Marc Newlin has identified a vulnerability MouseJack seven years ago, revealing information about a similar vulnerability (CVE-2023-45866), affecting Bluetooth stacks on Android, Linux, macOS, and iOS. This vulnerability allows key press spoofing through simulating activity from an input device connected via Bluetooth. Gaining access to the keyboard input, an attacker can perform various actions such as executing commands in the system, installing applications, and redirecting messages.
The vulnerability is caused by host HID (Human Interface Device) drivers for Bluetooth devices which have a mode that allows a remote peripheral device to create and establish encrypted connections without authentication. Such connected devices can transmit keyboard messages, which the HID stack processes, creating an opportunity for an HID message spoofing attack that can be conducted without user involvement. This attack can be executed from up to 100 meters away from the victim.
The device pairing mechanism without authentication is defined in the Bluetooth specification, and depending on the settings of the Bluetooth stack, it allows the connection of a device without user confirmation. For example, on Linux, when using the BlueZ Bluetooth stack, a hidden pairing can occur if the Bluetooth adapter is set to discovery and connect mode. On Android, it is sufficient to enable Bluetooth support. On iOS and macOS, Bluetooth must be enabled, and a wireless keyboard must be connected for a successful attack.
The ability to spoof input was demonstrated on Ubuntu 18.04, 20.04, 22.04, and 23.10 using a Bluetooth stack based on the BlueZ package. ChromeOS is not susceptible to the vulnerabilities, as its Bluetooth stack settings do not permit connections without authentication. On Android, the vulnerability affects devices with platform versions from 4.2.2 to 14. On macOS, the vulnerability was demonstrated on a 2022 MacBook Pro with Apple M2 processor and macOS 13.3.3, as well as on a 2017 MacBook Air with Intel processor and macOS 12.6.7. On iOS, the vulnerability was demonstrated on an iPhone SE with iOS 16.6. Enabling Lockdown mode does not protect against attacks on macOS and iOS.
On Linux, the vulnerability was resolved in the Bluez codebase by setting the 'ClassicBondedOnly' option to true, which enables a safe mode that allows connections to be established only after pairing. Previously, it was set to false, which lowered the security level for compatibility with certain input devices.
In the Fluoride Bluetooth stack used in the latest versions of Android, the vulnerability has been addressed by mandating authentication for all encrypted connections. Fixes for Android were released only for branches 11-14. For Pixel devices, the vulnerability was resolved in the December firmware update. For Android releases from 4.2.2 to 10, the vulnerability remains unpatched.
Source: linux.org.ru
