Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bluetooth keystroke-injection in Android, Linux, macOS and iOS

github.com

Post reply on HN
Print view View original

251–260 of 265 posts

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#251

Post by acdha »

beebeepka wrote: post #231
acdha wrote: post #218

Earlier quoted context omitted.

Latency is something I notice, but having used Bluetooth since it first came out, 500+ms is either a very noisy radio environment or defective hardware. It’s freakishly outside of normal for the technology - if you were seeing 5ms, maybe 10ms, that’d be within expectations but not even 50ms.

Clearly even modern devices are nowhere near 5ms but hey, let's just agree your perception is more forgiving.

Modern devices should be in the 10-15ms range. If yours are not, return them as defective.

The 5ms I referred to was the difference versus a cable - I’d expect a modern keyboard to be under 10ms and Bluetooth to be under 15ms. Since I’ve measured that the latency for a keystroke to render on screen in VSC at 16-24ms, I’m comfortable saying at least Apple has Bluetooth latency under that level.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#252

Post by mdaniel »

kelnos wrote: post #50
modeless wrote: post #8

> ChromeOS is the only Linux-based OS known to have enabled the fix Once again ChromeOS is showing it cares about security more than seemingly any other end user OS. I think it's really underestimated as a platform.

I would be a lot more supportive of ChromeOS if it wasn't controlled by Google. It seems like it's mainly a vehicle to get students and others hooked on Google services and further normalize Google's brand of ad tracking and surveillance capitalism.

I had such high hopes for FirefoxOS but it got Mozilla-ed

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#253

Post by creer »

maxerickson wrote: post #250
creer wrote: post #228

Earlier quoted context omitted.

Mine says # Defaults to true for security. #ClassicBondedOnly=true (which is the patch indicated)

I don't follow your point.

I was answering yours (perhaps reading it not the way you intended) and the grand parent's "HOWEVER 'ClassicBondedOnly=true' is commented out". No big deal. This style of option and comment and commenting out the option (default or not) is autopilot common - no special intent here.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#254

Post by whelp_24 »

asystole wrote: post #173
tungah wrote: post #133

This is great news now that the industry phased out physical audio connection on phones in favor of wireless. Good job, guys.

USB-C DACs are inexpensive and widely available.

Ah, yes, the dongle, it means you choose between charging or headphones, and your port is more susceptible to damage.

There was no reason to remove it in the first place.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#255

Post by fomine3 »

overstay8930 wrote: post #223
Koffiepoeder wrote: post #57

Earlier quoted context omitted.

Ctrl+alt+t (insert malicious shell command)

That is only part of the CVSS scoring system. Not only do you need near-physical access (i.e. not open to the internet, already drops the rating significantly), it requires the victim to interact with a suspicious prompt, which basically drops it to the level of a phishing email (i.e. not CVSS 8.8).

No victim operation is needed, just type it by automated pseudo HID device

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#256

Post by ranguna »

mihalycsaba wrote: post #109
magicalhippo wrote: post #79

Earlier quoted context omitted.

> Android: disable Bluetooth when you're not using it (but you'll be vulnerable while you are). Page says it only works for stuff that doesn't require password or biometrics. I actively lock my phone when not using it, and surely I'd see the activity of the keystrokes being sent when using my device, no? In that case it doesn't seem that horrible to leave Bluetooth enabled.

Does this even work without pairing?

The vulnerabilities work by tricking the Bluetooth host state-machine into pairing with a fake keyboard without user-confirmation.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#257

Post by joseda-hg »

mr_mitm wrote: post #246
joseda-hg wrote: post #226

Earlier quoted context omitted.

On Android for free apps I believe the default is no password confirmation Assuming recent versions, you could press home + type "Play Store" to search and open the app, search for something and install without a password, assuming an unatended device, in my phone at least you can click to wake up the screen

Can you use "tab" to cycle through UI elements on Android or how would you navigate the app store?

You can, I just tested, 2 tabs + Enter get you writing on the Search Box

A surprising amount of keyboard shortcuts work on android, Alt+Tab works to get Recent Activities, Directional keys let you move aroud elements, even the special keys like home/calculator work

But there's a lot of unintuitive stuff, back button is Windows + Del

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#258

Post by huppeldepup »

yonatan8070 wrote: post #122
huppeldepup wrote: post #96

If you can silently pair to a phone, you can make the phone dial whatever number you want. Recently found this out when connecting the serial terminal to an earbud for repair (it wouldn't auto-connect to the other earbud).

How would you reliably unlock the phone and get to the dialer app? Given how varied home screen layouts are, even an unlocked phone might be hard to attack this way

That's not what I mean. You can instruct the phone - over bluetooth, within the bluetooth functionality - to dial a number. No lock screen or dial app to access.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#259

Post by hmottestad »

lofaszvanitt wrote: post #176
kelnos wrote: post #46

I had to dig a little to figure this out, so, to keep yourself safe: Android: disable Bluetooth when you're not using it (but you'll be vulnerable while you are). My Pixel just got the 12/5/2023 security update, which fixes the issue; not sure about non-Pixel phones. Linux: Open up /etc/bluetooth/input.conf and set ClassicBondedOnly=true (in my case I just had to uncomment this, not add anything). The next version of…

I always hated that after an ios update bluetooth always came back as enabled... when I never actually used it... this puzzled me for a long time...... also, the emmentaler like wifi cannot be fully turned off from the control panel either

You can turn off WiFi from the settings. Dunno it it’ll come back on again after updating.

The control panel only disables WiFi until the next day.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#260

Post by diebeforei485 »

Terretta wrote: post #230
diebeforei485 wrote: post #28

I'm going to guess that Apple made some decisions here to trade off security for usability so the Magic Keyboard can "work like magic" regardless of what stage of the boot cycle, recovery mode, etc the computer is in, and this vulnerability takes advantage of that. Looks like this has just been fixed in iOS/macOS.

If your hypothesis is correct, that Apple traded security for usability, then if the security is fixed the keyboard must be less usable, right? Or, if no usability is lost, then maybe the hypothesis isn't correct.

I have no idea if usability with bluetooth keyboards is affected in different boot states. It certainly isn't affected during normal use, but I don't know about the various recovery modes.

Considering the amount of time they took to release this, I assume they figured out a way to get it to work in those various cases after a lot of engineering effort.

Post reply on HN