{"id":112103,"date":"2023-12-10T09:10:17","date_gmt":"2023-12-10T07:10:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios"},"modified":"2023-12-10T09:10:17","modified_gmt":"2023-12-10T07:10:17","slug":"uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios","title":{"rendered":"Sebezhet\u0151s\u00e9g a Linux, macOS, Android \u00e9s iOS Bluetooth stackjeiben","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

<\/p>\n

Marc Newlin, aki felfedezte a sebezhet\u0151s\u00e9get MouseJack<\/a> h\u00e9t \u00e9vvel ezel\u0151tt, nyilv\u00e1noss\u00e1gra hozta az inform\u00e1ci\u00f3t a hasonl\u00f3 sebezhet\u0151s\u00e9gr\u0151l (CVE-2023-45866)<\/a>, amely a Bluetooth stack-eket \u00e9rinti Android, Linux, macOS \u00e9s iOS rendszerekben. Ez a sebezhet\u0151s\u00e9g lehet\u0151v\u00e9 teszi a billenty\u0171le\u00fct\u00e9sek hamis\u00edt\u00e1s\u00e1t egy Bluetooth-on csatlakoz\u00f3 bemeneti eszk\u00f6z aktivit\u00e1s\u00e1nak szimul\u00e1l\u00e1s\u00e1val. A billenty\u0171zeti inputhoz val\u00f3 hozz\u00e1f\u00e9r\u00e9ssel a t\u00e1mad\u00f3 k\u00fcl\u00f6nb\u00f6z\u0151 m\u0171veleteket hajthat v\u00e9gre, p\u00e9ld\u00e1ul parancsokat futtathat a rendszeren, alkalmaz\u00e1sokat telep\u00edthet, \u00e9s \u00fczeneteket ir\u00e1ny\u00edthat \u00e1t.<\/p>\n

<\/noindex><\/noindex> <\/p>\n

A sebezhet\u0151s\u00e9g abb\u00f3l ad\u00f3dik, hogy a Bluetooth-eszk\u00f6z\u00f6k HID (Human Interface Device) hosztmeghajt\u00f3i rendelkeznek egy olyan m\u00f3ddal, amely lehet\u0151v\u00e9 teszi a t\u00e1voli perif\u00e9ri\u00e1s eszk\u00f6z\u00f6k sz\u00e1m\u00e1ra az autentik\u00e1ci\u00f3 n\u00e9lk\u00fcli titkos\u00edtott kapcsolatok l\u00e9trehoz\u00e1s\u00e1t \u00e9s be\u00e1ll\u00edt\u00e1s\u00e1t. Az ilyen csatlakoztatott eszk\u00f6z\u00f6k k\u00e9pesek billenty\u0171zeti \u00fczenetek tov\u00e1bb\u00edt\u00e1s\u00e1ra, amelyeket a HID stack kezel, ez lehet\u0151s\u00e9get ad a HID \u00fczenetek hamis\u00edt\u00e1s\u00e1ra ir\u00e1nyul\u00f3 t\u00e1mad\u00e1sokra, amelyeket felhaszn\u00e1l\u00f3 k\u00f6zrem\u0171k\u00f6d\u00e9se n\u00e9lk\u00fcl lehet v\u00e9grehajtani. Ez a t\u00e1mad\u00e1s ak\u00e1r 100 m\u00e9teres t\u00e1vols\u00e1gb\u00f3l is v\u00e9grehajthat\u00f3 a c\u00e9lt\u00f3l.<\/p>\n

Az autentik\u00e1ci\u00f3 n\u00e9lk\u00fcli eszk\u00f6zp\u00e1ros\u00edt\u00e1s mechanizmusa a Bluetooth specifik\u00e1ci\u00f3ban van meghat\u00e1rozva, \u00e9s a Bluetooth stack be\u00e1ll\u00edt\u00e1sait\u00f3l f\u00fcgg\u0151en lehet\u0151v\u00e9 teszi az eszk\u00f6z csatlakoztat\u00e1s\u00e1t a felhaszn\u00e1l\u00f3 meger\u0151s\u00edt\u00e9se n\u00e9lk\u00fcl. P\u00e9ld\u00e1ul Linux alatt, a BlueZ Bluetooth stack haszn\u00e1latakor a Bluetooth adapternek felfedez\u00e9si \u00e9s csatlakoz\u00e1si m\u00f3dban kell lennie a rejtett p\u00e1ros\u00edt\u00e1shoz. Androidon elegend\u0151 a Bluetooth t\u00e1mogat\u00e1s enged\u00e9lyez\u00e9se. iOS \u00e9s macOS eset\u00e9ben a sikeres t\u00e1mad\u00e1shoz a Bluetooth-nak be kell kapcsolva lennie, \u00e9s egy vezet\u00e9k n\u00e9lk\u00fcli billenty\u0171zetnek is csatlakoztatva kell lennie.<\/p>\n

