Attackers can exploit a critical Bluetooth security vulnerability that's been lurking largely unnoticed for years on macOS, iOS, Android, and Linux device platforms. The keystroke injection vulnerability allows an attacker to control the targeted device as if they were attached by a Bluetooth keyboard, performing various functions remotely depending on the endpoint.
Tracked as
CVE-2023-45866, the flaw exists in how in the Bluetooth protocol is implemented on various platforms. It works "by tricking the Bluetooth host state-machine into pairing with a fake keyboard without user confirmation," Marc Newlin, principal reverse engineer at SkySafe, revealed in
a blog post published Dec. 6. "The underlying unauthenticated pairing mechanism is defined in the Bluetooth specification, and implementation-specific bugs expose it to the attacker," he explained.
The vulnerability enables an attacker to pair an emulated Bluetooth keyboard with a victim's phone or computer, implementing the keyboard as a Python script that runs on a Linux computer. The attacker can then inject keystrokes, typing on the target device as if they were a Bluetooth keyboard legitimately attached to the target.
This effectively allows someone to "perform arbitrary actions as the user" on exploited devices, Newlin explains. "On Android or iOS, this includes any actions the user can perform which do not require a password or biometric authentication," such as installing apps and forwarding emails or text messages, he says. On Linux and macOS, the attacker could launch a command-prompt and run arbitrary commands as well as install apps, Newlin adds.
