Scan on service UUID instead of device name (issue #10) #14

Merged

eddy merged 1 commit from fix/issue-10-ble-scan-service-uuid into main

2026-08-02 21:28:00 +02:00

eddy commented

2026-08-02 21:27:38 +02:00

Owner

Summary

Fixes BLE name spoofing vulnerability in client scanning.

Change

Replace name-based scan filter:

// Before (spoofable)
advertisedDevice->getName() == "SylDa_Server"

// After (service UUID required)
advertisedDevice->isAdvertisingService(NimBLEUUID(SERVICE_UUID))

Defense in depth

Scan filter: Only connect to devices advertising 4fafc201-... service UUID
Post-connect: Verify server UUID via UUID_CHAR_UUID characteristic (already existed)
HMAC: All relay commands authenticated with HMAC key

Why this matters

A spoofed device advertising the name "SylDa_Server" is trivial. Spoofing the correct 128-bit service UUID is much harder, and without the matching UUID characteristic value + HMAC key, the attacker still cannot control relays.

Closes #10

## Summary Fixes BLE name spoofing vulnerability in client scanning. ### Change Replace name-based scan filter: ```cpp // Before (spoofable) advertisedDevice->getName() == "SylDa_Server" // After (service UUID required) advertisedDevice->isAdvertisingService(NimBLEUUID(SERVICE_UUID)) ``` ### Defense in depth 1. **Scan filter**: Only connect to devices advertising `4fafc201-...` service UUID 2. **Post-connect**: Verify server UUID via `UUID_CHAR_UUID` characteristic (already existed) 3. **HMAC**: All relay commands authenticated with HMAC key ### Why this matters A spoofed device advertising the name "SylDa_Server" is trivial. Spoofing the correct 128-bit service UUID is much harder, and without the matching UUID characteristic value + HMAC key, the attacker still cannot control relays. Closes #10

eddy added 1 commit

2026-08-02 21:27:38 +02:00

Scan on service UUID instead of device name (issue #10 )

CI / firmware (pull_request) Successful in 1m16s

Details

CI / android (pull_request) Successful in 5s

Details

7bdd50b16e

- Replace name-based scan filter (getName() == 'SylDa_Server') with
  isAdvertisingService(SERVICE_UUID) to prevent BLE name spoofing
- Post-connect UUID verification via UUID_CHAR_UUID was already in place
- Update log messages to reflect service-UUID-based scanning

eddy referenced this pull request

2026-08-02 21:27:52 +02:00

Client verbindt met elke SylDa_Server — geen UUID verificatie (kritieke veiligheidsbug) #10

eddy merged commit 68aec28fe2 into main

2026-08-02 21:28:00 +02:00

eddy referenced this pull request from a commit

2026-08-02 21:28:01 +02:00

Merge pull request 'Scan on service UUID instead of device name (issue #10)' (#14) from fix/issue-10-ble-scan-service-uuid into main