Did you know – enabling Bluetooth in non-discovery mode doesn't prevent access to your smartphone

Some smartphone users like to have Bluetooth turned on, but keep their devices in non-discoverable mode so other connected gadgets won't detect them. It turns out this precaution is just a myth, and keeping your device non-discoverable won't fully protect it against hackers bent on breaking into your phone. There are scanners and sniffer devices in existence that find your device's Bluetooth address and let infiltration commence even when it’s set to non-discoverable.

A significant vulnerability that eases the process is the "factory" default password used on the majority of Bluetooth devices, which is something to the tune of "0000" or "1234". Once someone has sniffed your Bluetooth address, chances are they can establish a connection using this PIN code. According to security researchers, it's this unreasonably simplified system that faciliates most cases of Bluetooth eavesdropping and so-called "Bluejacking"  – connecting to a phone and sending spam content. So one of the better things you can do in this regard is change your Bluetooth password to a less  PIN.

The way this goes is that most consumer devices rely on the Bluetooth Device Address (BD_ADDR) information as a security mechanism. Operating in discoverable mode, Bluetooth devices respond to page request messages issued by other gadgets with their BD_ADDR information. In non-discoverable mode, though, BD_ADDR information requests are ignored. It may be common sense, but devices in discoverable mode are especially vulnerable as they get easily identified with tools such as BTScanner that send repeated page request messages to all Bluetooth devices within range.

What's the take-away here? Keeping Bluetooth devices non-discoverable is still good practice, but it won't stop attackers. They are able to send con request messages to every common BD_ADDR prefix or OUI until the full BD_ADDR is known. Either that, or they can use a list of common BD_ADDR prefixes that lets an attacker test all known Bluetooth OUI values in less than 2 minutes. Ultimately, Bluetooth is best left switched off unless you're using it to pair a device or transmit information.

source: SANS Tech Institute via MakeUseOf

ALSO READ