{"id":112103,"date":"2023-12-10T09:10:17","date_gmt":"2023-12-10T07:10:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios"},"modified":"2023-12-10T09:10:17","modified_gmt":"2023-12-10T07:10:17","slug":"uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios","title":{"rendered":"S\u00e5rbarhet i Bluetooth-stacken f\u00f6r Linux, macOS, Android och iOS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex>      <noindex><\/p>\n<p>Marc Newlin, som uppt\u00e4ckte s\u00e5rbarheten <a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=43934\">MouseJack<\/a> f\u00f6r sju \u00e5r sedan, avsl\u00f6jade information om <a rel=\"nofollow\" href=\"https:\/\/security-tracker.debian.org\/tracker\/CVE-2023-45866\">en liknande s\u00e5rbarhet (CVE-2023-45866)<\/a>, som p\u00e5verkar Bluetooth-stacken i Android, Linux, macOS och iOS. Denna s\u00e5rbarhet m\u00f6jligg\u00f6r f\u00f6rfalskning av tangenttryckningar genom att simulera aktivitet fr\u00e5n en inmatningsenhet som \u00e4r ansluten via Bluetooth. Genom att f\u00e5 tillg\u00e5ng till tangentbordsinmatning kan en angripare utf\u00f6ra olika \u00e5tg\u00e4rder, s\u00e5som att k\u00f6ra kommandon i systemet, installera applikationer och omdirigera meddelanden.<\/p>\n<p><\/noindex><\/noindex>  <\/p>\n<p>S\u00e5rbarheten orsakas av att v\u00e4rddrivrutiner f\u00f6r HID (Human Interface Device) f\u00f6r Bluetooth-enheter har ett l\u00e4ge som till\u00e5ter en fj\u00e4rrperiferienhet att skapa och etablera krypterade anslutningar utan autentisering. S\u00e5dana anslutna enheter kan \u00f6verf\u00f6ra tangentbordsmeddelanden som HID-stacken hanterar, vilket \u00f6ppnar f\u00f6r en attack f\u00f6r att f\u00f6rfalska HID-meddelanden utan anv\u00e4ndarens medverkan. Denna attack kan utf\u00f6ras p\u00e5 upp till 100 meters avst\u00e5nd fr\u00e5n offret.<\/p>\n<p>Mekanismen f\u00f6r enhetsparning utan autentisering definieras i Bluetooth-specifikationen och kan, beroende p\u00e5 inst\u00e4llningarna f\u00f6r Bluetooth-stacken, m\u00f6jligg\u00f6ra anslutning av en enhet utan bekr\u00e4ftelse fr\u00e5n anv\u00e4ndaren. Till exempel, i Linux, n\u00e4r man anv\u00e4nder Bluetooth-stacken BlueZ, m\u00e5ste Bluetooth-adaptern vara i l\u00e4ge f\u00f6r uppt\u00e4ckbarhet och anslutning f\u00f6r att d\u00f6lja parningen. I Android r\u00e4cker det med att aktivera Bluetooth-st\u00f6det. I iOS och macOS m\u00e5ste Bluetooth vara aktiverat och en tr\u00e5dl\u00f6s tangentbord vara ansluten f\u00f6r en lyckad attack.<\/p>\n<p>M\u00f6jligheten att f\u00f6rfalska inmatning demonstrerades p\u00e5 Ubuntu 18.04, 20.04, 22.04 och 23.10 med Bluetooth-stacken baserad p\u00e5 paketet BlueZ. ChromeOS \u00e4r inte s\u00e5rbart, eftersom dess inst\u00e4llningar f\u00f6r Bluetooth-stacken inte till\u00e5ter anslutningar utan autentisering. I Android p\u00e5verkar s\u00e5rbarheten enheter med plattformversioner fr\u00e5n 4.2.2 till 14. I macOS visades s\u00e5rbarheten p\u00e5 MacBook Pro 2022 med Apple M2-processor och macOS 13.3.3, liksom p\u00e5 MacBook Air 2017 med Intel-processor och macOS 12.6.7. I iOS visades s\u00e5rbarheten p\u00e5 iPhone SE med iOS 16.6. Aktivering av Lockdown-l\u00e4get ger inte skydd mot attacken i macOS och iOS.<\/p>\n<p> <noindex><\/p>\n<p>I Linux \u00e4r s\u00e5rbarheten <a rel=\"nofollow\" href=\"https:\/\/git.kernel.org\/pub\/scm\/bluetooth\/bluez.git\/commit\/profiles\/input?id=25a471a83e02e1effb15d5a488b3f0085eaeb675\">utrotades<\/a> \u0432 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u0435 Bluez \u043f\u0443\u0442\u0435\u043c \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 &laquo;ClassicBondedOnly&raquo; \u0432 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 &laquo;true&raquo;, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0435\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0439 \u0440\u0435\u0436\u0438\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u0441\u043e\u043f\u0440\u044f\u0436\u0435\u043d\u0438\u044f. \u0420\u0430\u043d\u0435\u0435 \u0431\u044b\u043b\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 &laquo;false&raquo;, \u043a\u043e\u0442\u043e\u0440\u043e\u0435, \u0440\u0430\u0434\u0438 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0441\u0442\u0438 \u0441 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438 \u0432\u0432\u043e\u0434\u0430, \u0441\u043d\u0438\u0436\u0430\u043b\u043e \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.