How secure is Windows Bluetooth pairing request?

Into_Oblivion1 · Jun 18, 2024

Dear all

I use Windows 11.

When a Bluetooth device wants to pair with to my laptop, a message pops up on my screen asking if I want to allow the pairing.

1.
How secure is this?

2.
Could a hacker bypass this, and still get access to my data without my knowledge through Bluetooth?

Thank you

Best regards

andrew129260 · Jun 18, 2024

Nothing is 100 Percent secure and bluetooth has been known to be attacked.

However, in general, bluetooth is quite safe to use with a modern pc. Just keep your phone and system up to date.

There are much bigger issues with security than bluetooth.

The main thing to watch out for is when pairing devices, ensure you are pairing the correct device, and never pair new devices in public places.

Dannydet · Jun 18, 2024

Bluetooth has a very limited distance, usually only up to 30 - 60 feet

Into_Oblivion1 · Jul 3, 2024

andrew129260 said:
Nothing is 100 Percent secure and bluetooth has been known to be attacked.

However, in general, bluetooth is quite safe to use with a modern pc. Just keep your phone and system up to date.

There are much bigger issues with security than bluetooth.

The main thing to watch out for is when pairing devices, ensure you are pairing the correct device, and never pair new devices in public places.

Could a hacker bypass the paiaring request, and still get access to my data without my knowledge through Bluetooth?
Or would you say it is around NSA-level skill?

Thank you

Fabler2 · Jul 3, 2024

Into_Oblivion1 said:
Could a hacker bypass the paiaring request, and still get access to my data without my knowledge through Bluetooth?
Or would you say it is around NSA-level skill?

Thank you

More than likely a hacker can. Only thing to do is make sure your settings is secure as possible. Go to settings, Bluetooth and Devices, Devices, scroll down to 'More Bluetooth settings, and adjust to what you want. These are mine:

andrew129260 · Jul 3, 2024

Into_Oblivion1 said:
Could a hacker bypass the paiaring request, and still get access to my data without my knowledge through Bluetooth?
Or would you say it is around NSA-level skill?

Thank you

Anything is possible.

But I currently don't know of any way where modern bluetooth can be connected to a device without the pairing process being in effect. Usually it is all about tricking a person to pair to the wrong device.

There are bluetooth scanners that scan around public places looking for targets and to know if someone has been in that location before, and can be used for tracking.

This is why it is important to have your bluetooth device name be something unique that you would know, but without any personal information in it. Sort of like the ssid for your wifi.

For example. don't name your bluetooth device as Andrew's Iphone.

Name it something like Phone from outer space or something like that. You recognize it, but it doesn't have your name or personal info in it.

Into_Oblivion1 · Jul 3, 2024

I have a latop, that I use as a backup for my own important data.

The laptop is offline from the internet aswell.

I have turned bluetooth off and disabled bluetooth in device manager - but bluetooth was turned on for some minutes before this.
I just want to make sure, that nothing malicious got through in those minutes.

My OS i fully updated.
I did a deep scan after with Microsoft Defender - it found nothing
-
Would you trust, that my laptop is clean from malware etc.?

Thank you

andrew129260 · Jul 3, 2024

Into_Oblivion1 said:
I have turned bluetooth off and disabled bluetooth in device manager - but bluetooth was turned on for some minutes before this.

Bluetooth and wifi can toggle themselves on to help with location services to get an accurate reading of where you are, such as the maps app or the weather app or anything using location.

Into_Oblivion1 said:
Would you trust, that my laptop is clean from malware etc.?

More than likely you are fine. A scan with windows defender and malwarebytes could not hurt though. I highly doubt you were attacked via bluetooth.

Into_Oblivion1 · Jul 3, 2024

andrew129260 said:
Bluetooth and wifi can toggle themselves on to help with location services to get an accurate reading of where you are, such as the maps app or the weather app or anything using location.

