21 votes

PassKey account takeover in all mobile browsers (via Bluetooth)

1 comment

  1. skybrian
    Link
    From the article: ... ... So, I guess it's fixed.

    From the article:

    There are two clear prerequisites for this attack to work against a victim on a mobile device:

    • An attacker controlled (evil) device within BLE range (< 100m)
    • A victim visiting an attacker controlled page

    ...

    All major mobile browsers were found vulnerable, in this case the vulnerability is simply allowing FIDO:/ intents to be triggerable by a page. All fixes consisted in blacklisting such URIs from being navigable.

    ...

    I would like to give special thanks to all the browsers teams for fixing this issue relatively quickly.

    So, I guess it's fixed.

    8 votes