Summary
A vulnerability was recently discerned by Marc Newlin, Principal Reverse Engineer for Skysafe. This vulnerability, classified as CVE-2023-45866 allows unauthenticated keystroke-injection through Bluetooth. This is done by tricking the Bluetooth host machine into pairing with a fake keyboard through an unauthenticated pairing mechanism defined in the Bluetooth specification.
Impact Assessment
The vulnerability impacts a number of devices, the full catalog of which is not available at this time, but there have been tests with:
- Android – Vulnerable when Bluetooth is enabled
- Linux/BlueZ – Requires Bluetooth to be discoverable or connectable
- iOS and macOS – Vulnerable when Bluetooth is enabled and a magic keyboard has been paired with the phone or computer
Regardless of these tests, this vulnerability has the potential to affect all Bluetooth-capable devices. The vulnerability can allow a nearby or network-adjacent attacker to connect to a vulnerable device over unauthenticated Bluetooth and inject keystrokes for malicious activity.
What it means for you
Review your use of Bluetooth-capable devices and disable connectivity on devices to prevent malicious exploitation of this vulnerability. Review vendor recommendations for any Bluetooth-capable devices and be on the lookout for patches that may become available. This vulnerability shows that Bluetooth is inherently unauthenticated. Therefore, use of the protocol should be limited whenever possible.
Remediation
Google has announced that fixes for the issues that affected Android 11 through 14 are available. All currently-supported Pixel devices will receive this fix via December OTA updates.
BlueZ Linux Bluetooth protocol has provided a patch to this vulnerability.
Not many vendors have produced patches for this vulnerability yet.
Business Implications
This vulnerability allows a network adjacent attack to inject keystrokes into a user’s device. This can allow them to run commands in the context of the user. Depending on the access of the user, the impact could change dramatically. However, data loss, disclosure, and exfiltration are all possible consequences as is the installation of malware.
Access Point Technology Recommends
Review use of Bluetooth protocol: This vulnerability depends on the attacker being able to connect to the device using Bluetooth. Depending on use case it is possible to mitigate this vulnerability by completely disabling Bluetooth capability on devices.
Stay informed: Many vendors have not provided patches to this vulnerability yet. It is paramount to stay on top of this CVE to ensure that if a patch become available, it is applied promptly.
Associated Bulletins
https://github.com/skysafe/reblog/tree/main/cve-2023-45866
https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/profiles/input?id=25a471a83e02e1effb15d5a488b3f0085eaeb675
.webp)
.png)
