Marc Newlin, yemwe adapeza chiopsezo MouseJack zaka zisanu ndi ziwiri zapitazo, adawulula zambiri za kusatetezeka kofananira (CVE-2023-45866), zomwe zimakhudza ma Bluetooth stacks Android, Linux, macOS ndi iOS. Kufooka kumeneku kumalola kusokoneza makiyi poyesa ntchito ya chipangizo cholowera cholumikizidwa ndi Bluetooth. Mwa kupeza mwayi wolowera ku kiyibodi, wowukira amatha kuchita zinthu zosiyanasiyana, monga kuchita malamulo a dongosolo, kukhazikitsa mapulogalamu, ndi kutumiza mauthenga.
Chiwopsezochi chimayamba chifukwa cha ma driver a Bluetooth HID (Human Interface Device) omwe amalola zotumphukira zakutali kupanga ndikukhazikitsa maulumikizidwe obisika popanda kutsimikizika. Zipangizo zolumikizidwazi zimatha kutumiza mauthenga a kiyibodi, omwe amakonzedwa ndi stack ya HID, ndikutsegula mwayi wa HID uthenga spoofing kuwukira kopanda kuyanjana kwa ogwiritsa ntchito. Kuukira kumeneku kutha kuchitidwa kuchokera kumtunda wamamita 100 kuchokera kwa wovulalayo.
Njira yolumikizira zipangizo popanda kutsimikizira imafotokozedwa mu Bluetooth specification ndipo, kutengera makonda a Bluetooth stack, imalola chipangizo kulumikiza popanda chitsimikizo kuchokera kwa wogwiritsa ntchito. Mwachitsanzo, mu Linux, mukamagwiritsa ntchito BlueZ Bluetooth stack, kuti mulumikizane mobisa, adaputala ya Bluetooth iyenera kukhala mu discovery ndi connection mode. Android Ndikokwanira kuyatsa chithandizo cha Bluetooth. Mu iOS ndi macOS Kuti chiwopsezo chikhale chopambana, Bluetooth iyenera kuyatsidwa ndipo kiyibodi yopanda zingwe iyenera kulumikizidwa.
Kuthekera kwa kusintha kwa zinthu zolowera kunawonetsedwa mu Ubuntu 18.04, 20.04, 22.04, ndi 23.10 yokhala ndi Bluetooth stack yochokera pa phukusi la BlueZ. ChromeOS siili pachiwopsezo, chifukwa makonda ake a Bluetooth stack salola kulumikizana popanda kutsimikizira. Android Kufooka kumeneku kumakhudza zipangizo zomwe zili ndi mitundu ya nsanja kuyambira 4.2.2 mpaka 14. macOS Kufooka kwa chipangizochi kunawonetsedwa pa MacBook Pro ya 2022 yokhala ndi purosesa ya Apple M2 ndipo macOS 13.3.3, komanso pa MacBook Air 2017 yokhala ndi purosesa ya Intel ndi macOS 12.6.7. Mu iOS, kufooka kwawonetsedwa pa iPhone SE ndi iOS 16.6. Kutsegula Lockdown mode sikuteteza ku ziwopsezo pa macOS ndi iOS.
В Linux kusatetezeka anathetsedwa Mu Bluez codebase, pokhazikitsa "ClassicBondedOnly" kuti "zoona," zomwe zimathandiza njira yotetezeka yomwe imalola kuti malumikizidwe pambuyo pa kuphatikizira. M'mbuyomu, zosinthazo zinali "zabodza," zomwe zimasokoneza chitetezo kuti zigwirizane ndi zida zina zolowetsa.
Mu gulu la Bluetooth la Fluoride lomwe limagwiritsidwa ntchito m'mabaibulo aposachedwa Android, kusatetezeka kwakonzedwa mwa kulamula kutsimikizira kwa maulumikizidwe onse obisika. Android zinatulutsidwa pa nthambi 11-14 zokha. Pa zipangizo za Pixel, kufooka kunakonzedwa mu zosintha za firmware za Disembala. Android Kuyambira 4.2.2 mpaka 10, kufooka sikunadziwikebe.
Source: linux.org.ru
