VUNERABILITY

[paulontheweb]

I miss the option in the app when changing a companions Bluetooth pin to fixed, to also hide that pin on the screen of the device.
What is the point of all the encryption when you can have a simple breach when physically losing the device. Unauthorised persons can simply connect the found or stolen companion and connect it with their own phone and start messing with your device. Such as reading all confidential texts or imposing as you.

This concerns me alot. Hide Bluetooth PIN on screen" Should be an easy fix.

I am using the thinknode m1 (nrf52840) and heltec v3 (esp32) but this problem concerns all companions with a screen.

[mrlmuk]

Modifying a line or two of code for the UI would probably be the easiest method. MeshCore/examples/companion_radio/ui-new/UITask.cpp This would prevent it being displayed but all it does is stop someone accessing it over Bluetooth while in your possession. Obviously you would also need to know how to set a static BT PIN of your own before you do this, which will be more work on a device using a random pin initially.

If I steal your device and connect it to a computer I could modify the firmware over USB extract your config including the private key and give it back to you. Now I can import that key to another device and silently read any new messages which arrive or impersonate you. I might even be able to do that without breaking the existing pairing with some work.

I'm not saying this should not be a feature but it is not a serious vulnerability as the screen is irrelevant when you consider how important it is to prevent physical access to any companion device.