Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have bought the Logitech Wireless Presenter R400, and it includes a Wireless receiver that it should be plugged in to the computer in order for the remote send signals to the computer.

I would like to know if that receiver is a weak point that can give an attacker the ability to breach into the computer? I would like to know if you know about any attack against wireless receivers.

I guess that the Wireless reviecer is just like any Wireless card (maybe with less features) hence it isn't a good idea for me to use it with the computer.

My security needs are at the highest level, so is this device appropriate?

share|improve this question
3  
You say your security needs are at the highest level but this could mean a lot of things. To some it would mean all wireless devices are banned. To others it may mean something very different. –  Rory Alsop Jan 16 '12 at 12:50
    
In my situation is indeed that all wireless devices are banned, but I thought since it is a remote control maybe there's far less concern about a breach through it. –  Hanan N. Jan 16 '12 at 19:13
add comment

2 Answers

up vote 5 down vote accepted

It's wireless, so you might be able to sniff it if it doesn't use encryption by monitoring the connection.

However since it probably closed source you will not know if the program driver supplied is safe. Does it use RSA or AES encryption ? Even if they use these protocols, might they be extracted from either remote or receiver ?

Can someone else send signals with their remote (maybe by analyzing their remote and apply some homebrew that hasn't been published yet) ?

Wireless devices are per definition often less secure than their wired equivalents. If you want complete security, don't use it.

share|improve this answer
    
Certainly some of Logitech's 2.4GHz products use 128-bit AES, but I can't see any indication that they include that in the R400. Their thinking is probably that you need encryption on keyboards, and maybe mice, but not on a clicker. –  Graham Hill Jan 16 '12 at 11:52
    
Yea, and even with AES encryption I'm wondering if a repeater attack wouldn't be possible. –  Lucas Kauffman Jan 16 '12 at 12:04
1  
Ah, Lucas, I just realised we're reading the question wrong. We're thinking of an attacker compromising the 2.4GHz transmission (eavesdropping or altering it) but Hanan is wondering if this is an avenue for rooting the computer the device is connected to. –  Graham Hill Jan 16 '12 at 14:34
    
mmm I think that would be highly unlikely no ? –  Lucas Kauffman Jan 16 '12 at 14:43
1  
And of course, at the highest level of security, you're presenting to people cleared for everything on the laptop, in a TEMPEST shielded room, with your USB ports epoxyed shut, and the threat of criminal prosecution if you attempt to plug in something bought in a shop. So you're not really going to have a problem. :-) –  Graham Hill Jan 16 '12 at 14:47
show 4 more comments

It is possible that the USB device plugged in the host computer is seen by the host computer as a kind of mouse or keyboard. As such, this would make the computer ready to accept mouse-like or keyboard-like events (as if someone was clicking or typing text).

It is conceivable that the USB device is itself ready to receive and process keyboard-like event. The clicker will not send those, of course; but Logitech also manufactures wireless keyboards and it would make sense that they reuse components between products, to save on development and production costs.

Take this two together, and you have it: possibly, you just gave any attacker a keyboard to your machine. At that point, many things are possible...

Hopefully, the clicker and the receiver have some sort of automatic cryptographic pairing procedure which reduces the possibilities of an hostile hijack (a man-in-the-middle could still be possible, since avoiding it may entail substantial computing effort from the involved devices). However, since this communication is between a Logitech device and another Logitech device, and the two of them are sold together, then there is no incentive for this protocol to be standard or at least documented. So you cannot be sure that things were done properly.

Also, any wireless receiver implies that there must be some driver software which analyzes data obtain from "the outside". Any bug in such a driver could be exploited (and yield kernel-level access to the host computer).

To sum up: yeah, there are conceivable risks for the host computer.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.