Live data from Hacker News

Bluetooth keystroke-injection in Android, Linux, macOS and iOS

github.com

261–265 of 265 posts

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#261
post #117

Earlier quoted context omitted.

Google won't let you use GPS for maps without also turning on wifi for similar reasons I guess. It does make it more accurate but shouldn't be required.

That's nonsense, Maps works perfectly fine with wifi off

They might have changed it again, but it was a thing, I saw the prompts mentioned here too:

https://news.ycombinator.com/item?id=30167865

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#262

Earlier quoted context omitted.

I always hated that after an ios update bluetooth always came back as enabled... when I never actually used it... this puzzled me for a long time...... also, the emmentaler like wifi cannot be fully turned off from the control panel either

You can turn off WiFi from the settings. Dunno it it’ll come back on again after updating. The control panel only disables WiFi until the next day.

Theoretically, you can.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#263

Earlier quoted context omitted.

You can turn off WiFi from the settings. Dunno it it’ll come back on again after updating. The control panel only disables WiFi until the next day.

Theoretically, you can.

What can you do theoretically?

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#264
post #145

By the way, USB is similar. If you connect a keyboard to "charging only" port, it works. Tried myself on Android. Was told off here it's supposedly not practically exploitable.

What Android device are you using that has a physical "charging only" port?

Not physical, software switch.

Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS

#265
post #71

> The Linux vulnerability was fixed in 2020 (CVE-2020-0556), but the fix was left disabled by default. ChromeOS is the only Linux-based OS known to have enabled the fix, even though it was announced by Ubuntu, Debian, Fedora, Gentoo, Arch and Alpine.

Took all of 30 seconds to verify it's in NixOS[1]. Another 30 seconds to see it was patched a week ago, at "Dec 8, 2023, 8:23 AM GMT+13", a day after the article was published (Dec 7, 2023, 10:18 AM GMT+13). :shrug: Also, what do they even mean, if the distro announcement says to simply upgrade to fix it[2]? Do they mean that even after the upgrade you need to manually change a setting? Because the NixOS fix seems to…

The NixOS change seems to be still stuck in staging-23.11, and not released:

    $ git log --grep=CVE-2023-45866 origin/nixos-23.11
    $ git log --grep=CVE-2023-45866 origin/staging-23.11 ^origin/nixos-23.11
    commit 8ba508ba10d27f61fe9f40eb8513d8d0864fbe14
    Merge: f5cf92f30bd7 8fb1486901a3
    Author: Martin Weinelt 
    Date:   2023-12-11 13:02:10 +0100
    
        Merge pull request #272751 from leona-ya/backport-272672-to-staging-23.11
    
        [Backport staging-23.11] bluez: apply patch for CVE-2023-45866
    
    commit 8fb1486901a3f4e7cbdee5616f7d1a39a5dc7a99
    Author: Leona Maroni 
    Date:   2023-12-07 13:44:59 +0100
    
        bluez: apply patch for CVE-2023-45866
    
        (cherry picked from commit 7d7f66dfba9f239f15aaec6512afb3443bbae915)
Post reply on HN