Are you saying, that Wifi and Bluetooth could get turned on, without my knowledge?
Also if they are disabled in Device Manager?

andrew129260 · Jul 3, 2024

Into_Oblivion1 said:
Are you saying, that Wifi and Bluetooth could get turned on, without my knowledge?

Yes, this happens on your phone as well. Even when wifi is off or bluetooth they do turn themselves on to help with location services from time to time.

On android, this is called wifi scanning and bluetooth scanning.

Into_Oblivion1 said:
Also if they are disabled in Device Manager?

If they are disabled in device manager, they should not be able to turn themselves on. However, if a driver update is applied (say though windows update) this can re-enable them and turn them back on.

If you want to block them fully, turn them off in the systems bios. But keep in mind that the bios could be updated and revert back to system defaults.

Into_Oblivion1 · Jul 3, 2024

andrew129260 said:
If they are disabled in device manager, they should not be able to turn themselves on. However, if a driver update is applied (say though windows update) this can re-enable them and turn them back on.

"However, if a driver update is applied (say though windows update) this can re-enable them and turn them back on."
I am not worried about this, since it would require the laptop to have internet access.

Berton · Jul 3, 2024

How is the computer offline, is the Wireless/Wi-Fi adapter in it turned off in Device Manager? I use Bluetooth mice and if like all of mine, turning off the adapter also turns off the Bluetooth function.

neemobeer · Jul 3, 2024

Bluetooth has had many flaws over the years that have allowed threat actors to gain access to systems without user consent or knowledge. It does, as many stated have limited range and unless you are being targeted is okay to run from your home. As a precautionary measure it is a good idea to disable Bluetooth if you are out in public and not actively using it. Having Bluetooth on at DefCon as an example will often result in you ending up on their wall of sheep often with some personal info leaked due to Bluetooth being enabled or often connecting to the "free & public" wifi APs setup.

Into_Oblivion1 · Jul 5, 2024

Berton said:
How is the computer offline, is the Wireless/Wi-Fi adapter in it turned off in Device Manager? I use Bluetooth mice and if like all of mine, turning off the adapter also turns off the Bluetooth function.

1.
Disconnected from network
Wifi turned off
Disabled network adapters / network cards in device manager

2.
Bluetooth turned off
Disabled Bluetooth in device manager

Into_Oblivion1 · Jul 5, 2024

neemobeer said:
Bluetooth has had many flaws over the years that have allowed threat actors to gain access to systems without user consent or knowledge.

Like bypassing the pariring request?

What could be signs, that they have connected to my Bluetooth adapter unauthorized?

jimbo45 · Jul 5, 2024

Into_Oblivion1 said:
Like bypassing the pariring request?

What could be signs, that they have connected to my Bluetooth adapter unauthorized?

Show connected devices !!!

If travelling I'd always use wired headphones rather than blu tooth -- iPhones and Samsungs can use a USBC->audio connector to connect to wired phones. Blu tooth while OK in a home is as leaky as a sieve when in public.

Cheers
jimbo

Into_Oblivion1 · Jul 5, 2024

jimbo45 said:
Show connected devices !!!

If the hacker has skill to bypass the pairing request, I assume, that the hacker would also have skill to hide the connected malicious device in "Connected devices" aswell?

jimbo45 · Jul 5, 2024

Into_Oblivion1 said:
If the hacker has skill to bypass the pairing request, I assume, that the hacker would also have skill to hide the connected malicious device in "Connected devices" aswell?

Maybe -- but worth a check. Perhaps the hacker is just interested in getting connected. I'd still not use blutooth in public -- you can easily use tiny wired phones without a problem. Just get the adapter.

Cheers
jimbo

neemobeer · Jul 6, 2024

Some types of attacks don't even show up as a connected device or they can simply spoof an existing device you connected already. This is why it's simply a good idea to disable Bluetooth when not in use and especially in public. Bluesnarf attacks are the most common and an attacker can simply download files from your system unauthenticated.

badrobot · Jul 6, 2024

It's a point to point pairing. You wanna make sure you know the device name you are pairing it with. If you are really concerned, turn it off when you are in public places.