Unknown BlueTooth device successfully connected to M1 Air, without permission

Hi there,


Today someone has successfully connected to my BlueTooth on my M1 Air.

I happened to check my devices to pair my head phones and noticed an unknown device had successfully connected to my Mac. The icon of the device was blue/active!!


Has this happened to anyone else?

What kind of data/files could have been accessed without me knowing?


I am really surprised someone was able to do so!


Also, does anyone know how to get a log of all data copied (possibly) to a bluetooth device?

MacBook Air 13″, macOS 11.1

Posted on Jan 6, 2021 9:50 PM

Reply
9 replies

Jan 6, 2021 10:38 PM in response to modoCosmo

modoCosmo Said:

"I understand nearby people would be able to see any bluetooth device that is broadcasting, like my Air would do. However, they had successfully connected, the icon with their device name was blue/active, indicating it had successfully connected to my Air. If they use an Android phone they would have a file browser and would be able to see all my files? and access?"

-------


Keep Firewall On:

No. They would not get in, and for three reasons:

  • Firewall, protects this. So, keep firewall on: Change Firewall Preferences on Mac - Apple Support
  • Don't Pair: Unless you pair them, it is not going to be used by your Mac.
  • Bluetooth List: If removed from the Bluetooth list (in System Preferences), it will not be used.


Jan 7, 2021 8:52 AM in response to modoCosmo

modoCosmo Said:

"'Don't Pair: Unless you pair them, it is not going to be used by your Mac.' This is exactly my concern. The device showed up in my paired devices list, the icon in front of the name (macOS BigSur) was blue, this seems to mean the device was paired :("

-------


Add to Ignored Devices:

Try using Terminal to add this as an Ignored bluetooth device. You would get the MAC Address using a few commands. Of each device listed, it would be the first line shown (i.e "a1-b2-c3-d4-e5-f6"). If any downside, MAC Addresses can always be spoofed to be something else. So, unless they are top-end hackers, then I wouldn't worry a thing about it, and just proceed through Terminal.


Determining the Device: In the list, there are different items. For this item - Find its MAC Address, through use of its nam: The MAC Address is on top of the item. The Item Name is on the Botton of the time.


To open Terminal: Go to: Applications > Utilities > Terminal

How this is performed:

1. Get: this item's MAC Address, Using this command:

sudo defaults read /Library/Preferences/com.apple.Bluetooth.plist DeviceCache


2. Add: the MAC Address to the end of this command (Replace: <MAC ADDRESS> with the office Mac Address discovered above.

sudo defaults write /Library/Preferences/com.apple.Bluetooth.plist IgnoredDevices -array-add '<MAC ADDRESS>'


3. Verify: if this is not an ignored device:

sudo defaults read /Library/Preferences/com.apple.Bluetooth.plist IgnoredDevices


***SOURCE: Prevent auto-pairing for certain devices (Bluetooth) - Ask Different

---


Screenshot, with Personal Info Blocked Out:

Jan 6, 2021 10:08 PM in response to modoCosmo

modoCosmo Said:

"Unknown BlueTooth device successfully connected to M1 Air, without permission: Hi there, Today someone has successfully connected to my BlueTooth on my M1 Air."

-------


See the Following:

  • Nearby Items:

If you are in an apartment complex and are close to the window, somewhat, then the neighbor's device is going to be seen by your Mac. The same would go for a nearby room, or on the other side of the room. So, all would seem fine.


  • Deleting this Item:

Do so by right-clicking on its icon in the device list, and selecting remove.


  • Reset the Bluetooth Module:

For Security & Privacy reasons, consider resetting the Bluetooth module for a more reliable connection.

Go Here: Use "Reset the Bluetooth module" to Fix Constant Bluetooth Disconnections

Jan 8, 2021 7:58 AM in response to modoCosmo

You are welcome.


In your information, I see:

  • Melissa's Galaxy S10
  • Samuel's Galaxy A71


Is there a Melissa or a Samuel next door? If so, then that would make sense as to who it would be.


So, go into Bluetooth in your System Preferences, and see if any items are seen. Right-Click on it, and you would see a MAC Address. Do they match those to that are shown above? Are they connected?

Jan 10, 2021 5:03 PM in response to modoCosmo

modoCosmo Said:

"Melissa's phone was connected, the icon was highlighted in blue, same as when I connect one of my BlueTooth devices, that is why I was worried and posted on this forum. Because somehow that device had connected... I don't know for how long and what that person would have been able to see or even copy from my hard drive. I did have my firewall on and also I have not activated file transfer using BlueTooth so hopefully the person would have not been able to access much."

-------


Firewall and Tracking This:

You are fine from here. But, if you want to learn more about tracing this, then view the video provided below.


  • Any Security Software Installed?:

You are all set - if firewall is on and if Security Software is not installed. But... be certain that you keep Security Software off of your Mac. Because, what Security Software does is it overrules the built-in Firewall settings on your Mac - indeed something to stay away from. If it is installed, then uninstall it, using the uninstaller. Ask the Developer which Uninstaller to use. Get it from none other than the Developer, as getting it elsewhere may end up with Malware or Spyware installed. So, if it is installed at the time this happened, then maybe consider looking into this, more deep.


  • Methods for Troubleshooting:

Apple Developer Forums: There are some things that I looked into, all of which are very technical. You'd have to single it out these items by manufacturer and all of that. MAC Addresses can always be spoofed, but I wouldn't worry about that, unless you think the person it high up there in tech. Learn about tracing where it all comes from, and goes to. Watch this Video: Unified Logging and Activity Tracing - Developer Forums. So, if this comes to high-end security - then show that video to whomever.

Jan 6, 2021 10:17 PM in response to TheLittles

"If you are in an apartment complex and are close to the window, somewhat, then the neighbor's device is going to be seen by your Mac. The same would go for a nearby room, or on the other side of the room. So, all would seem fine."


I understand nearby people would be able to see any bluetooth device that is broadcasting, like my Air would do.

However, they had successfully connected, the icon with their device name was blue/active, indicating it had successfully connected to my Air.

If they use an Android phone they would have a file browser and would be able to see all my files? and access?

Jan 8, 2021 3:03 AM in response to TheLittles

Thanks for that...

So looks like 2 unknown devices have successfully paired to my Mac?


"6d-b0-f5-85-3c-3b" = {

HeySiriEnabled = 0;

LMPSubversion = 16904;

LMPVersion = 9;

LastNameUpdate = "2021-01-07 02:57:04 +0000";

Manufacturer = 15;

Name = "Melissa's Galaxy S10";

SmartRoutingAutoRoute = 1;

};

"71-28-0b-34-6b-70" = {

HeySiriEnabled = 0;

LMPSubversion = 702;

LMPVersion = 9;

LastNameUpdate = "2020-12-30 05:34:30 +0000";

Manufacturer = 29;

Name = "Samuel's Galaxy A71";

SmartRoutingAutoRoute = 1;

};

Jan 10, 2021 1:29 PM in response to TheLittles

```So, go into Bluetooth in your System Preferences, and see if any items are seen. Right-Click on it, and you would see a MAC Address. Do they match those to that are shown above? Are they connected?```


Melissa's phone was connected, the icon was highlighted in blue, same as when I connect one of my BlueTooth devices, that is why I was worried and posted on this forum.

Because somehow that device had connected... I don't know for how long and what that person would have been able to see or even copy from my hard drive.

I did have my firewall on and also I have not activated file transfer using BlueTooth so hopefully the person would have not been able to access much.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Unknown BlueTooth device successfully connected to M1 Air, without permission

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.