Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bluetooth keystroke-injection in Android, Linux, macOS and iOS

github.com

Post reply on HN
Print view View original

181–190 of 265 posts

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#181

Post by lxgr »

rplnt wrote: post #62
kelnos wrote: post #46

I had to dig a little to figure this out, so, to keep yourself safe: Android: disable Bluetooth when you're not using it (but you'll be vulnerable while you are). My Pixel just got the 12/5/2023 security update, which fixes the issue; not sure about non-Pixel phones. Linux: Open up /etc/bluetooth/input.conf and set ClassicBondedOnly=true (in my case I just had to uncomment this, not add anything). The next version of…

Too bad iOS makes it very hard to disable bluetooth. Android was swipe+click, iOS it's swipe, two long presses, two clicks. Or you can type it, but that's obviously more clicks (though possibly faster). I used to make the effort when I switched from Android, but I already gave up...

To be fair, the default behavior does exactly what I want: Disconnect me from a broken Wi-Fi network/Bluetooth headphone/speaker implementation that is hijacking my audio output, without breaking "Find My", Airdrop or Wi-Fi geolocation.

AirPods can stay connected, which is maybe unfair towards third-party vendors, but they also don't insist on connecting to all paired devices at once and usually pick the two wrong ones and steal audio from whoever in my home is using that device at the moment.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#182

Post by capitainenemo »

rini17 wrote: post #145

By the way, USB is similar. If you connect a keyboard to "charging only" port, it works. Tried myself on Android. Was told off here it's supposedly not practically exploitable.

Do you only use your port on Android for charging? It's also super useful for HDMI. And, yeah, peripherals. I don't consider that a vulnerability though. It's just useful. The problem here is someone can do it without you noticing them and while you're using it for sensitive things.

https://mitxela.com/projects/smsc this cool project from yesterday he was able to use on his phone that way.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#183

Post by layer8 »

maxerickson wrote: post #178
layer8 wrote: post #170

> I'm really not sure what sort of wireless keyboard to recommend at this point. If you are reading this and you make a secure wireless keyboard, please send me one so I can hack it for you. Do I understand this correctly that the attack requires a vulnerable keyboard to be actively connected to the device? But the fix for the vulnerability is on the device side, not the keyboard side?

It's a reference back to where they stated that they used to recommend Bluetooth wireless keyboards. These attacks only involve keyboards to the extent that Apple devices have to be paired with a keyboard for them to work.

“Paired” in the sense of “the device knows this particular keyboard because it has been paired with it at some point in the past”, or in the sense of “currently connected”?

Secondly, it’s still not clear to me how a “secure” keyboard would solve the problem if the vulnerability is on the device side (which it seems to be given that it can be fixed there).

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#184

Post by CamperBob2 »

judge2020 wrote: post #124
sumuyuda wrote: post #83

Earlier quoted context omitted.

I had to create custom shortcuts to disable WiFi and Bluetooth after Apple made the ones from Control Center useless.

It makes sense for most people. When they want to turn those off they want to either disconnect from WiFi or disconnect from Bluetooth audio, and they don’t expect things like airdrop or their Apple Watch to stop working when they turn them off.

Sounds like an excellent opportunity for a UI affordance to me. Instead, Apple has chosen the path of least-yet-most-unpleasant surprise.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#185

Post by maxerickson »

layer8 wrote: post #183
maxerickson wrote: post #178

Earlier quoted context omitted.

It's a reference back to where they stated that they used to recommend Bluetooth wireless keyboards. These attacks only involve keyboards to the extent that Apple devices have to be paired with a keyboard for them to work.

“Paired” in the sense of “the device knows this particular keyboard because it has been paired with it at some point in the past”, or in the sense of “currently connected”? Secondly, it’s still not clear to me how a “secure” keyboard would solve the problem if the vulnerability is on the device side (which it seems to be given that it can be fixed there).

A wireless keyboard that didn't use Bluetooth wouldn't be vulnerable to this.

I didn't really try to figure it out, but I expect paired in the sense of paired, not connected. Sounds like ios toggles a setting for HID when you pair the magic keyboard an becomes vulnerable to this.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#186

Post by aydyn »

hexfish wrote: post #105
aydyn wrote: post #53

Earlier quoted context omitted.

I don’t see how people can STILL use wired nowdays. It’s so much less desk clutter and vastly better aesthetics to go full wireless. Charging is not an issue, get some Logitech that lasts months if not years.

Not everyone cares about the aesthetics of their tools or shares your sense of aesthetics (minimalism). Furthermore: OP and things like mousejack are exactly tbe reason why some people will not use a wireless input device. Keyboards are used to enter secrets so they rank pretty high in my threat model.

That sounds a little paranoid, especially when you have options for factory paired keyboard/dongle encryption.

And aesthetics? This is a forum that tirelessly obsesses over micro usb vs usb-c. Wired is de facto obsolete afaiac.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#187

Post by layer8 »

maxerickson wrote: post #185
layer8 wrote: post #183

Earlier quoted context omitted.

“Paired” in the sense of “the device knows this particular keyboard because it has been paired with it at some point in the past”, or in the sense of “currently connected”? Secondly, it’s still not clear to me how a “secure” keyboard would solve the problem if the vulnerability is on the device side (which it seems to be given that it can be fixed there).

A wireless keyboard that didn't use Bluetooth wouldn't be vulnerable to this. I didn't really try to figure it out, but I expect paired in the sense of paired, not connected. Sounds like ios toggles a setting for HID when you pair the magic keyboard an becomes vulnerable to this.

If it’s “paired” in the first sense, then merely using a non-Bluetooth keyboard is not sufficient, you also have to make sure to unpair any previously paired Bluetooth devices. It would therefore seem important to find out what precisely is the case.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#188

Post by rini17 »

capitainenemo wrote: post #182
rini17 wrote: post #145

By the way, USB is similar. If you connect a keyboard to "charging only" port, it works. Tried myself on Android. Was told off here it's supposedly not practically exploitable.

Do you only use your port on Android for charging? It's also super useful for HDMI. And, yeah, peripherals. I don't consider that a vulnerability though. It's just useful. The problem here is someone can do it without you noticing them and while you're using it for sensitive things. https://mitxela.com/projects/smsc this cool project from yesterday he was able to use on his phone that way.

Perhaps you missed that "charging only" is a setting for when you really only want to allow charging when the charger is sus? At any other time, sure, get wild.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#189

Post by Aachen »

magicalhippo wrote: post #158
Aachen wrote: post #148

Earlier quoted context omitted.

> surely I'd see the activity of the keystrokes being sent when using my device, no? That was my first thought as well. Then I remembered how much time my device spends in my pocket or on my nightstand

Right, but can it enter keystrokes when the device is locked? As in use the device "behind" the lock screen?

I don't have a device lock because I keep the thing on my body and anyone violating that will also get the password anyhow and I don't want to have to authenticate a million times a day. That logic worked until now I guess :/
Post reply on HN