Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bluetooth keystroke-injection in Android, Linux, macOS and iOS

github.com

Post reply on HN
Print view View original

81–90 of 265 posts

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#81

Post by iforgotpassword »

phendrenad2 wrote: post #65

I doubt this is practical for use against phones or computers, but if you're responsible for keeping people from messing with kiosks your life just got more interesting.

I had accidentally exposed a Linux machine with a passwordless vnc to the Internet a good decade ago. A few minutes in I got someone connecting trying to run stuff via automated keystrokes that were obviously targeting Windows. You only need to successfully get a backdoor in and work from there.

In targeted cases it might be enough to send a shift key-press every minute to avoid a screen lock kicking in so you can approach the machine yourself later and "do something".

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#82

Post by aYsY4dDQ2NrcNzA »

shzhdbi09gv8ioi wrote: post #60
kelnos wrote: post #47

Earlier quoted context omitted.

I never really understood the benefits of a wireless keyboard. Do people usually carry their keyboard from their desk with them when they take their laptop somewhere else? I guess I could maybe -- maybe -- see the convenience if you have some sort of small-form-factor keyboard that you stash in your bag. But still, the wire doesn't seem like much of a burden, and personally I'd find the annoyance of needing to ensure…

My cats insist on sleeping on the desk, so wireless keyboard & mouse is a must for me so I can navigate around cats. They all is USB-C charged so I use a single charger cable for macbook, gaming controller, keyboard and mouse.

Which is how a cat chose your username. I know how that feels.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#83

Post by sumuyuda »

rplnt wrote: post #62
kelnos wrote: post #46

I had to dig a little to figure this out, so, to keep yourself safe: Android: disable Bluetooth when you're not using it (but you'll be vulnerable while you are). My Pixel just got the 12/5/2023 security update, which fixes the issue; not sure about non-Pixel phones. Linux: Open up /etc/bluetooth/input.conf and set ClassicBondedOnly=true (in my case I just had to uncomment this, not add anything). The next version of…

Too bad iOS makes it very hard to disable bluetooth. Android was swipe+click, iOS it's swipe, two long presses, two clicks. Or you can type it, but that's obviously more clicks (though possibly faster). I used to make the effort when I switched from Android, but I already gave up...

I had to create custom shortcuts to disable WiFi and Bluetooth after Apple made the ones from Control Center useless.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#84

Post by rplnt »

sumuyuda wrote: post #83
rplnt wrote: post #62

Earlier quoted context omitted.

Too bad iOS makes it very hard to disable bluetooth. Android was swipe+click, iOS it's swipe, two long presses, two clicks. Or you can type it, but that's obviously more clicks (though possibly faster). I used to make the effort when I switched from Android, but I already gave up...

I had to create custom shortcuts to disable WiFi and Bluetooth after Apple made the ones from Control Center useless.

Is it possible to do for Location as well? Last time I tried to search for it, it really wasn't possible except through Siri somehow.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#85

Post by atoav »

TylerE wrote: post #74
atoav wrote: post #70

Earlier quoted context omitted.

So you are saying this is not true? You mean they got Google to react to a made up vulnerability? Did you even read the text?

They’re not talking about this. They’re talking about the NameDrop feature added in iOS 17. The one with multiple confirmation steps, while the facebook memes talk like hackers can steal your info from long range with no intervention. https://www.snopes.com/fact-check/iphone-namedrop-warning/

Ah thanks for the context

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#86

Post by SCdF »

ComodoHacker wrote: post #75
exikyut wrote: post #25

This doesn't mention Windows at all. That sounds great on the surface, but it would be really helpful to understand why Windows is not actually at fault so I can better measure the risk profile. For example, knowing that the Windows Bluetooth stack has the architectural equivalent of BlueZ's `ClassicBondedOnly=false` would be really helpful to know; that would tell me to keep an eye out for it being `true` in environ…

I believe it's because they just didn't bother trying this on Windows (yet)

Do you believe that, or do you actually know that because he said it somewhere?

If you look at the linux patch[1] it's a case of bad defaults. So maybe Windows just has good defaults?

[1] https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/pr...

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#87

Post by [deleted] »

aYsY4dDQ2NrcNzA wrote: post #82
shzhdbi09gv8ioi wrote: post #60

Earlier quoted context omitted.

My cats insist on sleeping on the desk, so wireless keyboard & mouse is a must for me so I can navigate around cats. They all is USB-C charged so I use a single charger cable for macbook, gaming controller, keyboard and mouse.

Which is how a cat chose your username. I know how that feels.

[deleted]

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#88

Post by rezonant »

dotancohen wrote: post #64
dotancohen wrote: post #63

Earlier quoted context omitted.

What phone? Can you not disable Bluetooth when you are not using the keyboard? Can Bluetooth HID be disabled without disabling e.g. audio devices (breasts).

TIL that "headsets" and "breasts" are close enough on the qwerty keyboard to confuse swiping keyboards.

Usually breasts aren't audio devices, but it does occasionally happen. Good luck finding some with Bluetooth support though.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#89

Post by wkipling »

exikyut wrote: post #25

This doesn't mention Windows at all. That sounds great on the surface, but it would be really helpful to understand why Windows is not actually at fault so I can better measure the risk profile. For example, knowing that the Windows Bluetooth stack has the architectural equivalent of BlueZ's `ClassicBondedOnly=false` would be really helpful to know; that would tell me to keep an eye out for it being `true` in environ…

Because Bluetooth barely works normally for Windows

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#90

Post by stavros »

strogonoff wrote: post #55
kelnos wrote: post #47

Earlier quoted context omitted.

I never really understood the benefits of a wireless keyboard. Do people usually carry their keyboard from their desk with them when they take their laptop somewhere else? I guess I could maybe -- maybe -- see the convenience if you have some sort of small-form-factor keyboard that you stash in your bag. But still, the wire doesn't seem like much of a burden, and personally I'd find the annoyance of needing to ensure…

A laptop by default is not suitable for working any substantial length of time due to the fixed coupling between its screen and keyboard. Separating them—so that you can relax while keeping your screen roughly at your eye level and at comfortable distance, and your elbows bent at comfortable 90 degrees (or more)—gets you 80% there in terms of ergonomics. You could carry around a portable display, but that might be a…

I find the notion that wires are less reliable than wireless extremely contrary to my own experience.
Post reply on HN