<\/p>\n<p><\/noindex> <noindex><\/p>\n<p>I Bluetooth-stacken Fluoride, som anv\u00e4nds i de senaste versionerna av Android, <a rel=\"nofollow\" href=\"https:\/\/android.googlesource.com\/platform\/packages\/modules\/Bluetooth\/+\/5673b3c6bbe8c6c9edb8afb5e9499dc3a41d3943\">har s\u00e5rbarheten \u00e5tg\u00e4rdats<\/a> genom att g\u00f6ra autentisering obligatorisk f\u00f6r alla krypterade anslutningar. Korrigeringar f\u00f6r Android har sl\u00e4ppts endast f\u00f6r versionerna 11-14. F\u00f6r Pixel-enheter \u00e5tg\u00e4rdades s\u00e5rbarheten i decemberuppdateringen. F\u00f6r Android-versioner fr\u00e5n 4.2.2 till 10 f\u00f6rblir s\u00e5rbarheten \u00e5tg\u00e4rdad.<\/p>\n<p><\/noindex><\/p>\n<p>K\u00e4lla: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/news\/security\/17447666\">linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041c\u0430\u0440\u043a \u041d\u044c\u044e\u043b\u0438\u043d (Marc Newlin), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u044f\u0432\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c MouseJack \u0441\u0435\u043c\u044c \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434, \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2023-45866), \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 Bluetooth-\u0441\u0442\u0435\u043a\u0438 Android, Linux, macOS \u0438 iOS. \u042d\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u043e\u0434\u043c\u0435\u043d\u0443 \u043d\u0430\u0436\u0430\u0442\u0438\u0439 \u043a\u043b\u0430\u0432\u0438\u0448 \u043f\u0443\u0442\u0435\u043c \u0441\u0438\u043c\u0443\u043b\u044f\u0446\u0438\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0432\u0432\u043e\u0434\u0430, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e Bluetooth. \u041f\u043e\u043b\u0443\u0447\u0438\u0432 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043b\u0430\u0432\u0438\u0430\u0442\u0443\u0440\u043d\u043e\u043c\u0443 \u0432\u0432\u043e\u0434\u0443, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112103","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041c\u0430\u0440\u043a \u041d\u044c\u044e\u043b\u0438\u043d (Marc Newlin), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u044f\u0432\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c MouseJack \u0441\u0435\u043c\u044c \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434, \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sv_SE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Bluetooth-\u0441\u0442\u0435\u043a\u0430\u0445 Linux, macOS, Android \u0438 iOS | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041c\u0430\u0440\u043a \u041d\u044c\u044e\u043b\u0438\u043d (Marc Newlin), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u044f\u0432\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c MouseJack \u0441\u0435\u043c\u044c \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434, \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-12-10T07:10:17+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-12-10T07:10:17+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhet i Bluetooth-stacken Linux, macOS, Android och iOS | ProHoster","description":"Marc Newlin, som identifierade MouseJack-s\u00e5rbarheten f\u00f6r sju \u00e5r sedan, avsl\u00f6jade information om","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Bluetooth-\u0441\u0442\u0435\u043a\u0430\u0445 Linux, macOS, Android \u0438 iOS | ProHoster","og:description":"\u041c\u0430\u0440\u043a \u041d\u044c\u044e\u043b\u0438\u043d (Marc Newlin), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u044f\u0432\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c MouseJack \u0441\u0435\u043c\u044c \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434, \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-bluetooth-stekah-linux-macos-android-i-ios","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-12-10T07:10:17+00:00","article:modified_time":"2023-12-10T07:10:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/112103","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=112103"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/112103\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=112103"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=112103"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=112103"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}