Info about new nRF5 SDK v17.1.0

RE: Info about new nRF5 SDK v17.1.0

DimitrisP — Thu, 30 Sep 2021 10:16:29 GMT

Hi Torbjorn

Thank very mutch that is a crystal clear answer to my initial first question.

Before closing the case I will if there in anything for:

"2. - NRFFOSDK-13616: Updated handling of bonding events to be more sceptical of failed bonding/encryption attempts, since they can be the sign of an attack."

Is that what Avrebbek said "I am still waiting for more background on 2), but essentially if you get repeated failed pairing attempts it could be a sign that someone is trying to hack your connection by intercepting the pairing packets and trying to install themselves as a man in the middle. For this reason it is safer to disconnect when this situation occurs, rather than to repeatedly try to do pairing again. "

or there is more?

Dimitris

RE: Info about new nRF5 SDK v17.1.0

ovrebekk — Thu, 30 Sep 2021 09:37:36 GMT

Hi Dimitris

Not sure what you mean, you are obviously free to use this feature if you want 🙂

The pm_conn_exclude(..) function is documented here (the same documentation that you can find in the header file).

[quote user="DimitrisP"]I do need code from other users, but it is really useful to know how to exclude connections from handled by PM [/quote]

Could you provide some more information on what you are trying to do?

The reason this feature wasn't there before is that normal BLE applications don't need it. If you don't want to do pairing/bonding for particular connections you can always do that, the only difference with this feature is that it allows you to handle pairing/bonding manually for specific connections.

Normally people use the peer_manager to avoid having to implement all of this themselves.

Best regards
Torbjørn

RE: Info about new nRF5 SDK v17.1.0

DimitrisP — Wed, 29 Sep 2021 11:23:17 GMT

So if I get it right

There is a new option in peer manager (NRFFOSDK-13484), Nordic announce it and do not let customers to use it. Don't you thing it is bit strange?

I do need code from other users, but it is really useful to know how to exclude connections from handled by PM

Dimitris

RE: Info about new nRF5 SDK v17.1.0

mrono — Wed, 29 Sep 2021 11:11:28 GMT

When I downloaded SDK 17.1, I diffed the entire "components" subfolder against SDK 17.0.2. There aren't that many changes. The changes for issue 1 are easy to see from the diff.

I was curious about issue 2 as well. There were some changes specifically for LESC, but it was not immediately obvious to me if these were responsible for issue 2.

RE: Info about new nRF5 SDK v17.1.0

ovrebekk — Wed, 29 Sep 2021 10:57:42 GMT

Regarding 1 it is not a lot to share unfortunately. Apparently a limited number of customers reported an issue during their application development, and in order to solve the issue we provided this fix. We are not able to share details about the customer application, which means we can't really go into details about the issue either.

I am still waiting for more background on 2), but essentially if you get repeated failed pairing attempts it could be a sign that someone is trying to hack your connection by intercepting the pairing packets and trying to install themselves as a man in the middle. For this reason it is safer to disconnect when this situation occurs, rather than to repeatedly try to do pairing again.

Whether or not this is related to a specific incident or report I don't know, but I will let you know as soon as I hear back from the security team.

Best regards
Torbjørn

RE: Info about new nRF5 SDK v17.1.0

ovrebekk — Thu, 23 Sep 2021 11:58:37 GMT

Hi Dimitris

I will check internally if we have some more information regarding these changes, and get back to you.

Best regards
Torbjørn