A bemeneti hamis\u00edt\u00e1s lehet\u0151s\u00e9g\u00e9t az Ubuntu 18.04, 20.04, 22.04 \u00e9s 23.10 v\u00e1ltozataiban a BlueZ csomagon alapul\u00f3 Bluetooth stackkel demonstr\u00e1lt\u00e1k. A ChromeOS nem \u00e9rintett a sebezhet\u0151s\u00e9ggel, mivel a Bluetooth stack be\u00e1ll\u00edt\u00e1sai nem teszik lehet\u0151v\u00e9 az autentik\u00e1ci\u00f3 n\u00e9lk\u00fcli kapcsol\u00f3d\u00e1st. Androidon a sebezhet\u0151s\u00e9g a 4.2.2 \u00e9s 14 k\u00f6z\u00f6tti platformverzi\u00f3kkal rendelkez\u0151 eszk\u00f6z\u00f6ket \u00e9rinti. macOS-en a sebezhet\u0151s\u00e9get a 2022-es Apple M2 processzoros MacBook Pro \u00e9s a 13.3.3-as macOS, valamint a 2017-es Intel processzoros MacBook Air \u00e9s a 12.6.7-es macOS eset\u00e9ben demonstr\u00e1lt\u00e1k. iOS-en a sebezhet\u0151s\u00e9get az iOS 16.6-tal rendelkez\u0151 iPhone SE-n mutatt\u00e1k be. A Lockdown m\u00f3d bekapcsol\u00e1sa nem ny\u00fajt v\u00e9delmet a t\u00e1mad\u00e1sok ellen macOS \u00e9s iOS rendszereken.<\/p>\n

<\/p>\n

Linux alatt a sebezhet\u0151s\u00e9g megold\u00f3dott<\/a> A Bluez k\u00f3db\u00e1zis\u00e1ban a «ClassicBondedOnly» be\u00e1ll\u00edt\u00e1s «true» \u00e9rt\u00e9k\u00e9re \u00e1ll\u00edt\u00e1s\u00e1val aktiv\u00e1lhat\u00f3 a biztons\u00e1gos \u00fczemm\u00f3d, amely csak p\u00e1ros\u00edt\u00e1s ut\u00e1n enged\u00e9lyezi a kapcsolatok l\u00e9trehoz\u00e1s\u00e1t. Kor\u00e1bban «false» \u00e9rt\u00e9ken volt be\u00e1ll\u00edtva, ami a bemeneti eszk\u00f6z\u00f6k k\u00f6z\u00f6tti kompatibilit\u00e1s \u00e9rdek\u00e9ben cs\u00f6kkentette a biztons\u00e1g szintj\u00e9t.<\/p>\n

<\/noindex> <\/p>\n

A leg\u00fajabb Android verzi\u00f3kban haszn\u00e1lt Fluoride Bluetooth stack-ben, a sebezhet\u0151s\u00e9g megsz\u00fcntetve<\/a> minden titkos\u00edtott kapcsolat k\u00f6telez\u0151 hiteles\u00edt\u00e9s\u00e9nek alkalmaz\u00e1s\u00e1val. Az Android jav\u00edt\u00e1sai csak a 11-14-es \u00e1gon jelentek meg. A Pixel eszk\u00f6z\u00f6k sz\u00e1m\u00e1ra a sebezhet\u0151s\u00e9get a decemberi firmware friss\u00edt\u00e9sben orvosolt\u00e1k. A 4.2.2 \u00e9s 10 k\u00f6z\u00f6tti Android kiad\u00e1sokn\u00e1l a sebezhet\u0151s\u00e9g tov\u00e1bbra is fenn\u00e1ll.<\/p>\n

<\/noindex><\/p>\n

Forr\u00e1s: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041c\u0430\u0440\u043a \u041d\u044c\u044e\u043b\u0438\u043d (Marc Newlin), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u044f\u0432\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c MouseJack \u0441\u0435\u043c\u044c \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434, \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2023-45866), \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 Bluetooth-\u0441\u0442\u0435\u043a\u0438 Android, Linux, macOS \u0438 iOS. \u042d\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u043e\u0434\u043c\u0435\u043d\u0443 \u043d\u0430\u0436\u0430\u0442\u0438\u0439 \u043a\u043b\u0430\u0432\u0438\u0448 \u043f\u0443\u0442\u0435\u043c \u0441\u0438\u043c\u0443\u043b\u044f\u0446\u0438\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0432\u0432\u043e\u0434\u0430, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e Bluetooth. \u041f\u043e\u043b\u0443\u0447\u0438\u0432 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043b\u0430\u0432\u0438\u0430\u0442\u0443\u0440\u043d\u043e\u043c\u0443 \u0432\u0432\u043e\u0434\u0443, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112103","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sebezhet\u0151s\u00e9g a Linux, macOS, Android \u00e9s iOS Bluetooth stack-ekben | ProHoster","description":"Marc Newlin, aki h\u00e9t \u00e9ve felfedezte a MouseJack sebezhet\u0151s\u00e9get, inform\u00e1ci\u00f3t t\u00e1rt fel a","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Bluetooth-\u0441\u0442\u0435\u043a\u0430\u0445 Linux, macOS, Android \u0438 iOS | ProHoster","og:description":"\u041c\u0430\u0440\u043a \u041d\u044c\u044e\u043b\u0438\u043d (Marc Newlin), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u044f\u0432\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c MouseJack \u0441\u0435\u043c\u044c \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434, \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-12-10T07:10:17+00:00","article:modified_time":"2023-12-10T07:10:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/112103","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=112103"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/112103\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=112103"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=112103"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=112103"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}