h0nk_bt_exploit

Samsung devices are vulnerable to a critical Bluetooth security vulnerability that allows an attacker to control the targeted device as if they were attached by a Bluetooth keyboard, performing various functions remotely depending on the endpoint. This vulnerability, tracked as CVE-2023-45866, affects macOS, iOS, Android, and Linux device platforms. It works by tricking the Bluetooth host state-machine into pairing with a fake keyboard without user confirmation.

On Android devices, the vulnerability is exploitable whenever Bluetooth is enabled. However, Samsung has released patches for most affected devices, although some older models may not receive updates. To mitigate the risk, users are advised to install the latest available security patches and to only enable Bluetooth when strictly necessary.

Additionally, a zero-day vulnerability, tracked as CVE-2024-44068, was discovered in Samsung’s mobile and wearable processors, including Exynos models 9820, 9825, 980, 990, 850, and W920. This vulnerability allows for arbitrary code execution and has been exploited in the wild as part of an exploit chain enabling attackers to escalate privileges on vulnerable devices.

Samsung has released a patch as part of its October 2024 security updates, and users should apply this update to mitigate the risk

perplexity.ai Answer:

There is indeed a recently discovered critical Bluetooth vulnerability that allows attackers to compromise Android, iOS, macOS, and Linux devices by simulating a Bluetooth keyboard.

This vulnerability, designated as CVE-2023-45866, allows attackers to connect to affected Bluetooth devices without authentication and inject keystrokes to achieve code execution. The attack works by tricking the target device into believing it is connected to a Bluetooth keyboard. This is done by exploiting an "unauthenticated pairing mechanism" in the Bluetooth protocol.

For Samsung devices, this vulnerability is especially relevant for older models like Galaxy S4, S5, and S6. The attack can be carried out with a Linux device (e.g., Raspberry Pi) with a Bluetooth adapter against any discoverable Bluetooth target in range, potentially up to a distance of about 240 meters.

To protect against such attacks, it is recommended:

• Disable Bluetooth when not in use.
• Use secure pairing methods.
• Perform regular software updates.
• Avoid pairing in public or untrusted environments.

It is important to note that at the time of discovery (December 2023), security updates for this issue were not yet available.

CVE-2023-45866

🧠 Tool Purpose The script simulates a Bluetooth keyboard (HID) and executes automated keystrokes on a target device using DuckyScript.

✅ How it Works

🔧 Platform Comparison

🔌 Target Device: MAC Address

• Must be entered explicitly (get_target_address()).
• Used for pairing and connection.
• Must have Bluetooth enabled and allow connections.

🧱 Technical Limitations M5Stick

💡 Alternatives with M5Stick

🔒 Security Assessment

Resource:

• https://pypi.org/project/PyBluez/

⚠️ Disclaimer The provided scripts and proof-of-concept code are intended solely for educational and private testing purposes. They must only be executed on devices that you own or have explicit permission to test.

By using these scripts, you agree to take full responsibility for any actions taken. Unauthorized use on networks or devices you do not control may be illegal and is strictly prohibited.

The author of this code is not liable for any damage, disruption, or legal consequences resulting from misuse. Always follow responsible disclosure and ethical testing guidelines.