I could do that, but I’m using the built in Bluetooth on my desktop. Honestly, I’m just annoyed with Bluetooth and windows. Everything else not based on Windows work completely fine, from macOS to my multiple linux desktops
That's like arguing graphics suck in Linux compared to Windows because your 4090 in Windows works great but your CGA adapter you use on your one Linux desktop isn't that great. You're not doing a real comparison of like hardware, you're comparing different adapters across different OSes.
True, but I can’t feasibly rip out my wireless adaptor on my motherboard and connect it to my Mac.
Linux was running on the same hardware that windows was because I wanted to utilize my 4090 for some machine learning projects, so yes, there was an apples to apples comparison
I could do that, but I’m using the built in Bluetooth on my desktop. Honestly, I’m just annoyed with Bluetooth and windows. Everything else not based on Windows work completely fine, from macOS to my multiple linux desktops
Are your Mac and Linux desktops using the same Bluetooth adapter as your Windows machines? If not, then maybe you do have an adapter issue and it's not the OS.
Linux and Windows are on the same machine. I can’t rip out my motherboard’s adaptor to connect it to my Macs
How in the world is this a CVSS 8.8 if this is the case? What a waste of everyone's time if this is true.
Ctrl+alt+t (insert malicious shell command)
That is only part of the CVSS scoring system. Not only do you need near-physical access (i.e. not open to the internet, already drops the rating significantly), it requires the victim to interact with a suspicious prompt, which basically drops it to the level of a phishing email (i.e. not CVSS 8.8).
I had to dig a little to figure this out, so, to keep yourself safe: Android: disable Bluetooth when you're not using it (but you'll be vulnerable while you are). My Pixel just got the 12/5/2023 security update, which fixes the issue; not sure about non-Pixel phones. Linux: Open up /etc/bluetooth/input.conf and set ClassicBondedOnly=true (in my case I just had to uncomment this, not add anything). The next version of…
I know it's a popular trope on HN to say nothing on Windows ever works but anecdotally I've been using Bluetooth on windows for over 10 years now from 7 to 11, and never had any issues whatsoever that were related to Windows itself. The only issues I have are Bluetooth disappears after wake from sleep which after research appears to be due to buggy firmware of the Mediatek network card installed in the laptop and not…
I’ve had a ton issues on Windows with Bluetooth and I know it’s not the hardware because on Linux it works fine. My Xbox Series controller is the biggest issue. For instance will not automatically reconnect when I pair it the first time and then disconnect. On the next turn on of the controller, it never finds the PC and connects. Windows then has no push for me to press to connect. I have to delete the controller an…
I understand the desire to use Bluetooth, but there is a (relatively) cheap $20 adapter that uses a protocol and frequency more similar to WiFi I believe (like arctis gaming headsets if you’ve ever used those) which works much better. My experience with Bluetooth has always worked as far as connecting is concerned, but I had to use a TP Link Bluetooth adapter and disabled the motherboard Bluetooth to tell windows to use TP (it won’t assume for you). Even after being connected, I don’t think standard Bluetooth has the proper latency and bandwidth for the controller to work reliably in a crowded airspace (I live in an apartment). I will get small skips and latency spikes from time to time. The Xbox adaptor for PC makes it work basically just as effectively as connecting to an Xbox, with the only caveat being it will overheat pretty easily if you place it near an exhaust vent on the PC and are pumping hot air all around it. I put it on the front of my case and it stays cool enough there to work reliably.
Can someone walk me through the process of exploiting Android or iOS with this? I never attached a keyboard to my phones. How do I get to the app store and download an app using just the keyboard? On iOS it requires the fingerprint if I remember correctly, at least on mine. But it's for work and I do mostly very basic stuff with it, so I could be wrong.
On Android for free apps I believe the default is no password confirmation
Assuming recent versions, you could press home + type "Play Store" to search and open the app, search for something and install without a password, assuming an unatended device, in my phone at least you can click to wake up the screen
I'm going to guess that Apple made some decisions here to trade off security for usability so the Magic Keyboard can "work like magic" regardless of what stage of the boot cycle, recovery mode, etc the computer is in, and this vulnerability takes advantage of that. Looks like this has just been fixed in iOS/macOS.
If your hypothesis is correct, that Apple traded security for usability, then if the security is fixed the keyboard must be less usable, right?
Or, if no usability is lost, then maybe the hypothesis isn't correct.