News for hackers. Stuff that matters.

A comment on Bluetooth keystroke-injection in Android, Linux, macOS and iOS. Parent comment

Re:Bluetooth keystroke-injection in Android, Linux, macOS an... by magicalhippo on Saturday December 16, 2023 @04:27AM (#38662982)
> Android: disable Bluetooth when you're not using it (but you'll be vulnerable while you are).

Page says it only works for stuff that doesn't require password or biometrics.

I actively lock my phone when not using it, and surely I'd see the activity of the keystrokes being sent when using my device, no?

In that case it doesn't seem that horrible to leave Bluetooth enabled.

[ Parent | on HN ]
Re:Bluetooth keystroke-injection in Android, Linux, macOS an... by mihalycsaba on Saturday December 16, 2023 @07:36AM (#38663784)
Does this even work without pairing?
[ Parent | on HN ]
Re:Bluetooth keystroke-injection in Android, Linux, macOS an... by ranguna on Monday December 18, 2023 @03:51AM (#38680433)
The vulnerabilities work by tricking the Bluetooth host state-machine into pairing with a fake keyboard without user-confirmation.
[ Parent | on HN ]
Re:Bluetooth keystroke-injection in Android, Linux, macOS an... by Aachen on Saturday December 16, 2023 @09:49AM (#38664606)
> surely I'd see the activity of the keystrokes being sent when using my device, no?

That was my first thought as well. Then I remembered how much time my device spends in my pocket or on my nightstand

[ Parent | on HN ]
Re:Bluetooth keystroke-injection in Android, Linux, macOS an... by magicalhippo on Saturday December 16, 2023 @10:07AM (#38664737)
Right, but can it enter keystrokes when the device is locked? As in use the device "behind" the lock screen?
[ Parent | on HN ]
Re:Bluetooth keystroke-injection in Android, Linux, macOS an... by Aachen on Saturday December 16, 2023 @01:17PM (#38666469)
I don't have a device lock because I keep the thing on my body and anyone violating that will also get the password anyhow and I don't want to have to authenticate a million times a day. That logic worked until now I guess :/
[ Parent | on HN ]
Re:Bluetooth keystroke-injection in Android, Linux, macOS an... by davrosthedalek on Saturday December 16, 2023 @10:10AM (#38664762)
Not sure. Doesn't the iphone lock you out for a day if you enter your pin wrong too often? If that pin-entering can be done via bluetooth.... More a prank than an attack, but still quite annoying.
[ Parent | on HN ]