EH-MB05 User Guide
10-25
Notes:
1. A man-in-the-middle (MITM) attack occurs when a user wants to connect two devices but instead of connecting
directly with each other they unknowingly connect to a third (attacking) device that plays the role of the device they are
attempting to pair with. The third device then relays information between the two devices giving the illusion that they are
directly connected. The attacking device may even eavesdrop on communication between the two devices (known as
active eavesdropping) and is able to insert and modify information on the connection. In this type of attack, all of the
information exchanged between the two devices are compromised and the attacker may inject commands and
information into each of the devices thus potentially damaging the function of the devices. Devices falling victim to the
attack are capable of communicating only when the attacker is present. If the attacker is not active or out range, the two
victim devices will not be able to communicate directly with each other and the user will notice it.
To prevent MITM attacks, Secure Simple Pairing offers two user assisted numeric methods: numerical comparison or
passkey entry. If Secure Simple Pairing would use 16 decimal digit numbers, then the usability would be the same as
using legacy pairing with 16 decimal digit PIN. The chance for a MITM to succeed inserting its own link keys in this case
is a 1 in 1016 = 253 pairing instances, which is an unnecessarily low probability.
Secure Simple Pairing protects the user from MITM attacks with a goal of offering a 1 in 1,000,000 chance that a MITM
could mount a successful attack. The strength of the MITM protections was selected to minimize the user impact by
using a six digit number for numerical comparison and Passkey entry. This level of MITM protection was selected since,
in most cases, users can be alerted to the potential presence of a MITM attacker when the connection process fails as a
result of a failed MITM attack. While most users feel that provided that they have not compromised their passkey, a 4-
digit key is sufficient for authentication (i.e. bank card PIN codes), the use of six digits allows Secure Simple Pairing to be
FIPS compliant and this was deemed to have little perceivable usability impact.
If the Man-In-The-Middle protection feature is activated, the module may output the number for numeric comparison by
indicator NC or a passkey request by indicator PK. About the command NC and PK, please refer to section 5.1.24 and
5.1.25.
2. If the Man-In-The-Middle protection feature is activated, the IO capability can only be configured to “Display Yes/No”
or “Keyboard Only”. About the IO capability, please refer to section 5.1.7 .
3. When connect with some Android device by the SPP profile, it is required to active the Man-In-The-Middle protection.
5.1.4.4. Examples:
Ex. 5.11. To query current Man-In-The-Middle protection state of the Bluetooth module:
AT+MM<CR><LF> query the current Man-In-The-Middle protection state.
MM=00<CR><LF> report the Man-In-The-Middle protection is deactivated currently.
Ex. 5.12. To active Man-In-The-Middle protection feature:
AT+MM=01<CR><LF> active Man-In-The-Middle protection feature.
OK<CR><LF> response from the module to indicate the command is adopted.
Ex. 5.13. To active Man-In-The-Middle protection feature, and let the module confirm the numeric comparison
automatically:
AT+MM=02<CR><LF> active Man-In-The-Middle protection feature and auto confirm the numeric comparison.
Thus, no NC indicator will be output by the module.
OK<CR><LF> response from the module to indicate the command is adopted.
5.1.5. NM—Query or change the local friendly name
5.1.5.1. Description:
This command can query or change the local friendly name of Bluetooth module. Once changed, the new friendly name
will take effect at next time the remote device get local name and until the next time the friendly name is changed by this
command. It means the Bluetooth module will remember the friendly name, and even if the Bluetooth module has been
powered off, the friendly name will not be lost.
If the parameter is not presented, the Bluetooth module will report current friendly name by the Indicator NM.
5.1.5.2. Syntax:
