2

I have the same issue as Martin did from Mar 6 '18 at 15:07 on this list. No working answer was provided for him. His link: [Unwanted macOS connection requests Also, adelejjeh asked on Oct 8 '16 at 15:36 MacBook keeps getting bluetooth pair requests from unauthorized device, and in that case the suggestion was to turn off the Handoff feature, which did not work for adelejjeh.

I had a Bluetooth connection request popup on my iMac running Mojave 10.14. It was from a device called "Nokia 7.1", which I DO NOT have! I was a bit stunned, and now I don't recall if I clicked Cancel or if the dialog went away by itself after some time. I noticed that I did have Bluetooth On on my iMac, so I turned it off (I have wired keyboard and mouse). An iPad and Google Pixel phone are my only other devices, which I rarely connect. I have no Nokia 7.1! Wouldn't this mean that either: 1) Someone is very nearby, trying to connect? Or, 2) It is some Malware trying to make me think it is my own device? Is this a Mac security hole that is being exploited? I really wonder what happens if someone clicks the Connect button! My Webroot SecureAnywhere software does not see a problem. It is definitely not "just a bug", as Martin asked if it could be. It's hard to imagine Apple has not addressed this issue that has been noticed since at least Oct '16.

I wonder if Arnold's issue Unauthorised Bluetooth device keeps connecting to Mac is essentially the same, but maybe he had clicked the Connect button in his past, and so now (May 18 '15 at 2:18) he was actually seeing the unauthorized connections (and data transfers) happening via his Bluetooth monitoring apps. In his case, the problem occurred when he had either Safari or Chrome browsers up (not Firefox). And, he turned off Handoff and did a factory reset of the Bluetooth environment. He never wrote back to say whether that all worked. In my case, I almost exclusively use Firefox, and occasionally use Safari when some videos don't work on my Firefox. It seems like all "Answers" I've seen are Not really solutions. I shouldn't have to turn Handoff Off, or Bluetooth Off, or not use Safari, or whatever. These are not solutions!

1
  • If it is just a request and not a connection, don't worry about it. Nearby devices can try to handshake when they see an active Bluetooth host. The request needs to be accepted before there can be an actual connection. If no connection is being established, you don't need to do anything.
    – fixer1234
    Feb 11, 2019 at 1:49

1 Answer 1

1

Piquing my interest, I wanted to do some research and found that these types of cases are relatively common. In cases like this, if your Security & Privacy settings are still set to default and bluetooth is regularly used in conjunction with the Public folder, then yes, there's the potential that someone could gain access. But, only to that Public folder.

Alternatively, it bears mentioning, that bluetooth devices when discoverable will search for all the other bluetooth devices in range, which is about 20 - 30 feet. This doesn't necessarily means that they're connected, but that the Mac can see the device for pairing.

There's an interesting paper that details tracking anonymized bluetooth devices, but this is in-keeping with an adversarial mindset and that the target is being actively monitored and tracked. They examined W10 devices as well as MacOS and iOS devices using the below criteria:

We passively record advertising events, while Bluetooth in macOS / iOS is enabled. Additionally, the Airdrop sharing feature is launched on the respective devices, and the resulting advertising events are recorded. We measure data generated by various up-to-date iPhones Tracking Anonymized Bluetooth Devices58(iPhone 5s, iPhone 8, iPhone X, running iOS 11),two iPads (iPad, iPad Pro running iOS 12), and two Macs (iMac A1419 and Macbook Pro A1502 running macOS 10.13)

From a MITM perspective, there was a bluetooth security flaw, which CERT issued a security warning for in 2018 that details "Bluetooth firmware or operating system software drivers may not sufficiently validate elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may allow a remote attacker to obtain the encryption key used by the device."

The impact of which was, "An unauthenticated, remote attacker within range may be able to utilize a man-in-the-middle network position to determine the cryptographic keys used by the device. The attacker can then intercept and decrypt and/or forge and inject device messages."

Nevertheless, this was patched fairly quickly and, should a user be up-to-date, would have little reason to be concerned. However, there's always means to harden security on a MacOS device and, while it may defeat the purpose of some of the convenient, streamlined interoperability of Apple devices (e.g Handoff, Airdrop, etc.), it decreases the potential of a malicious attack on the computer.

Regardless of the Apple Security Platform narrative, it bears keeping in mind that there necessitates a reasonably security-oriented mindset when it comes to having a machine that connects to the internet or is capable of connecting to any other device. While it's arguably not feasible, the most secure PC is the one that never touches the internet. In this case though, there isn't anything to really worry about.

2
  • While very detailed and informative, I'm not sure this adequately answers the questions, which seems to boil down to "where are these requests coming from", and "how do I stop them".
    – Doktor J
    Jan 17, 2020 at 19:46
  • @DoktorJ: Umm …what? where? The OP is not very focused; I see the questions «What does this mean?» and «Is this security-relevant?» Wildtaco’s post here seems to address those questions. Jan 18, 2020 at 6:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .