{"id":112103,"date":"2023-12-10T09:10:17","date_gmt":"2023-12-10T07:10:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios"},"modified":"2023-12-10T09:10:17","modified_gmt":"2023-12-10T07:10:17","slug":"uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios","title":{"rendered":"Dob\u00ebsi n\u00eb Bluetooth stack-et e Linux, macOS, Android dhe iOS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

<\/p>\n

Marc Newlin, i cili zbuloi dob\u00ebsin\u00eb MouseJack<\/a> shtat\u00eb vjet m\u00eb par\u00eb, b\u00ebri publike informacionin p\u00ebr nj\u00eb dob\u00ebsi t\u00eb ngjashme (CVE-2023-45866)<\/a>, q\u00eb prek Bluetooth stack-et e Android, Linux, macOS dhe iOS. Kjo dob\u00ebsi mund\u00ebson injektimin e shtypjeve t\u00eb tasteve duke simuluar aktivitetin e nj\u00eb pajisjeje hyr\u00ebse t\u00eb lidhur me Bluetooth. Pasi fiton akses te hyrja nga tastiera, nj\u00eb sulmues mund t\u00eb kryej\u00eb veprime t\u00eb ndryshme, si ekzekutimi i komandave n\u00eb sistem, instalimi i aplikacioneve dhe ridrejtimi i mesazheve.<\/p>\n

<\/noindex><\/noindex> <\/p>\n

Dob\u00ebsia shkaktohet nga fakti se driver\u00ebt host HID (Human Interface Device) p\u00ebr pajisjet Bluetooth kan\u00eb nj\u00eb m\u00ebnyr\u00eb q\u00eb i lejon nj\u00eb pajisjeje periferike n\u00eb distanc\u00eb t\u00eb krijoj\u00eb dhe t\u00eb vendos\u00eb lidhje t\u00eb enkriptuara pa autentikim. Pajisje t\u00eb tilla t\u00eb lidhura mund t\u00eb d\u00ebrgojn\u00eb mesazhe t\u00eb tastier\u00ebs, t\u00eb cilat p\u00ebrpunohen nga HID stack-u, duke hapur mund\u00ebsin\u00eb p\u00ebr nj\u00eb sulm me injektim t\u00eb mesazheve HID, i kryer pa nd\u00ebrveprimin e p\u00ebrdoruesit. Ky sulm mund t\u00eb kryhet nga nj\u00eb distanc\u00eb deri n\u00eb 100 metra nga viktima.<\/p>\n

Mekanizmi i \u00e7iftimit t\u00eb pajisjeve pa autentikim p\u00ebrcaktohet n\u00eb specifikimin Bluetooth dhe, n\u00eb var\u00ebsi t\u00eb konfigurimit t\u00eb Bluetooth stack-ut, lejon lidhjen e nj\u00eb pajisjeje pa konfirmim nga p\u00ebrdoruesi. P\u00ebr shembull, n\u00eb Linux, kur p\u00ebrdoret Bluetooth stack-u BlueZ, p\u00ebr \u00e7iftim t\u00eb fsheht\u00eb adaptori Bluetooth duhet t\u00eb jet\u00eb n\u00eb modalitetin e zbulimit dhe lidhjes. N\u00eb Android mjafton t\u00eb jet\u00eb aktivizuar mb\u00ebshtetja p\u00ebr Bluetooth. N\u00eb iOS dhe macOS, q\u00eb sulmi t\u00eb ket\u00eb sukses, duhet t\u00eb jet\u00eb i aktivizuar Bluetooth-i, si edhe t\u00eb jet\u00eb e lidhur nj\u00eb tastier\u00eb pa tela.<\/p>\n

Mund\u00ebsia e injektimit t\u00eb hyrjes u demonstrua n\u00eb Ubuntu 18.04, 20.04, 22.04 dhe 23.10 me Bluetooth stack t\u00eb bazuar n\u00eb paket\u00ebn BlueZ. ChromeOS nuk preket nga kjo dob\u00ebsi, pasi konfigurimi i Bluetooth stack-ut t\u00eb tij nuk lejon lidhje pa autentikim. N\u00eb Android, dob\u00ebsia prek pajisjet me versione t\u00eb platform\u00ebs nga 4.2.2 deri n\u00eb 14. N\u00eb macOS, dob\u00ebsia u demonstrua n\u00eb MacBook Pro 2022 me procesor Apple M2 dhe macOS 13.3.3, si edhe n\u00eb MacBook Air 2017 me procesor Intel dhe macOS 12.6.7. N\u00eb iOS, dob\u00ebsia u demonstrua n\u00eb iPhone SE me iOS 16.6. Aktivizimi i modalitetit Lockdown nuk ofron mbrojtje ndaj sulmit n\u00eb macOS dhe iOS.<\/p>\n

<\/p>\n

N\u00eb Linux, dob\u00ebsia u eliminua<\/a> N\u00eb baz\u00ebn e kodit Bluez, duke vendosur cil\u00ebsimin \u00abClassicBondedOnly\u00bb n\u00eb vler\u00ebn \u00abtrue\u00bb, aktivizohet nj\u00eb mod t\u00eb sigurt, i cili lejon vendosjen e lidhjeve vet\u00ebm pas \u00e7iftimit. M\u00eb par\u00eb, vlera \u00abfalse\u00bb ishte vendosur, e cila, p\u00ebr shkak t\u00eb kompatibilitetit me disa pajisje hyr\u00ebse, ulte nivelin e siguris\u00eb.<\/p>\n

<\/noindex> <\/p>\n

N\u00eb stack-un Bluetooth Fluoride, i p\u00ebrdorur n\u00eb versionet m\u00eb t\u00eb fundit t\u00eb Android, dob\u00ebsia \u00ebsht\u00eb korrigjuar<\/a> duke b\u00ebr\u00eb t\u00eb detyruesh\u00ebm p\u00ebrdorimin e autentikimit p\u00ebr t\u00eb gjitha lidhjet e enkriptuara. Rregullimet p\u00ebr Android jan\u00eb publikuar vet\u00ebm p\u00ebr deg\u00ebt 11-14. P\u00ebr pajisjet Pixel, dob\u00ebsia u eliminua n\u00eb p\u00ebrdit\u00ebsimin e firmuerit t\u00eb dhjetorit. P\u00ebr versionet e Android nga 4.2.2 deri n\u00eb 10, dob\u00ebsia mbetet e pakorrigjuar.<\/p>\n

<\/noindex><\/p>\n

Burimi: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041c\u0430\u0440\u043a \u041d\u044c\u044e\u043b\u0438\u043d (Marc Newlin), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u044f\u0432\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c MouseJack \u0441\u0435\u043c\u044c \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434, \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2023-45866), \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 Bluetooth-\u0441\u0442\u0435\u043a\u0438 Android, Linux, macOS \u0438 iOS. \u042d\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u043e\u0434\u043c\u0435\u043d\u0443 \u043d\u0430\u0436\u0430\u0442\u0438\u0439 \u043a\u043b\u0430\u0432\u0438\u0448 \u043f\u0443\u0442\u0435\u043c \u0441\u0438\u043c\u0443\u043b\u044f\u0446\u0438\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0432\u0432\u043e\u0434\u0430, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e Bluetooth. \u041f\u043e\u043b\u0443\u0447\u0438\u0432 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043b\u0430\u0432\u0438\u0430\u0442\u0443\u0440\u043d\u043e\u043c\u0443 \u0432\u0432\u043e\u0434\u0443, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112103","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dob\u00ebsi n\u00eb stack-et Bluetooth t\u00eb Linux, macOS, Android dhe iOS | ProHoster","description":"Marc Newlin, i cili zbuloi dob\u00ebsin\u00eb MouseJack shtat\u00eb vjet m\u00eb par\u00eb, b\u00ebri publik informacionin rreth","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Bluetooth-\u0441\u0442\u0435\u043a\u0430\u0445 Linux, macOS, Android \u0438 iOS | ProHoster","og:description":"\u041c\u0430\u0440\u043a \u041d\u044c\u044e\u043b\u0438\u043d (Marc Newlin), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u044f\u0432\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c MouseJack \u0441\u0435\u043c\u044c \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434, \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-12-10T07:10:17+00:00","article:modified_time":"2023-12-10T07:10:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/112103","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=112103"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/112103\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=112103"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=112103"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=112103"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}