44. Mobile Device Security – Android, iPhone, Bluetooth and Wi-Fi
44.7 Bluetooth Risks – Pairing Hygiene and BlueBorne Awareness
Bluetooth = short-range radio. Everyday risks:
- Pairing to the wrong speaker / headset in a busy café
- Old phones left discoverable forever
- Sensitive file / contact share prompts accepted blindly
- BlueBorne-class bugs (2017, Armis): implementation flaws in Bluetooth stacks on multiple OSes that, as reported, could allow proximity attackers serious impact without classic pairing in some cases – awareness + patch, not a lab exploit recipe in this book
Blue habits:
- Turn Bluetooth off when unused (especially in crowds / travel)
- Pair only expected device names; remove old pairings
- Keep OS / Bluetooth stack patched (BlueBorne lesson)
- Do not accept surprise pairing pop-ups
- Never run "Bluetooth hack APK" against classmates
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Social-engines pairing to attacker gadget | User verifies device name; rejects unknown |
| Abuses unpatched BlueBorne-class flaws (concept) | Vendor security updates; replace EOL phones |
| Leaves malware listening via paired link | Remove unused pairings; BT off when idle |
Ravindra Bagale's Tip
Students download a BlueBorne PDF and try the exploit. That is not in the book. Interview: "I patch Bluetooth stacks and minimise discoverability; I do not practise airborne exploits on strangers." Remember this.
Ravindra Bagale's Tip – मराठी
Students BlueBorne PDF download करून exploit try करतात. Book मध्ये नाही. Interview: "I patch Bluetooth stacks and minimise discoverability; I do not practise airborne exploits on strangers." हे लक्षात ठेवा.
Ravindra Bagale's Tip – हिंदी
Students BlueBorne PDF download करके exploit try करते हैं. Book में यह नहीं है. Interview: "I patch Bluetooth stacks and minimise discoverability; I do not practise airborne exploits on strangers." यह याद रखो.
Lab
On OWN phone / emulator: list paired devices; remove one unused. Toggle BT off. Write 5-line BlueBorne awareness note (Armis 2017, patch, no recipe). Pair with Salman – ethics: no scanning adjacent seats.
Real incident: BlueBorne Bluetooth vulnerabilities (2017)
In September 2017, Armis disclosed a set of Bluetooth implementation vulnerabilities nicknamed BlueBorne, affecting Android, Windows, Linux, and older iOS (pre-iOS 10 in Armis reporting). CERT and vendor advisories described serious outcomes including remote code execution or man-in-the-middle themes on affected stacks, often discussed as workable from proximity without normal user pairing in some scenarios. Google, Microsoft, and others issued patches; Armis and follow-on reporting stressed that unpatched and EOL devices remained a long tail. Defence: apply OS security updates, disable Bluetooth when unused, inventory SME phones that never patch. Source: Armis BlueBorne disclosure (2017); CERT VU#240311; vendor security bulletins (verify; say "reported" for device-count estimates).