hacked.

andrew129260 said:

Bluetooth is just one of the millions of options of vulnerabilities.

Click to expand...

Having more options of vulnerabilities is what hackers love the most. It increases the likelihood of there being at least one option, that will enable them to get in successfully. In addition, it is what makes it next to impossible for most people to still be able to know where to even begin with security. So, it increases the likelihood of people no longer actually trying to invest reasonable amounts of effort and time in it. Meanwhile, the hackers keep trying to convince you that you should instead continue to come up with all sorts of poor excuses. The fact that this specific part of the hackers' strategy sounds too far fetched also helps to explain why it is so successful, as no one believes it's real. Smart hackers stay invisible so no one believes they're there. Visible hackers aren't there because they got caught.

Sure. But the thing is besides doing updates and following generally safe practices, that is really all you can realistically do.

No average person even understands how bluetooth works let alone how to check their firmware version. So again, sure hackers may love this stuff but there is nothing you can realistically do so why worry about it?

Do you know how much money people make in scams and everything else? There is very little reasons to attack people via something like bluetooth. Breaking into companies or networks is much more lucrative. Social engineering and scams etc. And if there was a mass scale of this, and widely a huge issue, someone would catch on eventually.

hdmi said:

Having more options of vulnerabilities is what hackers love the most. It increases the likelihood of there being at least one option, that will enable them to get in successfully.

Click to expand...

yes......I know. Which is why it's pointless to worry about everything. There are defiantly scenarios where you can be in the wrong place at the wrong time.

If you want to be terrified all the time by all means do so. But I don't understand this "sky is falling" mentality. Even if you keep on top of everything there is always a way in, that was my point.

I had a friend who used to panic about this stuff 24/7. Refused to use a smartphone because the government and hackers were out to get him, only used linux, never installed or ran anything outside of a sandbox etc. Guess what? He still had his accounts attacked. Because companies were attacked and private information was leaked. You don't need to hack anyone to find out private info about people, it is already out on the internet already. And if they themselves have not shared it, someone they know has on social media.

Why make life such a headache and live in constant fear? Life is too short. The hackers win with that mentality. But so be it, they have won already anyway. Because there is no such thing as 100% secure. It is a constant game of cat and mouse. I just refuse to play the game. I do everything in my power to stay as secure as possible, but I'm not going to freak out about having bluetooth on or gps or the other million ways they can get me.

I myself use Bluetooth on My Windows Desktop, & Windows Laptop at times when i use it as well as my Galaxy S22 Phone and will for my Future S24 or S25 whenever i upgrade this phone again.

Only time i ever turn bluetooth off is when i'm going out somewhere with either the Laptop or Galaxy Phone.

No longer am i paranoid on changing every single password every 6 months (yes i really used to do that every 6 months, even the WIfi password lol) Nowadays with so many devices on Wifi i just make it super super hard to begin with, and maybe change now every year, but 6 months was just too much after a while.

Otherwise i just keep Windows up to date, Malwarebytes up to date, Roboform password Manager up to date, all 3rd Party Applications up to date, Windows Defender scans every week before backup with Macrium Reflect Home.

Think i'm safe as gonna be these days or i hope

andrew129260 said:

Sure. But the thing is besides doing updates and following generally safe practices, that is really all you can realistically do.

No average person even understands how bluetooth works let alone how to check their firmware version. So again, sure hackers may love this stuff but there is nothing you can realistically do so why worry about it?

Do you know how much money people make in scams and everything else? There is very little reasons to attack people via something like bluetooth. Breaking into companies or networks is much more lucrative. Social engineering and scams etc. And if there was a mass scale of this, and widely a huge issue, someone would catch on eventually.


yes......I know. Which is why it's pointless to worry about everything. There are defiantly scenarios where you can be in the wrong place at the wrong time.

If you want to be terrified all the time by all means do so. But I don't understand this "sky is falling" mentality. Even if you keep on top of everything there is always a way in, that was my point.

I had a friend who used to panic about this stuff 24/7. Refused to use a smartphone because the government and hackers were out to get him, only used linux, never installed or ran anything outside of a sandbox etc. Guess what? He still had his accounts attacked. Because companies were attacked and private information was leaked. You don't need to hack anyone to find out private info about people, it is already out on the internet already. And if they themselves have not shared it, someone they know has on social media.

Why make life such a headache and live in constant fear? Life is too short. The hackers win with that mentality. But so be it, they have won already anyway. Because there is no such thing as 100% secure. It is a constant game of cat and mouse. I just refuse to play the game. I do everything in my power to stay as secure as possible, but I'm not going to freak out about having bluetooth on or gps or the other million ways they can get me.

Click to expand...

Some of the credit reference companies hold far more data about individuals than one could possibly imagine and will pass it on to "companies" wanting a credit reference check on someone. So by masquraiding as a company you could get quite personal information on a set of individuals far easier than by hacking those individuals computers !!!!

