Apple Updates Magic Keyboard Firmware to Block Bluetooth Monitoring
Last week, Apple released a firmware update for all the Mac versions of the Magic Keyboard, bringing it to version 2.0.6. This is not news that most TidBITS readers can use, but it’s yet another indication of how important digital security has become in the modern world. With the previous version of the firmware in the Magic Keyboard, an attacker with physical access to the keyboard could extract its Bluetooth pairing key and use that to monitor Bluetooth traffic, presumably whatever was typed.
You’re probably thinking, “That sort of thing only happens in movies!” And you’re right, but the point is that an attack that seems like it could only come from the fevered brain of a Hollywood scriptwriter was indeed possible. Crazy, eh?
To see if master hackers in your home or office could eavesdrop on your Magic Keyboard’s keystrokes, open System Settings > Bluetooth and click the info ⓘ button next to the keyboard to find the firmware version. You can also Option-click the Bluetooth icon in the menu bar. My seldom-used Magic Keyboard initially showed a firmware version of 1.6.0 but updated to 2.0.6 in a few hours; Howard Oakley reported that one of his two Magic Keyboards updated to 2.0.6, while the other stuck at 1.6.0. Apple says the firmware update will be delivered automatically in the background while the Magic Keyboard is actively paired to a device running macOS, iOS, iPadOS, or tvOS. There’s no way to install it manually, but again, unless you’re a high-value target, don’t stress about it. Turning the keyboard off and back on might nudge it to update, as might asking Bluetooth to Forget This Device and re-pairing it.
I don’t have an ⓘ next to the keyboard in System Preferences, maybe that’s a post-Monterey thing? Luckily option-clicking the Bluetooth icon in the menu bar (once I turn that on) works, and tells me my keyboard has a firmware version of 1.4.1. I’ll leave the keyboard on and paired for a while to see if it updates.
Thanks to @blm for the tip about option-clicking on the BT icon in the menu bar. I didn’t know about that secret handshake…
For those with old Macs running Monterey, another way to discover the version of firmware installed on a Magic Keyboard is through the System Information application. Select Bluetooth from the Hardware list, and the keyboard’s firmware version will be displayed (along with that of other connected BT devices - mice, AirPods, etc).
I found that my Magic Keyboard (on an M1-mini with 12.7.2) was already at 2.0.6. I’m safe from nearby eavesdroppers
To confirm and slightly expand upon David C’s comment; on Big Sur there is no firmware info reported in the Bluetooth dropdown from the main menu, but an option+click on the menu>System Information… >Bluetooth will provide it and much more.
In my case I see Firmware Version: 0x0206, which I’ll assume is equivalent to the 2.0.6 value mentioned by Adam and Howard Oakley.
To give credit where it’s due, @ace also mentioned that in the article.
Option-clicking on a menubar item is a pretty standard way to get more information. For example, Time Machine, WiFi, Sound, and Bluetooth all do (on Monterey, and there may be others that I don’t have on to try).
So, I finally got around to doing this to my five (count 'em, five!) Magic Keyboards, spanning both numpadful and numpadless models with and without Touch ID. Sometimes the process was quick, sometimes the process took nearly a day, all of them upgraded to version 2.0.6 from varying firmware versions both higher and lower once they were paired to Bluetooth and you waited a little while. The original Apple Wireless Keyboards (using two AA batteries) doesn’t get these updates, but I connected those two anyway as well, just to see if they worked at all; one of them immediately lost power and wouldn’t hear of battery replacements because the dry-cell batteries already in there had welded themselves in position and would not come out no matter how hard I smashed the keyboard against the desk, the other worked and I freed it of its precious burden but will probably never use it ever again anyway because both macOS and iOS warn you that using it might interfere with Wi-Fi performance.
All of which is by way of saying that I think it’d be awesome if you could update over USB, really. I appreciate that you have to be seriously anal-retentive to do what I just did, but still, it shouldn’t be this hard to update firmware at a whim.
Oh, and there’s actually a difference between Magic Keyboard and Magic Keyboard (2021) which I had not noticed at the time. (You have the latter if the corners are more rounded.) It doesn’t make much of a practical difference, but the top right key goes from being Eject to Lock. I daresay iOS is already treating them identically, anyway (I didn’t check).