Credit: Moritz Kindler / Unsplash
Such is the case with Apple’s Magic Keyboard, which just got a critical firmware update to patch a Bluetooth vulnerability that could potentially allow a hacker to intercept everything you type — including passwords.
The good news is that the bug won’t subject you to random attacks — a hacker would still need to get physical access to your keyboard for at least a short period of time. However, that may not be as difficult as it sounds in an office or school environment. Once the Bluetooth pairing key has been compromised, they’d presumably be able to continue monitoring whatever your type unless you removed and re-paired your Magic Keyboard to your Mac.
No Subscriptions – Get Microsoft Office Lifetime Access for Just $49.97
Even Microsoft tries to nudge you toward paying monthly for their Suite 365. The good news is that you don’t have to. iDrop News readers can get lifetime access to MS Office at 85% off the normal price…Get It Here
In a support document published earlier this week, Apple describes the issue thusly:
An attacker with physical access to the accessory may be able to extract its Bluetooth pairing key and monitor Bluetooth traffic.
The discovery of the flaw, designated as CVE-2024-0230, is credited to Marc Newlin of SkySafe, and has been patched in Magic Keyboard Firmware Update 2.0.6 — Apple’s first security update of 2024.
The flaw and corresponding fix applies to nearly all of Apple’s Magic Keyboard accessories, including the original Magic Keyboard and the updated 2021 version, plus the larger Magic Keyboard with Numeric Keypad, and both the standard and numeric keypad-equipped versions that also feature Touch ID.
Regarding the latter two models with Touch ID, even if the security vulnerability had been exploited (which is unclear), there’s no risk of someone intercepting your fingerprint.
![Apple Magic Keyboard with Touch ID closeup](/wp-content/uploads/2024/01/20240130_65b8ac78053b2.jpg)
While the Magic Keyboard has to use the standard Bluetooth keyboard profile for maximum compatibility, the Touch ID sensor can use a separate secure pairing process that employs strong encryption since it’s only intended to work with a compatible Apple silicon Mac. Further, while the Magic Keyboard with Touch ID can be used with multiple Macs and other devices, the Touch ID sensor on the keyboard can only be paired with one Mac at a time.
Note that this patch does not apply to Apple’s Magic Keyboard for the iPad since that doesn’t support Bluetooth anyway; it uses the iPad’s Smart Connector to communicate with your iPad, which is effectively a wired connection that’s not capable of being intercepted in the same manner.
How To Install a Magic Keyboard Firmware Update
Like firmware updates for Apple’s AirPods, there’s nothing special you need to do — or even that you can do — to install a Magic Keyboard Firmware Update.
The process should happen automatically in the background whenever your Magic Keyboard is paired with any Apple device, whether that’s a Mac running macOS or an Apple TV, iPhone, or iPad.
You can check the firmware version on your Magic Keyboard by opening System Settings on a Mac (or Settings on an iPad or iPhone), selecting Bluetooth, and then clicking the “Info” button to the right of your keyboard’s name.