{"id":112103,"date":"2023-12-10T09:10:17","date_gmt":"2023-12-10T07:10:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios"},"modified":"2023-12-10T09:10:17","modified_gmt":"2023-12-10T07:10:17","slug":"uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios","title":{"rendered":"Vulnerabilit\u0101te Bluetooth stekos Linux, macOS, Android un iOS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex>      <noindex><\/p>\n<p>Marks \u0145\u016blins (Marc Newlin), kur\u0161 atkl\u0101ja \u0161o ievainojam\u012bbu <a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=43934\">MouseJack<\/a> pirms septi\u0146iem gadiem, public\u0113ja inform\u0101ciju par <a rel=\"nofollow\" href=\"https:\/\/security-tracker.debian.org\/tracker\/CVE-2023-45866\">l\u012bdz\u012bgu ievainojam\u012bbu (CVE-2023-45866)<\/a>, kas ietekm\u0113 Bluetooth stekus Android, Linux, macOS un iOS. \u0160\u012b ievainojam\u012bba \u013cauj veikt tausti\u0146u spiediena vilto\u0161anu, simul\u0113jot ievades ier\u012bces aktivit\u0101ti, kas piesl\u0113gta pa Bluetooth. Ieg\u016bstot piek\u013cuvi tastat\u016bras ievadam, uzbruc\u0113js var veikt da\u017e\u0101das darb\u012bbas, piem\u0113ram, izpild\u012bt komandas sist\u0113m\u0101, instal\u0113t programmas un p\u0101radres\u0113t zi\u0146as.<\/p>\n<p><\/noindex><\/noindex>  <\/p>\n<p>Ievainojam\u012bba ir saist\u012bta ar to, ka HID (Human Interface Device) hosta draiveri Bluetooth ier\u012bc\u0113m ir konfigur\u0113ti t\u0101, ka att\u0101lin\u0101ts perif\u0113rais ier\u012bce var izveidot un izveidot \u0161ifr\u0113tas savienojumus bez autentifik\u0101cijas. \u0160\u0101das pievienot\u0101s ier\u012bces var p\u0101rraid\u012bt tastat\u016bras zi\u0146ojumus, un HID steks tos apstr\u0101d\u0101, kas paver iesp\u0113ju uzbrukumam, kas ietver HID zi\u0146ojumu vilto\u0161anu, ko veic bez lietot\u0101ja l\u012bdzdal\u012bbas. \u0160\u0101du uzbrukumu var veikt l\u012bdz pat 100 metru att\u0101lum\u0101 no upura.<\/p>\n<p>Savienojuma izveide bez autentifik\u0101cijas ir defin\u0113ta Bluetooth specifik\u0101cij\u0101 un atkar\u012bb\u0101 no Bluetooth steka iestat\u012bjumiem \u013cauj ier\u012bci pievienot bez lietot\u0101ja apstiprin\u0101juma. Piem\u0113ram, Linux k\u0101 uz Bluetooth steka BlueZ, sl\u0113gtai Bluetooth adapterim j\u0101b\u016bt atkl\u0101jamas un piesl\u0113dzam\u012bbas re\u017e\u012bm\u0101. Android ir pietiekami aktiviz\u0113t Bluetooth atbalstu. iOS un macOS , lai veiksm\u012bgi veiktu uzbrukumu, Bluetooth j\u0101b\u016bt iesl\u0113gtam, k\u0101 ar\u012b j\u0101pievieno bezvadu tastat\u016bra.<\/p>\n<p>Ievades vilto\u0161anas iesp\u0113ja tika demonstr\u0113ta Ubuntu 18.04, 20.04, 22.04 un 23.10 ar Bluetooth steku, kas balst\u012bts uz BlueZ pakotni. ChromeOS nav ievainojams, jo t\u0101 Bluetooth steka iestat\u012bjumi nepie\u013cauj savienojumus bez autentifik\u0101cijas. Android ievainojam\u012bba ietekm\u0113 ier\u012bces ar platformas versij\u0101m no 4.2.2 l\u012bdz 14. macOS ievainojam\u012bba tika demonstr\u0113ta uz MacBook Pro 2022 ar Apple M2 procesoru un macOS 13.3.3, k\u0101 ar\u012b uz MacBook Air 2017 ar Intel procesoru un macOS 12.6.7. iOS ievainojam\u012bba tika demonstr\u0113ta uz iPhone SE ar iOS 16.6. Iek\u0161 Lockdown re\u017e\u012bma aktiviz\u0101cija neaizsarg\u0101 pret uzbrukumiem macOS un iOS.<\/p>\n<p> <noindex><\/p>\n<p>Linux ievainojam\u012bba <a rel=\"nofollow\" href=\"https:\/\/git.kernel.org\/pub\/scm\/bluetooth\/bluez.git\/commit\/profiles\/input?id=25a471a83e02e1effb15d5a488b3f0085eaeb675\">tika nov\u0113rsta<\/a> Bluez kodu b\u0101z\u0113, iestatot opciju &laquo;ClassicBondedOnly&raquo; uz &laquo;true&raquo;, tiek aktiviz\u0113ts dro\u0161ais re\u017e\u012bms, kas \u013cauj izveidot savienojumus tikai p\u0113c p\u0101ra izveides. Iepriek\u0161 bija iestat\u012bts &laquo;false&raquo;, kas, lai nodro\u0161in\u0101tu sader\u012bbu ar da\u017e\u0101m ievades ier\u012bc\u0113m, samazin\u0101ja dro\u0161\u012bbas l\u012bmeni.