Note that this was fixed in macOS 14.2 and iOS 17.2:
Bluetooth keystroke-injection in Android, Linux, macOS and iOS
201–210 of 265 posts
Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS
#202Earlier quoted context omitted.
I've experienced Bluetooth issues like that before on Windows. 100% of the time it's been solved by using a better Bluetooth adapter. I don't have any issues after using actually good Bluetooth adapters, such as modern Intel ones.
I could do that, but I’m using the built in Bluetooth on my desktop. Honestly, I’m just annoyed with Bluetooth and windows. Everything else not based on Windows work completely fine, from macOS to my multiple linux desktops
Are your Mac and Linux desktops using the same Bluetooth adapter as your Windows machines? If not, then maybe you do have an adapter issue and it's not the OS.
Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS
#203My DivestOS patched this on Android 7 through 13 in the December update: https://divestos.org/pages/patch_counts
Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS
#204I had to dig a little to figure this out, so, to keep yourself safe: Android: disable Bluetooth when you're not using it (but you'll be vulnerable while you are). My Pixel just got the 12/5/2023 security update, which fixes the issue; not sure about non-Pixel phones. Linux: Open up /etc/bluetooth/input.conf and set ClassicBondedOnly=true (in my case I just had to uncomment this, not add anything). The next version of…
Too bad iOS makes it very hard to disable bluetooth. Android was swipe+click, iOS it's swipe, two long presses, two clicks. Or you can type it, but that's obviously more clicks (though possibly faster). I used to make the effort when I switched from Android, but I already gave up...
On iOS you can scroll diagonally from top right corner and one more click to disable it.
It is not permanent and comes back when disabling airplane mode, in addition to updates too.
Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS
#205Bluetooth is the gift that keeps on giving. Not sure why my Ubuntu insists on enabling it on every boot, at least on my hardware. Good thing PC peripherals moved away from this junk. It was fascinating watching Logitech sell 300 euro BT keyboard with literally a second of lag, or "high end" mice with 500ms or more. Hell, I barely use my PS5 controller because it sucks ass compared to my old Xbox 360 pad. Lag, lag, la…
That’s considerably worse than most people experience - keyboard latency is normally under 15ms - and I think that’s part of the problem there: if you live somewhere with a lot of congestion from other devices, poorly shielded microwave ovens, etc. you have a legitimately terrible experience but it’s not common enough for it to actually get fixed since it doesn’t impact sales.
Pretty sure you have forgotten or never experienced the awful bt devices from 15 years ago. Or maybe latency is not a big issue for you.
Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS
#206Earlier quoted context omitted.
Side note, have you tried a firmware update with the Xbox controller, inside the Xbox app for Windows? It helped me a lot, especially earlier generation / early production units. (But yes, I always have issues with Bluetooth on Windows too)
I have, it’s on the latest firmware from the Xbox app. Still have these issues, the Xbox controller is just the biggest thing, my Sony headphones also have issues with Windows. All of my coworkers have issues with anything regarding Bluetooth on Windows too
Yeah, I feel ya :/ My Xbox controller works better on a Mac than it ever it did on my Surface Book. Ironic.
Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS
#207Earlier quoted context omitted.
Do you only use your port on Android for charging? It's also super useful for HDMI. And, yeah, peripherals. I don't consider that a vulnerability though. It's just useful. The problem here is someone can do it without you noticing them and while you're using it for sensitive things. https://mitxela.com/projects/smsc this cool project from yesterday he was able to use on his phone that way.
Perhaps you missed that "charging only" is a setting for when you really only want to allow charging when the charger is sus? At any other time, sure, get wild.
You said a "charging only" port, thanks for the clarification. I interpreted that as the physical port, not an android setting to filter communications on the port. I don't think I'd ever trust a random cable even with an OS config setting.
BTW. physical port charging only ports do exist.. Still wouldn't trust 'em w/ random cables though. Other end might deliver too much power if nothing else.
Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS
#208I had to dig a little to figure this out, so, to keep yourself safe: Android: disable Bluetooth when you're not using it (but you'll be vulnerable while you are). My Pixel just got the 12/5/2023 security update, which fixes the issue; not sure about non-Pixel phones. Linux: Open up /etc/bluetooth/input.conf and set ClassicBondedOnly=true (in my case I just had to uncomment this, not add anything). The next version of…
iOS:
https://support.apple.com/en-us/HT214035
macOS: https://support.apple.com/en-us/HT214035
Both say:
> Impact: An attacker in a privileged network position may be able to inject keystrokes by spoofing a keyboard Description: The issue was addressed with improved checks.
Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS
#209Earlier quoted context omitted.
> Too bad iOS makes it very hard to disable bluetooth. Depending on whether you have the Settings icon on your Home Screen, that’s three taps (Settings -> Bluetooth -> Off). Not even any scrolling.
You can make a shortcut with the action Toggle and set Bluetooth
I’m trying this now and can’t figure this out. I’ve been trying for months now.
I’m adding a new action, I search toggle and Bluetooth and I’m not getting any actions to set Bluetooth. What am I doing wrong? Edit: Scratch that! I figured it out! Realised I wanted a way to connect to a Bluetooth device (my flaky headphones don’t always connect, pain to dig into the settings every time)
Re: Bluetooth keystroke-injection in Android, Linux, macOS and iOS
#210Earlier quoted context omitted.
Too bad iOS makes it very hard to disable bluetooth. Android was swipe+click, iOS it's swipe, two long presses, two clicks. Or you can type it, but that's obviously more clicks (though possibly faster). I used to make the effort when I switched from Android, but I already gave up...
On iOS you can scroll diagonally from top right corner and one more click to disable it. It is not permanent and comes back when disabling airplane mode, in addition to updates too.
The toggle in control centre does not disable Bluetooth. It disconnects Bluetooth until tomorrow. It even says that in control centre when you tap on the toggle.