Device discoverablility

BR/EDR

BLE

Bluetooth devices can remain discoverable by continuously advertising themselves or responding to inquiry requests, facilitating automatic connections for user convenience. However, discoverability should not be enabled by default, it should only be activated when explicitly required. Allowing users to manually control this state helps prevent unnecessary detection and identification, even if it affects usability.

Devices that remain discoverable expose information such as the MAC address, device name, and supported Bluetooth version, which can be used for tracking, impersonation or other targeted attacks. Therefore, discoverability should remain disabled except when needed for pairing or connection.

Devices equipped with input controls (e.g., buttons or keyboards) should provide a means to enable or disable discoverability through these controls.

Description

To fulfil the requirement it must be proven that the device is only discoverable by changing the state to discoverable and only for a limited time or until a connection is established or the state is manually deactivated.

Related resources

To test the discoverability of the device, Bluetooth LE beacons or Extended Inquiry Response messages can be obtained using the following resources:

Example case

Bluetooth headphones are turned on to carry out this analysis. Opening Wireshark with BTVS allows the capture of packets for analysis. The “beacons” provide visibility of the device emitting them, in this case, the headphones.

The control FAIL when the device is discoverable by default.

This behavior could be improved by making the headset not discoverable unless the user forces this mode. To achieve automatic connection of the headset, the headset would have to try to initiate a connection to the mobile device or computer to which it was previously connected.