Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bluetooth keystroke-injection in Android, Linux, macOS and iOS

github.com

Post reply on HN
Print view View original

171–180 of 265 posts

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#171

Post by FirmwareBurner »

givinguflac wrote: post #125
360MustangScope wrote: post #112

Earlier quoted context omitted.

I’ve had a ton issues on Windows with Bluetooth and I know it’s not the hardware because on Linux it works fine. My Xbox Series controller is the biggest issue. For instance will not automatically reconnect when I pair it the first time and then disconnect. On the next turn on of the controller, it never finds the PC and connects. Windows then has no push for me to press to connect. I have to delete the controller an…

For what it’s worth, I had a similar experience with my old Xbox controller. I bought a new one and the issue went away.

Could be one of two issues here. Either your old controller could have been faulty, or the other one, the new controller has a firmware update or HW revision that fixes the issue your old one had. Impossible to know without deeper dives in HW & FW revisions.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#172

Post by [deleted] »

davrosthedalek wrote: post #157
slacka wrote: post #147

Earlier quoted context omitted.

This vulnerability is about injecting keystrokes into connected wireless keyboards and mice.[1] With the phone industry adoption of USB-C, they've made wired easier than ever before. [1] https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/pr...

What does this have to do with the fact that now people have to switch on bluetooth for audio, instead of having a cable connection? And an attack requiring a physical cable connection is a little bit more visible, and less viable if I have my phone in my hand, than a wireless attack via bluetooth, don't you think?

[deleted]

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#174

Post by acidburnNSA »

dotancohen wrote: post #63
acidburnNSA wrote: post #54

Dang it, now I guess I have to toss my out of support android phone that works fine but doesn't support lineage.

What phone? Can you not disable Bluetooth when you are not using the keyboard? Can Bluetooth HID be disabled without disabling e.g. audio devices (breasts).

Oh maybe it can be disabled in Android? I have a smart watch that uses Bluetooth so I don't want to disable it completely. Phone is an old Samsung.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#175

Post by punkybr3wster »

davrosthedalek wrote: post #157
slacka wrote: post #147

Earlier quoted context omitted.

This vulnerability is about injecting keystrokes into connected wireless keyboards and mice.[1] With the phone industry adoption of USB-C, they've made wired easier than ever before. [1] https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/pr...

What does this have to do with the fact that now people have to switch on bluetooth for audio, instead of having a cable connection? And an attack requiring a physical cable connection is a little bit more visible, and less viable if I have my phone in my hand, than a wireless attack via bluetooth, don't you think?

You don’t “have to” switch to only wireless. There are plenty of inexpensive usb-c DACs and even the overpriced Apple usb-c to 3.5mm adapter is a whopping $9.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#176

Post by lofaszvanitt »

kelnos wrote: post #46

I had to dig a little to figure this out, so, to keep yourself safe: Android: disable Bluetooth when you're not using it (but you'll be vulnerable while you are). My Pixel just got the 12/5/2023 security update, which fixes the issue; not sure about non-Pixel phones. Linux: Open up /etc/bluetooth/input.conf and set ClassicBondedOnly=true (in my case I just had to uncomment this, not add anything). The next version of…

I always hated that after an ios update bluetooth always came back as enabled... when I never actually used it... this puzzled me for a long time......

also, the emmentaler like wifi cannot be fully turned off from the control panel either

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#177

Post by solardev »

360MustangScope wrote: post #112
FirmwareBurner wrote: post #103

Earlier quoted context omitted.

I know it's a popular trope on HN to say nothing on Windows ever works but anecdotally I've been using Bluetooth on windows for over 10 years now from 7 to 11, and never had any issues whatsoever that were related to Windows itself. The only issues I have are Bluetooth disappears after wake from sleep which after research appears to be due to buggy firmware of the Mediatek network card installed in the laptop and not…

I’ve had a ton issues on Windows with Bluetooth and I know it’s not the hardware because on Linux it works fine. My Xbox Series controller is the biggest issue. For instance will not automatically reconnect when I pair it the first time and then disconnect. On the next turn on of the controller, it never finds the PC and connects. Windows then has no push for me to press to connect. I have to delete the controller an…

Side note, have you tried a firmware update with the Xbox controller, inside the Xbox app for Windows? It helped me a lot, especially earlier generation / early production units.

(But yes, I always have issues with Bluetooth on Windows too)

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#178

Post by maxerickson »

layer8 wrote: post #170

> I'm really not sure what sort of wireless keyboard to recommend at this point. If you are reading this and you make a secure wireless keyboard, please send me one so I can hack it for you. Do I understand this correctly that the attack requires a vulnerable keyboard to be actively connected to the device? But the fix for the vulnerability is on the device side, not the keyboard side?

It's a reference back to where they stated that they used to recommend Bluetooth wireless keyboards. These attacks only involve keyboards to the extent that Apple devices have to be paired with a keyboard for them to work.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#179

Post by worewood »

wkipling wrote: post #89
exikyut wrote: post #25

This doesn't mention Windows at all. That sounds great on the surface, but it would be really helpful to understand why Windows is not actually at fault so I can better measure the risk profile. For example, knowing that the Windows Bluetooth stack has the architectural equivalent of BlueZ's `ClassicBondedOnly=false` would be really helpful to know; that would tell me to keep an eye out for it being `true` in environ…

Because Bluetooth barely works normally for Windows

I agree. In Windows whenever I need to connect my BT headset I have to re-pair it, otherwise I get just speakers, no mic.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#180

Post by [deleted] »

rplnt wrote: post #62
kelnos wrote: post #46

I had to dig a little to figure this out, so, to keep yourself safe: Android: disable Bluetooth when you're not using it (but you'll be vulnerable while you are). My Pixel just got the 12/5/2023 security update, which fixes the issue; not sure about non-Pixel phones. Linux: Open up /etc/bluetooth/input.conf and set ClassicBondedOnly=true (in my case I just had to uncomment this, not add anything). The next version of…

Too bad iOS makes it very hard to disable bluetooth. Android was swipe+click, iOS it's swipe, two long presses, two clicks. Or you can type it, but that's obviously more clicks (though possibly faster). I used to make the effort when I switched from Android, but I already gave up...

[deleted]
Post reply on HN