Bluetooth discoverability is not communicated to the user adequately in Settings

[Pedro Daniel Vieira Rosado]

When bluetooth is turned on ubuntu it is discoverable to all nearby devices.
It's strange that any "dumb" bluetooth device offers the option to be turned on but not be discoverable, but gnome bluetooth manager doesn't offer such option.

Any device can be paired with a device using the gnome desktop, as long as the user gets the prompt to pair. After that, gnome desktop can receive any file to the downloads folder.

There should be an option to make the gnome desktop device not show up to other devices, and another one to restrict what files can be sent via BT to the downloads folder

ProblemType: Bug
DistroRelease: Ubuntu 22.04
Package: libgnome-bluetooth13 3.34.5-8
ProcVersionSignature: Ubuntu 5.15.0-47.51-generic 5.15.46
Uname: Linux 5.15.0-47-generic x86_64
NonfreeKernelModules: nvidia_modeset nvidia
ApportVersion: 2.20.11-0ubuntu82.1
Architecture: amd64
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Thu Sep 1 12:12:16 2022
InstallationDate: Installed on 2022-08-31 (1 days ago)
InstallationMedia: Ubuntu 22.04.1 LTS "Jammy Jellyfish" - Release amd64 (20220809.1)
ProcEnviron:
 LANGUAGE=pt:pt_BR:en
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=pt_PT.UTF-8
 SHELL=/bin/bash
SourcePackage: gnome-bluetooth
UpgradeStatus: No upgrade log present (probably fresh install)

[Pedro Daniel Vieira Rosado (pdvrsd)]

After pair my desktop with my phone, just sent a .sh file with a simple init0 command.
once on the downloads folder, after double clicking the .sh file, pc turned off.

I don't think this should be happening in the first place.

[Daniel van Vugt (vanvugt)]

BlueZ itself lets you toggle discoverability:

$ bluetoothctl
[bluetooth]# discoverable off

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Sebastien Bacher (seb128)]

Could you describe what you are doing exactly? The discoverability should be turned on only when the bluetooth settings are open, which is similar to how other platform at doing it...

[Pedro Daniel Vieira Rosado (pdvrsd)]

Open setting on top right of the screen. Turn bluetooth on. As soon as BT is turned on for ubuntu 22.04, my laptop or desktop are visible to all nearby BT devices.
Click pair with any device, the prompt will show up in ubuntu 22.04. From that on, I can send any files over BT and will be sent directly to downloads folder, malicious or not.

[Pedro Daniel Vieira Rosado (pdvrsd)]

There could be at least a prompt to turn off visibility to other devices.
As for the sent files, a simple grep or zgrep to exclude some files from being sent to host via BT would be a security improvement. Specially because if the user has wine installed and a malicious .exe is sent... it can put the whole host in danger. Same for malicious scripts that can be used to escalate privileges on /home/user/downloads.

[Jeremy Bícha (jbicha)]

Close the Settings window (or even switch to a different page in Settings) to not be visible to other devices.

[Daniel van Vugt (vanvugt)]

Sounds like this isn't a bug, but I had forgotten the trick myself. This indicates the Settings GUI should be better designed to make it clear what's going on.

[Pedro Daniel Vieira Rosado (pdvrsd)]

Correct, and a prompt should be shown when possible malicious files are sent, to let the user decide if he wants to receive it or not.

It's surreal that you can send any file type with any content and it will automatically be sent to the download folder without user input, as long as the device is paired.

[Sebastien Bacher (seb128)]

The sharing is from gnome-user-share and it's supposed to display a notification when a file is received, if you aren't getting one you should report a new bug