<\/p>\n<p><\/noindex> <noindex><\/p>\n<p>Bluetooth stek\u0101 Fluoride, kas tiek izmantots jaun\u0101kaj\u0101s Android versij\u0101s, <a rel=\"nofollow\" href=\"https:\/\/android.googlesource.com\/platform\/packages\/modules\/Bluetooth\/+\/5673b3c6bbe8c6c9edb8afb5e9499dc3a41d3943\">ievainojam\u012bba ir nov\u0113rsta<\/a> ievie\u0161ot oblig\u0101tu autentifik\u0101ciju visiem \u0161ifr\u0113tajiem savienojumiem. Labojumi Android tika izlaisti tikai 11-14 zariem. Pixel ier\u012bc\u0113m ievainojam\u012bba tika nov\u0113rsta decembra aparat\u016bras atjaunin\u0101jum\u0101. Android versij\u0101m no 4.2.2 l\u012bdz 10 ievainojam\u012bba joproj\u0101m paliek neatrisin\u0101ta.<\/p>\n<p><\/noindex><\/p>\n<p>Avots: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/news\/security\/17447666\">linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041c\u0430\u0440\u043a \u041d\u044c\u044e\u043b\u0438\u043d (Marc Newlin), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u044f\u0432\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c MouseJack \u0441\u0435\u043c\u044c \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434, \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2023-45866), \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 Bluetooth-\u0441\u0442\u0435\u043a\u0438 Android, Linux, macOS \u0438 iOS. \u042d\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u043e\u0434\u043c\u0435\u043d\u0443 \u043d\u0430\u0436\u0430\u0442\u0438\u0439 \u043a\u043b\u0430\u0432\u0438\u0448 \u043f\u0443\u0442\u0435\u043c \u0441\u0438\u043c\u0443\u043b\u044f\u0446\u0438\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0432\u0432\u043e\u0434\u0430, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e Bluetooth. \u041f\u043e\u043b\u0443\u0447\u0438\u0432 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043b\u0430\u0432\u0438\u0430\u0442\u0443\u0440\u043d\u043e\u043c\u0443 \u0432\u0432\u043e\u0434\u0443, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112103","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041c\u0430\u0440\u043a \u041d\u044c\u044e\u043b\u0438\u043d (Marc Newlin), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u044f\u0432\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c MouseJack \u0441\u0435\u043c\u044c \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434, \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"lv_LV\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Bluetooth-\u0441\u0442\u0435\u043a\u0430\u0445 Linux, macOS, Android \u0438 iOS | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041c\u0430\u0440\u043a \u041d\u044c\u044e\u043b\u0438\u043d (Marc Newlin), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u044f\u0432\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c MouseJack \u0441\u0435\u043c\u044c \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434, \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-12-10T07:10:17+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-12-10T07:10:17+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ievainojam\u012bba Bluetooth stekos Linux, macOS, Android un iOS | ProHoster","description":"Marks \u0145\u016blins (Marc Newlin), kur\u0161 pirms septi\u0146iem gadiem atkl\u0101ja MouseJack ievainojam\u012bbu, izpaudis inform\u0101ciju par","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Bluetooth-\u0441\u0442\u0435\u043a\u0430\u0445 Linux, macOS, Android \u0438 iOS | ProHoster","og:description":"\u041c\u0430\u0440\u043a \u041d\u044c\u044e\u043b\u0438\u043d (Marc Newlin), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u044f\u0432\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c MouseJack \u0441\u0435\u043c\u044c \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434, \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e","og:url":"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-12-10T07:10:17+00:00","article:modified_time":"2023-12-10T07:10:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/112103","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=112103"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/112103\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=112103"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=112103"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=112103"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}