Android Bluetooth Hacking

Big thank you to Brilliant for sponsoring this video! Try Brilliant for free (for 30 days) and to get a 20% discount, visit: https://Brilliant.org/DavidBombal CVE-2023-45866 allows attackers to remotely control an Android phone (and other devices) without pairing. Details: Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue. Source: Mitre See CVE details here: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45866 https://nvd.nist.gov/vuln/detail/CVE-2023-45866 How to stop / mitigate this attack: 1) Upgrade your phone / install security patches on Android for versions 11 and later. Unfortunately earlier versions cannot be patched (Android 10 and earlier) 2) Note: For the script to discover the MAC address of the phone, the phone needs to be in pairing mode. 3) Turn off Bluetooth if not being used // Script and instructions here // GitHub: https://github.com/pentestfunctions/BlueDucky // Occupy The Web Books // Linux Basics for Hackers: US: https://amzn.to/3wqukgC UK: https://amzn.to/43PHFev Getting Started Becoming a Master Hacker US: https://amzn.to/4bmGqX2 UK: https://amzn.to/43JG2iA Network Basics for hackers: US: https://amzn.to/3yeYVyb UK: https://amzn.to/4aInbGK // OTW Discount // Use the code BOMBAL to get a 20% discount off anything from OTW's website: https://hackers-arise.net/ // Occupy The Web SOCIAL // X: https://twitter.com/three_cube Website: https://hackers-arise.net/ // GitHub CODE // https://github.com/pybluez/pybluez // Amazon LINKS // Rasberry Pi 5: US: https://amzn.to/3JZKoZD UK: https