Hi, My Name Is Keyboard
summary
Reports unauthenticated Bluetooth keystroke-injection flaws across macOS, iOS, Android, Linux and a user-interaction variant on Windows, plus a way to extract stored link keys from Apple Magic Keyboards via feature report 0x35 over USB. Exploit uses timing during the keyboard’s unplug/discoverable window to connect to L2CAP ports 17 and 19 and abuse no input no output pairing to inject keystrokes. Tools include a Python USB control-transfer fuzzer and SDP/L2CAP scripts; tested on macOS 12–14, Android 4.2.2–14, with patches rolling out from Dec–Jan and subsequent fixes.
AI-written summary · about
chapters (8)
- 0:00Introduction and motivation
- 2:01Early gaming keyboard research
- 5:54Bluetooth and HID concepts
- 9:11Analyzing Apple keyboard pairing
- 13:25Bluetooth keystroke injection
- 21:10Cross-platform vulnerabilities
- 26:18Windows and webOS findings
- 29:07Disclosure and industry impact
related talks
30mCommSec D1 - Keynterceptor: Press Any Key to Continue
52m"New Tales of Wireless Input Devices - Matthias Deeg, Gerhard Klostermeier
42m"Vulnerabilities from a grave. Forever dead or maybe alive..."
25mSweynTooth: Unleashing Mayhem over Bluetooth Low Energy
41mA Worm in the Apple: Wormable Zero-Click RCE in AirPlay... (Avi Lumelsky, Uri Katz)
51mBluetooth Hacking: Tools And Techniques
35mDeep into Android Bluetooth Bug Hunting: New Attack Surfaces and Weak Code Patterns
01h 06mBackdoors in Back Doors