Hi My Name is Keyboard

Marc Newlin opens with a gaming keyboard project that stalled. A USB fuzzer bricked a Dell dongle, and later firmware updates turned out to be encrypted with a key derived only from image size. That pushed the research toward Bluetooth and Apple hardware, which he had long assumed was beyond his reach.

The core of the talk covers Apple's Magic Keyboard, which talks over USB when plugged in and Bluetooth when not. Newlin found that the Bluetooth link key was sent to the keyboard over USB in a HID feature report. The key could be read back through the lightning port, or during a timing window at unplug over unauthenticated Bluetooth. Writable USB identifiers could also let an attacker pull the key from a Mac. Using a spoofed address during reconnection, he force-paired with macOS, iOS, Android and Linux hosts without confirmation and injected keystrokes, including at the Android lock screen. Windows required a user click but still allowed the pairing. The root cause traces to the no-input, no-output pairing mode in the Bluetooth specification.

The takeaway is that long-trusted Bluetooth Classic HID behaviour and everyday devices deserve the same scrutiny as new products. The patches also had side effects, such as breaking Android Fast Pair and Linux game controller support. Newlin published proof-of-concept code and encourages researchers to test technology people assume is secure.