3

I am using an HC-05 bluetooth Module. How can I stop someone from pairing with my device by brute forcing the key? Failing that, and if someone does pair with my device, is there a way to authenticate the user? I was thinking of salted hash with a shared secret key. Is there anything better?

7
  • Are you thinking that a device could repeatedly try and pair with you by submitting different keys over and over? I'm not sure about the spec of bluetooth nor maximum allowable key size ... but I'm guessing that you can set a key to be at least 8 bytes in length ... which makes a brute force attack on your device no more or less likely than a brute force attack on any other password protected environment.
    – Kolban
    Jun 9, 2015 at 16:46
  • Why is your device always accepting pair requests? Jun 9, 2015 at 17:07
  • @Kolban HC-05 does not take any more than 4 numbers. tec.reutlingen-university.de/uploads/media/…
    – Lord Loh.
    Jun 9, 2015 at 17:07
  • @IgnacioVazquez-Abrams It does not. But with just 10000 pins, it is not hard to brute force. Should I add an application layer security? Nonce / salting / hashing etc?
    – Lord Loh.
    Jun 9, 2015 at 17:09
  • 2
    @IgnacioVazquez-Abrams How do I disable pairing on an HC-05?
    – Lord Loh.
    Jun 9, 2015 at 18:10

2 Answers 2

2

Configure your Bluetooth module to AT Command Mode

Then use AT+PIN Command to change the default PAIRING PIN of the Bluetooth Module.

Visit this link for more information about how to configure bluetooth to AT Mode

1
  • The question was not how to change the PIN, but whether on not to trust the link layer security? For my application.
    – Lord Loh.
    Jun 9, 2015 at 17:05
1

In case someone else asks the same question in the future, here's the answer...

Technically speaking, the Arduino cannot be hacked for the simple reason that it doesn't have an Operating System like other devices such as the Raspberry Pi, BeagleBone, Rock64 etc. So in as much as someone might be able to bruteforce the HC-05 pin and get access, there's pretty much nothing else they can do past that point, so my advice to you is that don't stress over it. However I would suggest adding a few security measures to your HC-05 Bluetooth module:

  1. Change the default pin (0000 or 1234) to something else.
  2. Lock the module to connect only to a specific device via the MAC Address and the AT+BIND command.

Cheers!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.