{"id":112103,"date":"2023-12-10T09:10:17","date_gmt":"2023-12-10T07:10:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios"},"modified":"2023-12-10T09:10:17","modified_gmt":"2023-12-10T07:10:17","slug":"uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios","title":{"rendered":"Haavatavus Bluetoothi protokollides Linuxis, macOS-is, Androidis ja iOS-is","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

<\/p>\n

Marc Newlin, kes avastas haavatavuse MouseJack<\/a> seitsme aasta eest, avaldas teavet sarnase haavatavuse (CVE-2023-45866)<\/a>, mis m\u00f5jutab Bluetoothi-virna Androidis, Linuxis, macOS-is ja iOS-is. See haavatavus v\u00f5imaldab simuleerida sisendseadmest tulenevaid klahvivajutusi, asendades need. Juurdep\u00e4\u00e4s klaviatuuri sisendile v\u00f5ib lubada agressoril teha erinevaid tegevusi, nagu k\u00e4su t\u00e4itmine s\u00fcsteemis, rakenduste installimine ja s\u00f5numite suunamine.<\/p>\n

<\/noindex><\/noindex> <\/p>\n

Haavatavus tuleneb sellest, et Bluetooth-seadmete jaoks m\u00f5eldud HID (Human Interface Device) draiverid v\u00f5ivad kaugsideseadmest luua ja seadistada kr\u00fcpteeritud \u00fchendusi autentimise puudumisel. Sellised \u00fchendatud seadmed saavad edastada klaviatuuri s\u00f5numeid, mida HID-virn t\u00f6\u00f6tleb, avades v\u00f5imalusi HID-s\u00f5numite asendamise kasutamiseks, mis toimub ilma kasutaja osaluseta. Sellist r\u00fcnnakut saab teostada kuni 100 meetri kaugusel ohvrist.<\/p>\n

Seadmise mehhanism Bluetooth-seadmeste \u00fchendamiseks autentimise vajaduseta on m\u00e4\u00e4ratletud Bluetoothi spetsifikatsioonis ning s\u00f5ltuvalt Bluetoothi virna seadistustest v\u00f5imaldab see seadme \u00fchendamist ilma kasutaja kinnitamiseta. N\u00e4iteks Linuxis, kasutades BlueZ-p\u00f5hist Bluetoothi virna, peab Bluetooth-adapter olema peidetud ja \u00fchendusre\u017eiimis. Androidis piisab Bluetooth-toe l\u00fclitamisest. iOS-is ja macOS-is peab edukaks r\u00fcnnakuks olema Bluetooth sisse l\u00fclitatud ning traadita klaviatuur \u00fchendatud.<\/p>\n

Sisendi asendamise v\u00f5imalust on demonstreeritud Ubuntu versioonides 18.04, 20.04, 22.04 ja 23.10, mis p\u00f5hinevad BlueZ-p\u00f5hisel Bluetoothi virnal. ChromeOS ei ole haavatav, kuna selle Bluetoothi virna seaded ei luba \u00fchendusi ilma autentimiseta. Androidis puudutab haavatavus seadmeid, mille platvormiversioonid j\u00e4\u00e4vad vahemikku 4.2.2 kuni 14. macOSis on haavatavus demonstreeritud 2022. aasta MacBook Pro-l, millel on Apple M2 processor ja macOS 13.3.3, samuti 2017. aasta MacBook Air-l, millel on Intel processor ja macOS 12.6.7. iOS-is on haavatavus demonstreeritud iPhone SE-l, millel on iOS 16.6. Lockdown-re\u017eiimi sissel\u00fclitamine ei kaitse r\u00fcnnaku eest macOS-is ja iOS-is.<\/p>\n

<\/p>\n

Linuxis on haavatavus oli k\u00f5rvaldatud<\/a> Bluezi koodibaasis seadistades parameeter «ClassicBondedOnly» v\u00e4\u00e4rtuseks «true» aktiveeritakse turvare\u017eiim, mis lubab siduri loomist ainult p\u00e4rast paaritamist. Varem oli m\u00e4\u00e4ratud v\u00e4\u00e4rtus «false», mis, et tagada \u00fchilduvus teatud sisendseadmetega, alandas turvataset.<\/p>\n

