Device security is limited to the type of device.
What are the security risks of Bluetooth and what technologies and
best practices should be used to protect my device?
Each device provides a level of services. The services provided create the restrictions or limitations to access and exploit. The best protection is to keep Bluetooth turned off (if you're paranoid). Couple of interesting reads on Symantec's site and on Dark Reading.
What can an attacker do once a malicious device is paired with mine?
A few things that could happen:
Someone could: steal phone books, photos, videos, calendars, or allow make
phone calls, send and read e-mails, make appointments, and send SMS messages.
After exploiting a mobile phone you could potentially send SMS
message with a bomb threat to the local police station. The billing
records would certainly point directly to you as the phone owner and
the real sender of the SMS. It really depends on the target system's
implementation of the Bluetooth standard. Norton
They could also potentially listen to phone calls (if they've spoofed a headset) and control your mouse cursor on your desktop (if they spoofed your mouse).
I had a little fun with a car stereo at a Nissan dealership while I was bored waiting for my service to be done. The stereo in one of the demo cars was discoverable, so I paired during a demo when the salesman was showing the new features to a potential buyer, they paired with my device, then when the potential customer indicated that their pairing had failed they tried again (we were both paired). Then after the sales staff walked away I "possessed" the stereo, streaming random songs and controlling the volume. Someone would walk away from the car, the stereo would get louder. Someone would walk toward the car, then the stereo would get quieter. This was all fun until I received a phone call and the stereo auto-answered and almost blew my cover (I ignored the call).
Is it a good idea to remove & re-pair my devices on a set interval
(thinking that this is changing the Bluetooth PIN)
Since the system is easily exploitable, doing this doesn't remove the original vulnerabilities that exist in the target hardware's communication limitations with other devices (its trust level). dark reading
What is the security impact of making my device or computer
"discoverable"?
By making your system "discoverable" you allow someone to impersonate your device by renaming their device to match. This is unavoidable on some devices.
What kind of access does a Bluetooth enabled device get on my system?
This depends on the restrictions in place on the system itself. If your system assumes that all wireless mice or wireless headsets behave the same way because the software developer didn't take the time to secure the exchanges and someone impersonates your wireless mouse, they could have access to everything allowed in your system's services. On Windows apparently this might mean full control.
How can I control the scope of access a Bluetooth device has? (if my
phone were compromised I'd want to limit the exposure my PC has)
Any bluetooth system can potentially be compromised in its own ways because of the limitations in security implementation. Someone within range can just as easily compromise your "discoverable" desktop or laptop as they can your mobile phone, your headset, your mouse, your bluetooth enabled refrigerator, etc. Unpair and disable Bluetooth when you're not using it. Switch off dumb devices when not in use.
Are there Bluetooth security features that may (or may not be
enabled)? How can I audit for the presence (or lack of) these
features?
This depends on the device. Devices such as wireless mice will not have a log of activity. Desktops may. Some mobile phones do not.
Assuming encryption is a security feature that can be enabled, is it
required or is it optional? (moreover could an SSL Strip for Bluetooth
be created?)
Encryption can only be handled by devices that support it. In the initial handshake if you indicate your device doesn't have encryption capabilities, then the system will not try to encrypt transactions. Wireless mice for instance will not transmit secure signals.
Mac Bluetooth vulnerability exploited for Trojan deployment
Windows vulnerabilities
An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability only affects systems with Bluetooth capability.
Linux Bluetooth exploit includes memory stack manipulation and reading.
Good luck.
