10

Apple's Magic Keyboard is a bluetooth device which means that the hacker can potentially intercept the signal and decrypt messages or say get control over the input.

Question: Is Magic Keyboard secure enough? What does Apple do in order to make it secure?

2
  • 9
    Secure enough needs a definition for your threat model. Are you worried a noisy neighbor with no skills is snooping or the NSA is next door to catch you uploading state secrets?
    – bmike
    Jun 13 '20 at 17:14
  • New Bluetooth attacks are found from time to time, so it's important that keyboard firmware and iOS/macOS are updated. Apple does produce firmware updates for its keyboards, which is a plus point. By contrast, some Logitech firmware updates for dongles used by wireless keyboards/mice have bricked the dongle, and many smaller vendors will never produce security updates. Overall, I would trust Apple keyboard security and updates more than most.
    – RichVel
    Jun 13 at 12:01
4

It’s actually quite safe to use Bluetooth keyboards.

Since 2009 on, bluetooth keyboards have encrypted all traffic end to end with the exception of service discovery. In other words, only the advertising packets that basically say “I’m a keyboard” or “I’m a trackpad or mouse” are unencrypted. Everything else, including the authentication is encrypted.

How does macOS Sierra securely pair with Bluetooth keyboards without a code?

Entering a key or a passcode is not part of the security mechanism; its a form of Simple Secure Pairing or SSP. The passkey is just a way to identify devices to be paired. It’s definitely not a way to prevent MITM attacks.

So, is Bluetooth safe?

It’s more accurate to say “it’s safe enough for US Government standards.

Bluetooth adheres to U.S. federal security regulations, ensuring that all Bluetooth devices are capable of meeting and exceeding strict government security standards.

  • NIST Compliant: The National Institute of Technology develops security standards and guidelines for federal agencies to protect their information and information systems.

  • FIPS Approved: These Federal Information Processing Standards are developed by NIST in accordance with the Federal Information Security Management ACT (FISMA).

Further reading:

NIST Special Publication 800-121 Revision 2N Guide to Bluetooth Security

1
  • This is not true. It is insufficient to be simply compatible with the NIST standard. Bluetooth encryption modules (hardware or software) must be NIST certified FIPS 140-2 compliant to be safe enough for the Government. How do you know that the keyboard does not have a built in Trojan that attaches to the network adaptor interface through a hack in Windows and pipes all of your keystrokes to a foreign bad actor? Only when it is /certified/ at the source code level by a NIST provided 3rd party certification vendor.
    – Cerniuk
    Jan 8 at 14:23
3

This has been discussed on other SE site. Here's the link for the same:

The gist being, Bluetooth connection is encrypted, hence safe, and the computer makes you enter a code on the keyboard during the pairing process is done to protect. So this guards against the man-in-the-middle attack.

Encrypted connection between the computer and the keyboard also guards against any attempts at sniffing.

4
  • This is incorrect. The “code” that is entered is not to prevent MITM attacks, it’s for identification. Encryption alone also doesn’t guard against sniffing especially when the device uses the same public/private key pair across devices (cheap off brand devices). It’s using a unique key pair that guards against sniffing.
    – Allan
    Jun 13 '20 at 21:33
  • 1
    Identification is critical to preventing MITM attacks. Identification is how you know that your computer is connected to your keyboard, instead of your computer to the attacker, and the attacker to your keyboard. Jun 14 '20 at 2:04
  • @GlennWillen Well identification is necessary but not sufficient to prevent an MITM attack. After all, in the situation described here, an attacker could just forward the key press signals it receives from the keyboard on to the computer, then the computer gets the code it's expecting and completes the pairing without ever knowing that it's actually pairing to the attacker's device.
    – David Z
    Jun 14 '20 at 2:59
  • In theory, the way this ought to work is: the two devices use the code during key negotiation as a shared secret in order to create an authenticated connection, which does prevent MITM. However, I do not know the details of how this works in Bluetooth. It appears to me that a secure approach is used in Bluetooth 2.1 and later ("Simple Secure Pairing", en.wikipedia.org/wiki/Bluetooth#Pairing_mechanisms), and BTLE 4.2 and later ("Low Energy Secure Connection", en.wikipedia.org/wiki/Bluetooth#Bluetooth_4.2), using the code to provide MITM protection, but not earlier versions. Jun 14 '20 at 4:28
0

Unless there is an unknown vulnerability in Apple's bluetooth implementation, the actual data transfer is encrypted and secure. However, all wireless keyboards necessarily leak information about when you press keys:

  • It can be used to determine when you are using your keyboard. Probably not of use to many people.
  • Keypress timing can be used to make e.g. password guessing easier, but this is not a very practical attack as there is still a lot of guessing involved.
2
  • 1
    While what you say is technically correct re: when you press a key, just exactly how useful do you see this information being? How can timing be used to guess a password much less making guesswork “easier?” This is where your answer falls apart, but you put the nail in your own coffin, so to speak by negating the practicality of such attacks you just spent time describing,
    – Allan
    Jun 16 '20 at 12:02
  • Any attacker would need software that estimates likely key presses based on pattern of keyboard, so this is something of a theoretical attack, and only reduces the time for a brute force password-guessing attack - however, this research paper did implement this in another context. @jpa comment was accurate but more context is helpful.
    – RichVel
    Jun 13 at 11:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .