Security risk of leaving bluetooth on all the time on an Android 10 phone

Question

What are the security risks associated with leaving bluetooth on all the time on a Pixel phone updated to Android 10?

In this question, I am NOT focusing on the risks associated with someone intercepting my conversation using a bluetooth headset as an example.

Rather, I am focused on risks of getting malware similar to the bluetooth worm from a few years ago, which didn't require any pairing to spread.

My understanding was that Android phones are only discoverable when you click the "Pair new device" option from the Bluetooth menu but not sure if malware can spread even if Bluetooth is not discoverable.

I understand that it is ideal to switch bluetooth off but am trying to understand the risk involved with leaving it on.

Thanks

Answer 1

I'm not very sure of how Android 10 changes things when it comes to threats related to leaving your Bluetooth on, but there are many already discovered attacks which can lead to leaking of your sensitive data or even losing control of your bluetooth device (Not just your phone).

Some of these attacks are -

1. Bluejacking - This type of attack entails unsolicited text messages, mostly advertisements that people usually don’t want to see. With Bluejacking, leaving your Bluetooth on exposes you to aggressive (and very ineffective) marketing tactics, but it doesn’t pose a threat to the device itself.

2. Bluesnarfing - Unlike bluejacking, bluesnarfing is an actual threat to your security. Using this method, criminals can break into people’s devices and gain unauthorized access to their data. They can see the text messages, steal contacts, and most alarmingly, get their hands on people’s passwords. Successful bluesnarfing results data and identity theft.

3. Bluebugging - When criminals gain access to a person’s’ contacts, they can use them to send text messages and place calls from the phone without the user being aware of it. That way, they can spread bugs and viruses to a lot of people at once and break into hundreds of other devices.

4. BlueBorne - The most dangerous attack since it is not limited to just your phone. More precisely, they can take control of the device, infect it with malware, or steal data. But it’s even more unnerving that BlueBorn can affect all vulnerable Bluetooth devices within an area without anyone ever noticing that something’s wrong.

You can read more about them here