Companies like Experian etc probably even know how many times you used the restroom last week and what brand of toilet paper you use !!!. There's nothing you can do to stop these companies if you have ANY type of credit -- they check up on people even if you just want a mobile phone or a basic utilities contract, However nobody seems to worry about these companies and I'm sure their security isn't as robust as it should be.

Cheers
jimbo

hdmi said:

"Just because you're paranoid, doesn't mean they aren't after you." — Joseph Heller

Click to expand...

Dear hdmi

I have read all your posts in this thread with great interest

Would you like to answer the following?

I use Windows 11.

When a Bluetooth device wants to pair with to my laptop, a message pops up on my screen asking if I want to allow the pairing.

1.
How secure is this?

2.
Could a hacker bypass this, and still get access to my data without my knowledge through Bluetooth?
It has already been answered, that a hacker can bypass this.
-
But where in the "hacker league" / level are we?

Thank you

andrew129260 said:

If they are disabled in device manager, they should not be able to turn themselves on. However, if a driver update is applied (say though windows update) this can re-enable them and turn them back on.

Click to expand...

"However, if a driver update is applied (say though windows update) this can re-enable them and turn them back on."
I am not worried about this, since it would require the laptop to have internet access - is that correct?

Thank you

Into_Oblivion1 said:

Dear hdmi

I have read all your posts in this thread with great interest

Would you like to answer the following?

I use Windows 11.

When a Bluetooth device wants to pair with to my laptop, a message pops up on my screen asking if I want to allow the pairing.

1.
How secure is this?

Click to expand...

That's the $64,000 question. Read the news, see how many self-professed security experts (I call them self-professed, as I subscribe to the strong belief that the first step to becoming an expert is to learn and accept the fact that you aren't an expert...) thought that CrowdStrike was pretty safe. No hacking was involved with that fiasco. Even so, it was supposed to be a reliable security solution because... well, 60% of Fortune 500 companies and more than half of the Fortune 1,000 firms are clients, they said. Until it turned out that the damage that they have caused is on par with what once used to be feared about the Y2K bug. It's officially THE single biggest catastrophe in corporate IT history. I have said this many times, and will keep saying it... the chance of something that can go wrong actually going wrong might be small, but the consequence might not be small.

Into_Oblivion1 said:

2.
Could a hacker bypass this, and still get access to my data without my knowledge through Bluetooth?
It has already been answered, that a hacker can bypass this.
-
But where in the "hacker league" / level are we?

Thank you

Click to expand...

I think it quite depends on factors like how old is the Bluetooth hardware version and the associated firmware version, the drivers, and various other things like how often do you use Bluetooth and how many hours does it usually take before you finally turn it off again, in what type of environments are you when you use your Bluetooth devices or do you also do the pairing in a crowded/densely populated area/location, do you turn off Bluetooth visibility, etc., etc..

Another favorite example of why hackers don't necessarily always have to be incredibly skilled/experienced for them to still be able to abuse weak targets with relative ease IMO is, if you had rented a car and you connected your laptop or phone to the car's media playback system via Bluetooth, before you bring the car back to the owner, do you undo the pairing?

Into_Oblivion1 said:

"However, if a driver update is applied (say though windows update) this can re-enable them and turn them back on."
I am not worried about this, since it would require the laptop to have internet access - is that correct?

Thank you

Click to expand...

Windows Update requires internet access, but the same cannot be said about failure to remember that you should check if Bluetooth is still disabled after an update.

Into_Oblivion1 said:

"However, if a driver update is applied (say though windows update) this can re-enable them and turn them back on."
I am not worried about this, since it would require the laptop to have internet access - is that correct?

Thank you

Click to expand...

Yes, you would need an internet connection for any update to occur. Unless it was updated manually from a external drive.

hdmi said:

I think it quite depends on factors like how old is the Bluetooth hardware version and the associated firmware version, the drivers, and various other things like how often do you use Bluetooth and how many hours does it usually take before you finally turn it off again, in what type of environments are you when you use your Bluetooth devices or do you also do the pairing in a crowded/densely populated area/location, do you turn off Bluetooth visibility, etc., etc..

Click to expand...

Does Windows 11 come with the newest and most secure Bluetooth hardware version?

hdmi said:

Windows Update requires internet access, but the same cannot be said about failure to remember that you should check if Bluetooth is still disabled after an update.

Click to expand...

A Windows Update could activate a disabled Bluetooth adapter in Device Manager?

Into_Oblivion1 said:

A Windows Update could activate a disabled Bluetooth adapter in Device Manager?

Click to expand...

Yes.

Into_Oblivion1 said:

Does Windows 11 come with the newest and most secure Bluetooth hardware version?

Click to expand...

What do you mean? Windows does not come with any Bluetooth hardware version.

A Windows Update could activate a disabled Bluetooth adapter in Device Manager?

hdmi said:

Yes.

Click to expand...

Have you experienced this?

I find it quite ill-conceived / not a good idea.