A man in a hi-vis vest and a hard hat, carrying a clipboard, can walk into almost any building in the country. Nobody asks for ID. The vest says he belongs, and the clipboard agrees.
Now imagine the vest is a name on a screen.
Ravi, an account director, is in a meeting room, early, before the pitch. Someone has left a presentation clicker on the table. His laptop gives a small chirrup and offers: Dell Wireless Mouse. Pair? It is a perfectly ordinary question. He says yes. It takes about two seconds.
How I got here
I built a Bluetooth mouse jiggler from a €5 ESP32-C3 board. It does one harmless thing: it nudges the cursor every few seconds so Microsoft Teams doesn’t mark me “Away” while I’m reading a report. It was meant to be a bit of weekend fun.
Then I noticed what Windows asks when it finds a new Bluetooth mouse: do you want to pair with this device? Most people look at the name, “Dell Mouse” or “Logitech MX Master”, and click Pair without a second thought.
The true bit
Plenty of Bluetooth devices pair using a mode called “Just Works”, which gives no protection against a device that is lying about what it is. A device name is just text, and anyone can choose it. NIST’s mobile threat catalogue lists Just Works pairing as open to impersonation attacks.
My jiggler doesn’t inject keystrokes or run commands. In fact that’s the point. The demo is intentionally boring: the cursor moves slightly, and nothing else happens. Then you ask the room one question: why did you trust it? Nearly everyone gives the same answer: “Because it looked like a normal mouse.”
That is the lesson. No exploit. No malware. No technical hacking. A person trusted a device because its name looked legitimate. That is the pretext, and the attack is psychological.
What to do about it
- Treat Bluetooth device names as untrusted input.
- Limit who can pair new peripherals.
- Audit paired devices and remove old ones.
- Put Bluetooth pairing into your phishing training, alongside email and SMS.
The moral of the story
I started this project because I wanted Teams to stop calling me “Away.” I finished it thinking about something completely different.
Sometimes the weakest link isn’t a software flaw. It is a person making a trust decision in under two seconds, whether the prompt arrives by email, QR code, SMS or Bluetooth.
References
- The People Hacker, MouseJigglerESP32 (the harmless demo, on GitHub).
- NIST, Mobile Threat Catalogue: LPN-15, Bluetooth Just Works pairing.