3

What are the security risks associated with leaving bluetooth on all the time on a Pixel phone updated to Android 10?

In this question, I am NOT focusing on the risks associated with someone intercepting my conversation using a bluetooth headset as an example.

Rather, I am focused on risks of getting malware similar to the bluetooth worm from a few years ago, which didn't require any pairing to spread.

My understanding was that Android phones are only discoverable when you click the "Pair new device" option from the Bluetooth menu but not sure if malware can spread even if Bluetooth is not discoverable.

I understand that it is ideal to switch bluetooth off but am trying to understand the risk involved with leaving it on.

Thanks

  • I don't know of any specific attacks. If there was general knowledge of such an attack, I'm sure everyone would have heard of it and it would be patched ASAP. That said, there could be unknown attack vectors. As always, the more services you expose, the greater the attack surface. – multithr3at3d Nov 1 '19 at 21:16
1

I'm not very sure of how Android 10 changes things when it comes to threats related to leaving your Bluetooth on, but there are many already discovered attacks which can lead to leaking of your sensitive data or even losing control of your bluetooth device (Not just your phone).

Some of these attacks are -

  1. Bluejacking - This type of attack entails unsolicited text messages, mostly advertisements that people usually don’t want to see. With Bluejacking, leaving your Bluetooth on exposes you to aggressive (and very ineffective) marketing tactics, but it doesn’t pose a threat to the device itself.

  2. Bluesnarfing - Unlike bluejacking, bluesnarfing is an actual threat to your security. Using this method, criminals can break into people’s devices and gain unauthorized access to their data. They can see the text messages, steal contacts, and most alarmingly, get their hands on people’s passwords. Successful bluesnarfing results data and identity theft.

  3. Bluebugging - When criminals gain access to a person’s’ contacts, they can use them to send text messages and place calls from the phone without the user being aware of it. That way, they can spread bugs and viruses to a lot of people at once and break into hundreds of other devices.

  4. BlueBorne - The most dangerous attack since it is not limited to just your phone. More precisely, they can take control of the device, infect it with malware, or steal data. But it’s even more unnerving that BlueBorn can affect all vulnerable Bluetooth devices within an area without anyone ever noticing that something’s wrong.

You can read more about them here

  • 2
    Hey and welcome to security.shackexchange! This would be a much stronger answer if you included a description about each vulnerability. Maybe a paragraph each? – Mike Ounsworth Nov 1 '19 at 22:18
  • @MikeOunsworth Hey! I didn't feel the need to add any details about the attacks since they are listed out on the link I've provided. I didn't want to copy paste and make things redundant. – Ayush Ambastha Nov 1 '19 at 23:54
  • 1
    Quoting from the help center: "Links to external resources are encouraged, but please add context around the link so your fellow users will have some idea what it is and why it’s there. Always quote the most relevant part of an important link, in case the target site is unreachable or goes permanently offline." – Mike Ounsworth Nov 2 '19 at 0:26
  • This Q&A forum tries to follow more of an encyclopedia style, where the answer is self-contained, with links more as citations or references to show where you got the information from. – Mike Ounsworth Nov 2 '19 at 0:28
  • 1
    @MikeOunsworth I've edited my answer with a small paragraph about each attack. Thanks for the tips! – Ayush Ambastha Nov 2 '19 at 1:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.