Hacker News Reader

Comment by chc4 | Hacker News Reader

I don't use BLE PassKeys, but wouldn't the user also have to be paired with the attacker controlled BlueTooth device to get the connection request? Does the "The victim’s Authenticator connects to the attacker’s Client" step's authorization include pairing to a new device and not only allow a log-in with an already connected one?

View on HN

The QR code initiates pairing (at the FIDO level; I believe at the Bluetooth level there is actually no pairing required here).

The diagram in the post has the user device talking to the attacker device over Bluetooth, and the bug description explicitly says "An attacker within bluetooth range" - which heavily implies to me your device actually is pairing with the attacker device somehow! If already being paired with the attacker Bluetooth device is a prerequisite for this attack that's much less of a concern imo.

As far as I can tell, no pairing (or indeed any kind of logical Bluetooth connection) is required in the protocol used. The (device containing the) authenticator broadcasts a Bluetooth LE advertisement, and the "client platform" (i.e. usually the browser) has to be able to receive its contents to prove physical proximity.

Such a (by definition unidirectional) Bluetooth LE advertisement can easily be received and relayed over arbitrary distances.

IIRC caBLE ("cloud assisted bluetooth low energy") sidesteps the usual bluetooth pairing process by using out-of-band channels (QR codes, NFC) to exchange initial pairing information.

"range" here refers to physical distance (adjusting for interference). No prior pairing required.

Reply on news.ycombinator.com