{"id":112094,"date":"2023-12-09T21:10:14","date_gmt":"2023-12-09T19:10:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios-dopuskayushhaya-podstanovku-nazhatij-klavish"},"modified":"2023-12-09T21:10:14","modified_gmt":"2023-12-09T19:10:14","slug":"uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios-dopuskayushhaya-podstanovku-nazhatij-klavish","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios-dopuskayushhaya-podstanovku-nazhatij-klavish","title":{"rendered":"Bluetooth'i plokkide haavatavus Linuxis, macOS-is, Androidis ja iOS-is, mis v\u00f5imaldab klahvivajutuste asendamist","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Marc Newlin, kes seitse aastat tagasi avastas MouseJack haavatavuse, avaldas teavet sarnase haavatavuse (CVE-2023-45866) kohta, mis m\u00f5jutab Androidi, Linuxi, macOSi ja iOSi Bluetoothi steke ning v\u00f5imaldab klahvivajutuste simuleerimist, kasutades Bluetoothi kaudu \u00fchendatud sisendseadmest saadud tegevust. R\u00fcnnaku korral, omades juurdep\u00e4\u00e4su klaviatuuriv\u00e4ljundile, saab r\u00fcndaja sooritada selliseid toiminguid nagu k\u00e4su k\u00e4ivitamine, rakenduste installimine ja s\u00f5numite suunamine. <\/p>\n

Haavatavus tuleneb sellest, et hosti HID (Human Interface Device) draiverid Bluetooth-seadmete jaoks omavad re\u017eiimi, mis v\u00f5imaldab kaugseadmel luua ja kehtestada kr\u00fcpteeritud \u00fchendusi ilma autentimiseta. Muuhulgas v\u00f5ivad sel viisil \u00fchendatud seadmed edastada klaviatuuri teadet ja HID virn t\u00f6\u00f6tleb seda, v\u00f5imaldades korraldada kaug-ehitatud HID-teadete r\u00fcnnakut, mis toimub ilma kasutaja sekkumiseta. R\u00fcnnakut v\u00f5ib l\u00e4bi viia, kui r\u00fcndaja asub kuni 100 meetri kaugusel ohvrist. <\/p>\n

Seadmete paaritamise mehhanism ilma autentimiseta on m\u00e4\u00e4ratletud Bluetoothi spetsifikatsioonis ja s\u00f5ltuvalt Bluetoothi steki seadistustest v\u00f5ib seadme \u00fchendada ilma kasutajalt kinnitust k\u00fcsimata. Linuxis, kasutades BlueZ Bluetoothi steki, peab Bluetoothi adapter olema avastamise ja \u00fchendamise re\u017eiimis. Androidis piisab lihtsalt Bluetoothi toe sissel\u00fclitamisest. iOS-is ja macOS-is peab r\u00fcnnaku teostamiseks olema Bluetooth sisse l\u00fclitatud ja juhtmevaba klaviatuur \u00fchendatud. <\/p>\n

Sisendi simuleerimise v\u00f5imalus on demonstreeritud Ubuntu versioonides 18.04, 20.04, 22.04 ja 23.10, kasutades Bluez paketil p\u00f5hinevat Bluetoothi steki. ChromeOS ei ole haavatav, kuna selle Bluetoothi steki seaded ei luba autentimiseta \u00fchendust. Androidis m\u00f5jutab haavatavus seadmeid, mille platvormi versioonid ulatuvad 4.2.2 kuni 14. macOS-is on haavatavus demonstreeritud 2022. aasta MacBook Pro-s, millel on Apple M2 CPU ja macOS 13.3.3, ning 2017. aasta MacBook Airis Intel CPU-ga ja macOS 12.6.7. iOS-is on haavatavus demonstreeritud iPhone SE-s, milles on iOS 16.6. Lockdown re\u017eiimi sissel\u00fclitamine ei kaitse r\u00fcnnaku eest macOS-is ja iOS-is. <\/p>\n

Linux'is on haavatavaus parandatud Bluez koodeksis, muutes seadistuse «ClassicBondedOnly» v\u00e4\u00e4rtuseks «true», mis aktiveerib turvare\u017eiimi, lubades seadistada \u00fchendusi ainult p\u00e4rast paaritamist. Varem oli seadistus «false», mis ohustas turvalisust, et lahendada \u00fchilduvusprobleeme teatud sisendseadmetega. <\/p>\n

Viimastes Androidi v\u00e4ljaannetes kasutatavas Bluetoothi-kihis Fluoride on haavatavus k\u00f5rvaldatud k\u00f5igi kr\u00fcpteeritud \u00fchenduste autentimise kohustusliku rakendamise kaudu. Androidi parandused on koostatud ainult harudele 11-14. Pixel-seadmetele on haavatavus k\u00f5rvaldatud detsembri tarkvarauuenduses. Androidi v\u00e4ljaannetes alates 4.2.2 kuni 10 j\u00e4\u00e4b haavatavus parandamata.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041c\u0430\u0440\u043a \u041d\u044c\u044e\u043b\u0438\u043d (Marc Newlin), \u0441\u0435\u043c\u044c \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434 \u0432\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c MouseJack, \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u043f\u043e\u0445\u043e\u0436\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2023-45866), \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 Bluetooth-\u0441\u0442\u0435\u043a\u0438 Android, Linux, macOS \u0438 iOS, \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u043d\u0430\u0436\u0430\u0442\u0438\u0439 \u043a\u043b\u0430\u0432\u0438\u0448 \u0447\u0435\u0440\u0435\u0437 \u0441\u0438\u043c\u0443\u043b\u044f\u0446\u0438\u044e \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0432\u0432\u043e\u0434\u0430, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u0433\u043e \u0447\u0435\u0440\u0435\u0437 Bluetooth. \u0418\u043c\u0435\u044f \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043b\u0430\u0432\u0438\u0430\u0442\u0443\u0440\u043d\u043e\u043c\u0443 \u0432\u0432\u043e\u0434\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0442\u0430\u043a\u0438\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u043a \u043a\u043e\u043c\u0430\u043d\u0434 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112094","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus Linuxi, macOS-i, Androidi ja iOS-i Bluetoothi-kihis, mis v\u00f5imaldab klahvivajutuste asendamist | ProHoster","description":"Marc Newlin, kes avastas MouseJack'i haavatavuse seitse aastat tagasi, avaldas teavet sarnase haavatavuse (CVE-2023-45866) kohta, mis m\u00f5jutab Androidi, Linuxi, macOS-i ja iOS-i Bluetoothi-kihte ning v\u00f5imaldab seda teha.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios-dopuskayushhaya-podstanovku-nazhatij-klavish","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Bluetooth-\u0441\u0442\u0435\u043a\u0430\u0445 Linux, macOS, Android \u0438 iOS, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u043d\u0430\u0436\u0430\u0442\u0438\u0439 \u043a\u043b\u0430\u0432\u0438\u0448 | ProHoster","og:description":"\u041c\u0430\u0440\u043a \u041d\u044c\u044e\u043b\u0438\u043d (Marc Newlin), \u0441\u0435\u043c\u044c \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434 \u0432\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c MouseJack, \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u043f\u043e\u0445\u043e\u0436\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2023-45866), \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 Bluetooth-\u0441\u0442\u0435\u043a\u0438 Android, Linux, macOS \u0438 iOS, \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios-dopuskayushhaya-podstanovku-nazhatij-klavish","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-12-09T19:10:14+00:00","article:modified_time":"2023-12-09T19:10:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/112094","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=112094"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/112094\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=112094"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=112094"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=112094"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}