0

I recently bought a Volcano Hybrid from Storz & Bickel. It has Bluetooth functionality, and indeed requires it to change certain important settings, such as the brightness of the display (which is insanely bright by default).

So I bought a "Bluetooth adapter" for my computer which plugs in via USB. Then I am able to load a webpage in my browser which finds my powered-on Volcano Hybrid, and which I was then able to select from a list to "pair" with. Then it lets me change its settings remotely.

But... um... isn't there something missing here? Should it not require me to press a button or something on the actual device? Like, perhaps the Bluetooth icon would start blinking or something, and I have to press the "+" button to accept the connection?

I had to do nothing whatsoever with the device itself. It just paired.

But then what stops anyone else from also buying a Bluetooth adapter and walk past my house and pair with my unit and turn it on and heat it up while I'm not looking to mess with me? That would be very annoying and potentially dangerous.

Yes, you can turn off the Bluetooth feature on the device, but that's pretty annoying and done with a key combination that you have to hold for several seconds, so it's very likely that most won't bother, even if I personally will. It's annoying that I will have to do the same thing to turn it back on every time I want to update the firmware or change any of the settings.

I thought the basic idea of Bluetooth required you to at the very least press a button on the target device to "accept the pairing". Is this usually the case but was skipped for this particular device?

1

1 Answer 1

1

Sounds like "Just works" BLE. No it doesn't provide any mitigation against driveby or MITM by default.

The app apparently asks for the serial of the device. This hinted to me that it could be Out of Band auth but by the video of the web app it doesn't seem required in that interface. So, unless the web app video left that out, I wouldn't hope for any extra security there.

If any security analysis was done of this product, the ability to disable Bluetooth smells like a cheap mitigation for what you're describing.

2
  • Well, I certainly did not have to enter any serial number. In fact, the WebApp told me the serial number of my device in the interface after allowing me straight in.
    – Kaiman
    Commented Jul 8, 2022 at 21:13
  • Yea, my fear was the app has you enter the serial number just so it knows which one to connect to. Sounds like bog standard "just works" BLE. It's safe to expect zero security.
    – foreverska
    Commented Jul 8, 2022 at 21:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .