Wireless Keystroke Injection via Bluetooth Low Energy on Windows
Jose Pico and Fernando Perera demonstrate exploiting Windows Bluetooth Low Energy (BLE) pairing flaws to execute unauthorized wireless keystroke injection.
Summary
The Attack Surface of Bluetooth Low Energy Peripherals
Bluetooth Low Energy (BLE) human interface devices (keyboards, mice, remotes) are widely paired with modern Windows workstations and laptops.
Discovering BLE Pairing State Machine Flaws in Windows
Jose Pico and Fernando Perera analyze Windows Bluetooth stack implementations, discovering vulnerabilities in device re-connection and authentication handshakes.
Impersonating Legitimate BLE Keyboards Over the Air
The researchers demonstrate spoofing authorized BLE MAC addresses and characteristics to inject arbitrary keystrokes at high speeds without user interaction.
Remediation and Bluetooth Endpoint Hardening
The authors review Microsoft's patch deployment (CVE-2022-21999) and offer enterprise guidelines for managing wireless Bluetooth peripherals.
Related talks
Main Stage·37 min
Damien Cauquil
Breaks the BLE 5.0 channel hopping PRNG to predict future advertisement channels and enable targeted jamming of Bluetooth 5 devices.
Wireless Village·1 hr 10 min
FreqyXin
Breaks down Bluetooth Low Energy architecture, GATT services, sniffing tools, and attack surfaces in connected devices.
Main Stage·45 min
Romain Cayre · Damien Cauquil
Framework and unified protocol architecture for wireless security research, hardware abstraction, and over-the-air exploitation.