How to temporarily secure a Pi against BlueBorne

Question

Apparently Raspbian does not yet have a fix for the BlueBorne vulnerability, which can be exploited by an attacker within range of the device, with no need for the attacker device to be paired to the target, or for the target to be discoverable.

Until patches are available, the only way to prevent this would be to disable the Bluetooth device altogether.

If I run bluetoothctl and send it a power off command, will that disable the BT adapter down deep enough to foil any such attack attempts?

(For clarification: just preventing malicious BT traffic from being processed is sufficient for my purposes—preventing BT from being accidentally re-enabled or similar, as suggested in the comments, is more than I need.)

Answer 1

To disable Raspberry Pi 3 built-in Bluetooth add this line to file /boot/config.txt (the file can contain multiple dtoverlay= lines):

dtoverlay=pi3-disable-bt

In addition it is recommended to run sudo systemctl disable hciuart (to prevent failure of hciuart service on every startup).

These changes will take effect after reboot.

For more information see Raspberry Pi overlays documentation

Answer 2

Unload the bluetooth drivers with modprobe -r ... if you're concerned. Stop the bluetooth daemon etc first. Make the scripts concerned non-executable, or use service/systemctl to permanently disable bluetooth.