Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bluetooth keystroke-injection in Android, Linux, macOS and iOS

github.com

Post reply on HN
Print view View original

11–20 of 265 posts

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#11

Post by MBCook »

kccqzy wrote: post #6
SpikeDad wrote: post #4

Well iOS and macOS are only vulnerable in a very narrow range of conditions. On the other hand Android is a field day. And I believe these were patched in the current versions of iOS and macOS.

I read the original article to find the narrow range of conditions. It states "iOS and macOS are vulnerable when Bluetooth is enabled and a Magic Keyboard has been paired with the phone or computer" so does this mean if a computer has ever paired with a Magic Keyboard, it would allow itself to be paired with additional keyboards that the user did not want to pair? As someone who has bought multiple Magic Keyboards, t…

I’m sort of assuming the Magic Keyboard has to be present, but we don’t know that based on the write up. It’s a great question though. All desktop Macs come pre-paired with a Magic Keyboard even if you never use it. so if the keyboard doesn’t have to be actively connected at the time that would make them all vulnerable unless someone had unpaired them.

The other thing that wasn’t clear to me is if the vulnerability exists if a Magic Keyboard isn’t in the mix. If I have never paired one to my laptop and instead I am use a different brand of Bluetooth keyboard is it still a problem?

In other words is this Magic Keyboard specific? I’m assuming the author had other Bluetooth keyboards. Of course even if it is that doesn’t mean there aren’t other vulnerabilities lurking in iOS/macOS in this area.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#12

Post by jeffbee »

DiabloD3 wrote: post #9

Honestly, I'm not surprised. Bluetooth is an unsecured microcontroller that does not run an open source firmware (and yes, I'm aware, the CVE is partially enabled by the software stack as well). By definition, that is a security nightmare. I don't generally use Bluetooth devices in my house. Between the security nightmare aspect and the fact that it's always a worse end user experience than just going wired (no dropp…

For some reason Bluetooth has to be enabled for Android Auto to work, even though it's wired, so I leave it enabled. But there should be a way to just disable keyboards categorically, for phones.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#13

Post by MBCook »

jeroenhd wrote: post #7
amluto wrote: post #5

Earlier quoted context omitted.

Maybe lazy convenience vs security? Apple has a rather nice, convenient way to pair a keyboard that ought to resist unauthenticated injection. The issues here appear to just be bugs.

According to the write-up, the vulnerability itself was fixed years ago in BlueZ, but left disabled by default for compatibility. I'm not sure about the macOS vulnerability, but at least on the Linux side, usability beat security.

> According to the write-up, the vulnerability itself was fixed years ago in BlueZ

That’s the BlueZ vulnerability. Which is certainly different from the iOS/macOS vulnerability given Apple has their own BT stack.

The decision made by the Linux kernel developers and distribution maintainers not to enable the fix by default is theirs. It doesn’t imply anything about Apple’s behavior.

If Apple wasn’t aware of this, they couldn’t have made a security/convenience decision at all.

Without knowing more it seems like jumping to conclusions. The Linux maintainers may have made a reasonable decision based on possible fallout from breaking lots of devices.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#16

Post by tedunangst »

MBCook wrote: post #11
kccqzy wrote: post #6

Earlier quoted context omitted.

I read the original article to find the narrow range of conditions. It states "iOS and macOS are vulnerable when Bluetooth is enabled and a Magic Keyboard has been paired with the phone or computer" so does this mean if a computer has ever paired with a Magic Keyboard, it would allow itself to be paired with additional keyboards that the user did not want to pair? As someone who has bought multiple Magic Keyboards, t…

I’m sort of assuming the Magic Keyboard has to be present, but we don’t know that based on the write up. It’s a great question though. All desktop Macs come pre-paired with a Magic Keyboard even if you never use it. so if the keyboard doesn’t have to be actively connected at the time that would make them all vulnerable unless someone had unpaired them. The other thing that wasn’t clear to me is if the vulnerability e…

Alas, merely guessing, but it sounds like you can tell an apple device "I am the magic keyboard you know and trust" and it will believe you.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#17

Post by lxgr »

DiabloD3 wrote: post #9

Honestly, I'm not surprised. Bluetooth is an unsecured microcontroller that does not run an open source firmware (and yes, I'm aware, the CVE is partially enabled by the software stack as well). By definition, that is a security nightmare. I don't generally use Bluetooth devices in my house. Between the security nightmare aspect and the fact that it's always a worse end user experience than just going wired (no dropp…

As is the baseband, or the Wi-Fi chip, or most of the other components in a modern phone.

Proper hardware isolation (e.g. using IOMMUs) should be able to mitigate many of the resulting problems – and if the OS can be compromised using the software driver stack, that is indeed a problem of the OS/driver.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#19

Post by wtallis »

tedunangst wrote: post #16
MBCook wrote: post #11

Earlier quoted context omitted.

I’m sort of assuming the Magic Keyboard has to be present, but we don’t know that based on the write up. It’s a great question though. All desktop Macs come pre-paired with a Magic Keyboard even if you never use it. so if the keyboard doesn’t have to be actively connected at the time that would make them all vulnerable unless someone had unpaired them. The other thing that wasn’t clear to me is if the vulnerability e…

Alas, merely guessing, but it sounds like you can tell an apple device "I am the magic keyboard you know and trust" and it will believe you.

Wouldn't that require knowing/guessing/brute-forcing a unique device identifier that's probably not available to be sniffed if the genuine keyboard in question isn't in use?

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#20

Post by wtallis »

jeffbee wrote: post #12
DiabloD3 wrote: post #9

Honestly, I'm not surprised. Bluetooth is an unsecured microcontroller that does not run an open source firmware (and yes, I'm aware, the CVE is partially enabled by the software stack as well). By definition, that is a security nightmare. I don't generally use Bluetooth devices in my house. Between the security nightmare aspect and the fact that it's always a worse end user experience than just going wired (no dropp…

For some reason Bluetooth has to be enabled for Android Auto to work, even though it's wired, so I leave it enabled. But there should be a way to just disable keyboards categorically, for phones.

Doesn't Android Auto carry audio over Bluetooth? That would be consistent with how unreliable the audio is.
Post reply on HN