Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bluetooth keystroke-injection in Android, Linux, macOS and iOS

github.com

Post reply on HN
Print view View original

101–110 of 265 posts

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#101

Post by amarshall »

rplnt wrote: post #62
kelnos wrote: post #46

I had to dig a little to figure this out, so, to keep yourself safe: Android: disable Bluetooth when you're not using it (but you'll be vulnerable while you are). My Pixel just got the 12/5/2023 security update, which fixes the issue; not sure about non-Pixel phones. Linux: Open up /etc/bluetooth/input.conf and set ClassicBondedOnly=true (in my case I just had to uncomment this, not add anything). The next version of…

Too bad iOS makes it very hard to disable bluetooth. Android was swipe+click, iOS it's swipe, two long presses, two clicks. Or you can type it, but that's obviously more clicks (though possibly faster). I used to make the effort when I switched from Android, but I already gave up...

It’s impossible to permanently disable Bluetooth on iOS. Every iOS update re-enables it.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#102

Post by amarshall »

l0b0 wrote: post #71
nolist_policy wrote: post #69

> The Linux vulnerability was fixed in 2020 (CVE-2020-0556), but the fix was left disabled by default. ChromeOS is the only Linux-based OS known to have enabled the fix, even though it was announced by Ubuntu, Debian, Fedora, Gentoo, Arch and Alpine.

Took all of 30 seconds to verify it's in NixOS[1]. Another 30 seconds to see it was patched a week ago, at "Dec 8, 2023, 8:23 AM GMT+13", a day after the article was published (Dec 7, 2023, 10:18 AM GMT+13). :shrug: Also, what do they even mean, if the distro announcement says to simply upgrade to fix it[2]? Do they mean that even after the upgrade you need to manually change a setting? Because the NixOS fix seems to…

> Do they mean that even after the upgrade you need to manually change a setting?

Yes, that’s what “the fix was left disabled by default” would mean.

It’s good that it’s fixed by default now, but now is not 2020.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#103

Post by FirmwareBurner »

wkipling wrote: post #89
exikyut wrote: post #25

This doesn't mention Windows at all. That sounds great on the surface, but it would be really helpful to understand why Windows is not actually at fault so I can better measure the risk profile. For example, knowing that the Windows Bluetooth stack has the architectural equivalent of BlueZ's `ClassicBondedOnly=false` would be really helpful to know; that would tell me to keep an eye out for it being `true` in environ…

Because Bluetooth barely works normally for Windows

I know it's a popular trope on HN to say nothing on Windows ever works but anecdotally I've been using Bluetooth on windows for over 10 years now from 7 to 11, and never had any issues whatsoever that were related to Windows itself.

The only issues I have are Bluetooth disappears after wake from sleep which after research appears to be due to buggy firmware of the Mediatek network card installed in the laptop and not due to Windows, as the same issue happens at wake from sleep in Ubuntu.

And another issue was due to the device used being a Chinese no-name bootleg e-waste piece of crap off Amazon. Ironically never had any issues with Bluetooth earphones off AliExpress.

So YMMV.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#104

Post by fellerts »

kelnos wrote: post #46

I had to dig a little to figure this out, so, to keep yourself safe: Android: disable Bluetooth when you're not using it (but you'll be vulnerable while you are). My Pixel just got the 12/5/2023 security update, which fixes the issue; not sure about non-Pixel phones. Linux: Open up /etc/bluetooth/input.conf and set ClassicBondedOnly=true (in my case I just had to uncomment this, not add anything). The next version of…

Seems like the flag defaults to true since December 7 (Fedora 38) with bluez v5.70-4:

    $ rpm -q --changelog bluez | grep CVE-2023-45866 -C1
    * Thu Dec 07 2023 Peter Robinson  - 5.70-4
    - Add mitigation for CVE-2023-45866

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#105

Post by hexfish »

aydyn wrote: post #53
kelnos wrote: post #47

Earlier quoted context omitted.

I never really understood the benefits of a wireless keyboard. Do people usually carry their keyboard from their desk with them when they take their laptop somewhere else? I guess I could maybe -- maybe -- see the convenience if you have some sort of small-form-factor keyboard that you stash in your bag. But still, the wire doesn't seem like much of a burden, and personally I'd find the annoyance of needing to ensure…

I don’t see how people can STILL use wired nowdays. It’s so much less desk clutter and vastly better aesthetics to go full wireless. Charging is not an issue, get some Logitech that lasts months if not years.

Not everyone cares about the aesthetics of their tools or shares your sense of aesthetics (minimalism). Furthermore: OP and things like mousejack are exactly tbe reason why some people will not use a wireless input device.

Keyboards are used to enter secrets so they rank pretty high in my threat model.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#106

Post by eviks »

> I was intimidated by Bluetooth at the time, and just sort of assumed it was secure. I didn't try to hack any Bluetooth devices, and I recommended Bluetooth as a secure alternative to the plethora of custom protocols. It never occurred to me that Bluetooth would have trivial keystroke-injection vulnerabilities like the MouseJack protocols, so I never looked.

Oh yeah, intimidation is a strong basis for that myth that somewhere up high in the complex tech stacks there are people who know what they're doing and don't use sticks to prop up the castles built on quicksand

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#108

Post by [deleted] »

eternauta3k wrote: post #98
phendrenad2 wrote: post #65

I doubt this is practical for use against phones or computers, but if you're responsible for keeping people from messing with kiosks your life just got more interesting.

On a computer, you could conceivably hide a poisoned sudo/su somewhere and add it to the $PATH.

[deleted]

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#109

Post by mihalycsaba »

magicalhippo wrote: post #79
kelnos wrote: post #46

I had to dig a little to figure this out, so, to keep yourself safe: Android: disable Bluetooth when you're not using it (but you'll be vulnerable while you are). My Pixel just got the 12/5/2023 security update, which fixes the issue; not sure about non-Pixel phones. Linux: Open up /etc/bluetooth/input.conf and set ClassicBondedOnly=true (in my case I just had to uncomment this, not add anything). The next version of…

> Android: disable Bluetooth when you're not using it (but you'll be vulnerable while you are). Page says it only works for stuff that doesn't require password or biometrics. I actively lock my phone when not using it, and surely I'd see the activity of the keystrokes being sent when using my device, no? In that case it doesn't seem that horrible to leave Bluetooth enabled.

Does this even work without pairing?

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#110

Post by DougBTX »

rplnt wrote: post #62
kelnos wrote: post #46

I had to dig a little to figure this out, so, to keep yourself safe: Android: disable Bluetooth when you're not using it (but you'll be vulnerable while you are). My Pixel just got the 12/5/2023 security update, which fixes the issue; not sure about non-Pixel phones. Linux: Open up /etc/bluetooth/input.conf and set ClassicBondedOnly=true (in my case I just had to uncomment this, not add anything). The next version of…

Too bad iOS makes it very hard to disable bluetooth. Android was swipe+click, iOS it's swipe, two long presses, two clicks. Or you can type it, but that's obviously more clicks (though possibly faster). I used to make the effort when I switched from Android, but I already gave up...

> Too bad iOS makes it very hard to disable bluetooth.

Depending on whether you have the Settings icon on your Home Screen, that’s three taps (Settings -> Bluetooth -> Off). Not even any scrolling.

Post reply on HN