I'm not sure if it's identical in the Bluetooth world but the USB keys do present as a HID keyboard because the one-time pad & TOTP functionality require it to emit a string of random characters and there's no other generic way to do that.
The fact that paired devices are able to arbitrarily change their profile long after pairing seems to be the real issue here, and probably what was patched in yesterday's iOS/macOS releases.
There is nothing on this in the security notes to these updates, but my guess is that the CVEs will be disclosed in a bit.
Comments
I'm not sure if it's identical in the Bluetooth world but the USB keys do present as a HID keyboard because the one-time pad & TOTP functionality require it to emit a string of random characters and there's no other generic way to do that.
That's what I thought too, but it seems like FIDO CTAP over BLE is its own thing and does not use Bluetooth HID: https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-cl...
The fact that paired devices are able to arbitrarily change their profile long after pairing seems to be the real issue here, and probably what was patched in yesterday's iOS/macOS releases.
There is nothing on this in the security notes to these updates, but my guess is that the CVEs will be disclosed in a bit.