<\/noindex> <\/p>\n

Viimastes Androidi versioonides kasutatavas Bluetoothi virnas Fluoride, on haavatavus k\u00f5rvaldatud<\/a> k\u00f5ikide kr\u00fcptitud \u00fchenduste autentimise kohustusliku rakendamise teel. Androidi parandused on v\u00e4lja antud vaid 11-14 harude jaoks. Pixel-seadmete jaoks k\u00f5rvaldatakse haavatavus detsembri tarkvarauuendusega. Androidi versioonides 4.2.2 kuni 10 j\u00e4\u00e4b haavatavus lahendamata.<\/p>\n

<\/noindex><\/p>\n

Allikas: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041c\u0430\u0440\u043a \u041d\u044c\u044e\u043b\u0438\u043d (Marc Newlin), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u044f\u0432\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c MouseJack \u0441\u0435\u043c\u044c \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434, \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2023-45866), \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 Bluetooth-\u0441\u0442\u0435\u043a\u0438 Android, Linux, macOS \u0438 iOS. \u042d\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u043e\u0434\u043c\u0435\u043d\u0443 \u043d\u0430\u0436\u0430\u0442\u0438\u0439 \u043a\u043b\u0430\u0432\u0438\u0448 \u043f\u0443\u0442\u0435\u043c \u0441\u0438\u043c\u0443\u043b\u044f\u0446\u0438\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0432\u0432\u043e\u0434\u0430, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e Bluetooth. \u041f\u043e\u043b\u0443\u0447\u0438\u0432 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043b\u0430\u0432\u0438\u0430\u0442\u0443\u0440\u043d\u043e\u043c\u0443 \u0432\u0432\u043e\u0434\u0443, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112103","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Bluetooth-kihtide haavatavus Linuxis, macOS-is, Androidis ja iOS-is | ProHoster","description":"Marc Newlin, kes avastas seitse aastat tagasi MouseJack haavatavuse, paljastas sarnase haavatavuse (CVE-2023-45866), mis m\u00f5jutab Bluetoothi \u200b\u200bstack'e Androidis, Linuxis, macOS-is ja iOS-is. See haavatavus v\u00f5imaldab simuleeritud sisendi seadme kaudu sisestuste asendamist. Juurdep\u00e4\u00e4s klaviatuuri sisendile v\u00f5imaldab pahatahtlikul kasutajal teostada erinevaid toiminguid, nagu s\u00fcsteemis k\u00e4su t\u00e4itmine,","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Bluetooth-\u0441\u0442\u0435\u043a\u0430\u0445 Linux, macOS, Android \u0438 iOS | ProHoster","og:description":"\u041c\u0430\u0440\u043a \u041d\u044c\u044e\u043b\u0438\u043d (Marc Newlin), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u044f\u0432\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c MouseJack \u0441\u0435\u043c\u044c \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434, \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2023-45866), \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 Bluetooth-\u0441\u0442\u0435\u043a\u0438 Android, Linux, macOS \u0438 iOS. \u042d\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u043e\u0434\u043c\u0435\u043d\u0443 \u043d\u0430\u0436\u0430\u0442\u0438\u0439 \u043a\u043b\u0430\u0432\u0438\u0448 \u043f\u0443\u0442\u0435\u043c \u0441\u0438\u043c\u0443\u043b\u044f\u0446\u0438\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0432\u0432\u043e\u0434\u0430, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e Bluetooth. \u041f\u043e\u043b\u0443\u0447\u0438\u0432 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043b\u0430\u0432\u0438\u0430\u0442\u0443\u0440\u043d\u043e\u043c\u0443 \u0432\u0432\u043e\u0434\u0443, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435,","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-12-10T07:10:17+00:00","article:modified_time":"2023-12-10T07:10:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/112103","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=112103"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/112103\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=112103"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=112103"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=112103"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}