"Once paired, an attacker in close physical proximity to you could use their device to masquerade as your affected security key and connect to your device at the moment you are asked to press the button on your key. After that, they could attempt to change their device to appear as a Bluetooth keyboard or mouse and potentially take actions on your device."
Why is a bluetooth device allowed to spontaneously change its type and suddenly become an authenticated keyboard and/or mouise? Could this be done to insecure BT headphones or is something specific to a security key? Is the security key actually a keyboard?
I'm not sure if it's identical in the Bluetooth world but the USB keys do present as a HID keyboard because the one-time pad & TOTP functionality require it to emit a string of random characters and there's no other generic way to do that.
The fact that paired devices are able to arbitrarily change their profile long after pairing seems to be the real issue here, and probably what was patched in yesterday's iOS/macOS releases.
There is nothing on this in the security notes to these updates, but my guess is that the CVEs will be disclosed in a bit.
There is no such thing as "device type" in BLE. Any device can implement a number of profiles, and the list can change at will. A few are mandatory like GAP and GATT, others are optional, like battery profile, U2F, or custom fw update channels. Limiting profiles used or changes to that list would break many use cases (eg: DFU over BLE)
Comments
"Once paired, an attacker in close physical proximity to you could use their device to masquerade as your affected security key and connect to your device at the moment you are asked to press the button on your key. After that, they could attempt to change their device to appear as a Bluetooth keyboard or mouse and potentially take actions on your device."
Why is a bluetooth device allowed to spontaneously change its type and suddenly become an authenticated keyboard and/or mouise? Could this be done to insecure BT headphones or is something specific to a security key? Is the security key actually a keyboard?
I'm not sure if it's identical in the Bluetooth world but the USB keys do present as a HID keyboard because the one-time pad & TOTP functionality require it to emit a string of random characters and there's no other generic way to do that.
That's what I thought too, but it seems like FIDO CTAP over BLE is its own thing and does not use Bluetooth HID: https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-cl...
The fact that paired devices are able to arbitrarily change their profile long after pairing seems to be the real issue here, and probably what was patched in yesterday's iOS/macOS releases.
There is nothing on this in the security notes to these updates, but my guess is that the CVEs will be disclosed in a bit.
There is no such thing as "device type" in BLE. Any device can implement a number of profiles, and the list can change at will. A few are mandatory like GAP and GATT, others are optional, like battery profile, U2F, or custom fw update channels. Limiting profiles used or changes to that list would break many use cases (eg: DFU over BLE)