[SOLVED] Is it secure to use a Bluetooth controller (DS5) in public with my laptop?

[_dawn_chorus_]

I have never really used bluetooth devices so I am unfamiliar with the in's and out's, but the DS5 pairing directly with my laptop is nice for mobile gaming.
If I am playing in a public place with wifi disabled and bluetooth on undiscoverable is there any risk of being hacked through it?
This will be on my business laptop (a razor blade 15) so it would be ideal that it not be in any sketchy situation.

 

[hotaru.hino]

No. The bigger threat with Bluetooth security is the ability to eavesdrop on what's going on.

 

[_dawn_chorus_]

No. The bigger threat with Bluetooth security is the ability to eavesdrop on what's going on.

Thanks for the reply, but to clarify is your "No." a response to my "is it secure to use.." or "..is there any risk of being hacked?" ?
And by eavesdropping would someone be able to see my steam login credentials potentially or just what is being communicated between the computer and the controller?

 

[hotaru.hino]

Thanks for the reply, but to clarify is your "No." a response to my "is it secure to use.." or "..is there any risk of being hacked?" ?
And by eavesdropping would someone be able to see my steam login credentials potentially or just what is being communicated between the computer and the controller?

Just the communication between your computer and the controller. I will add the other side of the coin is someone could spam your BT receiver, but it's effectively the same as a DDOS attack.

Basically, AFAIK, you can't use BT as a means to hack into someone's computer.

 

[digitalgriffin]

Thanks for the reply, but to clarify is your "No." a response to my "is it secure to use.." or "..is there any risk of being hacked?" ?
And by eavesdropping would someone be able to see my steam login credentials potentially or just what is being communicated between the computer and the controller?

Yes Bluetooth has security holes. Depends on which implementation and if they use BLE (Bluetooth Low Energy) It also depends on how bad they want access to your machine) I don't even like using public wifi without VPN even though most pages are encrypted. Frame HTML Injection is possible, and if you don't pay attention to that little padlock, or warning, you might enter sensitive data into something that looks authentic, but isn't. Even with a padlock compromised certs can cause issues. Imagine it like a credit card skimmer people put over pumps at gas stations.

How Secure Is Bluetooth? Bluetooth Security Tips | XBitLabs

How Secure Is the BLE Communication Standard? - DZone Security

 

[hotaru.hino]

Yes Bluetooth has security holes. Depends on which implementation and if they use BLE (Bluetooth Low Energy) It also depends on how bad they want access to your machine) I don't even like using public wifi without VPN even though most pages are encrypted. Frame HTML Injection is possible, and if you don't pay attention to that little padlock, or warning, you might enter sensitive data into something that looks authentic, but isn't. Even with a padlock compromised certs can cause issues. Imagine it like a credit card skimmer people put over pumps at gas stations.

How Secure Is Bluetooth? Bluetooth Security Tips | XBitLabs

How Secure Is the BLE Communication Standard? - DZone Security

The biggest security concerns I'm seeing with Bluetooth security is simply sniffing the data and being able to spoof the device. This is only really a concern if the remote connection requests data that can be considered sensitive. For example, pairing a phone with say a smart watch, there will be sensitive data going back and forth between the two devices (like say your contacts). If an attacker figures out how to spoof the Bluetooth device, they can pose as the device and grab whatever data they want that the device is allowed to have access to (which I hope Android and iOS restrict said access to only what the user said the device has permission to get).

With regards to pairing a controller to a PC or even a phone, there really isn't any sensitive data that a controller would have access to. So even if an attacker spoofs a controller, the worst they can do is make OP's day bad by making it seem like the controller is spazzing out. And if the "controller" starts asking for my contact information, I'd be really suspect anyway. And I don't believe if you have a Bluetooth controller, it can do something like an injection into a web browser, especially if the web browser has no interest in Bluetooth traffic anyway. Now using a BT keyboard in public I would consider a bad idea, because someone can sniff that data.

OP is concerned that someone may use BT to hack into their PC to do nefarious things, which AFAIK, hasn't been a thing.