feat(nordic/ble): add device information service
What the developer wrote
Authored by tychovrahe
feat(nordic/ble): add device information service
[no changelog]
What changed, and why it matters
This commit adds a standard Bluetooth 'Device Information' service to Trezor's Nordic BLE firmware. It advertises the manufacturer name ('Trezor Company s.r.o'), device model ('Trezor Safe 7'), and firmware/software version strings over Bluetooth. There is no direct vulnerability in the diff, but it increases the amount of identifiable information a nearby attacker could read from Bluetooth scan/advertising data, which can aid targeted attacks or fingerprinting.
Review whether the Device Information Service characteristics require pairing/encryption on this product; if not, consider gating read access behind authenticated pairing. Ensure version strings do not leak sensitive build or internal identifiers. Add a changelog entry for the new BLE service behavior.
Security signals we found
New Bluetooth GATT service exposes device-identifying metadata (manufacturer, model, version)
Version strings set at runtime from build macros via settings_runtime_set
No changelog entry despite user-facing BLE behavior change
No evidence of access-control restrictions on DIS characteristics in the diff
Evidence from the diff
The patch enables Zephyr’s Bluetooth DIS (Device Information Service) via Kconfig and registers runtime settings for fw_rev and sw_rev using settings_runtime_set(). It exposes static strings and compile-time app version macros over BLE GATT. No input parsing, buffer handling, authentication, or cryptographic code is changed. The primary security consideration is information disclosure/enumeration, not an exploitable memory corruption or authentication bypass.
Changed components
nordic/trezor/trezor-ble/prj.confnordic/trezor/trezor-ble/src/ble/ble.cZephyr Bluetooth DIS subsystemTrezor Safe 7 BLE stackInspect captured patch +31 / −0
diff --git a/nordic/trezor/trezor-ble/prj.conf b/nordic/trezor/trezor-ble/prj.conf
index eaec03e1f..f54712f8a 100644
--- a/nordic/trezor/trezor-ble/prj.conf
+++ b/nordic/trezor/trezor-ble/prj.conf
@@ -60,6 +60,18 @@ CONFIG_BT_PERIPHERAL_PREF_TIMEOUT=400
CONFIG_BT_CTLR_PHY_2M=y
CONFIG_BT_USER_PHY_UPDATE=y
+CONFIG_BT_DIS=y
+CONFIG_BT_DIS_MANUF="Trezor Company s.r.o"
+CONFIG_BT_DIS_MODEL="Trezor Safe 7"
+CONFIG_BT_DIS_FW_REV=y
+CONFIG_BT_DIS_FW_REV_STR="0.0.0.0"
+CONFIG_BT_DIS_SW_REV=y
+CONFIG_BT_DIS_SW_REV_STR="0.0.0.0"
+CONFIG_BT_DIS_PNP=n
+CONFIG_BT_DIS_SETTINGS=y
+CONFIG_BT_DIS_STR_MAX=21
+
+
#PHY update needed for updating PHY request
CONFIG_BT_PHY_UPDATE=y
CONFIG_BT_USER_PHY_UPDATE=y
@@ -78,6 +90,7 @@ CONFIG_FLASH_PAGE_LAYOUT=y
CONFIG_FLASH_MAP=y
CONFIG_NVS=y
CONFIG_SETTINGS=y
+CONFIG_SETTINGS_RUNTIME=y
# Enable DK LED and Buttons library
CONFIG_DK_LIBRARY=y
diff --git a/nordic/trezor/trezor-ble/src/ble/ble.c b/nordic/trezor/trezor-ble/src/ble/ble.c
index 29cc886d9..73579af04 100644
--- a/nordic/trezor/trezor-ble/src/ble/ble.c
+++ b/nordic/trezor/trezor-ble/src/ble/ble.c
@@ -26,11 +26,22 @@
#include <zephyr/bluetooth/gatt.h>
#include <zephyr/bluetooth/hci.h>
#include <zephyr/bluetooth/uuid.h>
+#include <zephyr/settings/settings.h>
+
+#include <app_version.h>
+
#include "ble_internal.h"
#define LOG_MODULE_NAME ble
LOG_MODULE_REGISTER(LOG_MODULE_NAME);
+#define STR_HELPER(x) #x
+#define STR(x) STR_HELPER(x)
+
+#define APP_VERSION_STR \
+ STR(APP_VERSION_MAJOR) \
+ "." STR(APP_VERSION_MINOR) "." STR(APP_PATCHLEVEL) "." STR(APP_TWEAK)
+
static K_SEM_DEFINE(ble_init_ok, 0, 1);
atomic_t g_busy_flag = ATOMIC_INIT(0);
@@ -73,6 +84,13 @@ bool ble_init(void) {
settings_load();
}
+#if defined(CONFIG_BT_DIS_FW_REV)
+ settings_runtime_set("bt/dis/fw", APP_VERSION_STR, sizeof(APP_VERSION_STR));
+#endif
+#if defined(CONFIG_BT_DIS_SW_REV)
+ settings_runtime_set("bt/dis/sw", APP_VERSION_STR, sizeof(APP_VERSION_STR));
+#endif
+
err = service_init(bt_receive_cb);
if (err) {
LOG_ERR("Failed to initialize UART service (err: %d)", err);
Why this scored 24/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.