Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Reading a couple questions and answers here recently got me to thinking.

Wireless keyboards run the inherent risk of exposing their data due to the relatively broad transmission range, and the ease with which highly sensitive receivers (remember, making an RF signal audible is more the job of the receiver than the sender) can be built.

Recent studies have also shown that even wired keyboards can be exploited via the RF emanated along their cable.

Even beyond RF sniffing, there's always the risk that some "cleaning lady" might throw on a hardware keylogger between the keyboard cable and the PC.

Are there any keyboards that are secured (via encryption, shielding, and/or other means) against monitoring via electronic signal leakage or interception?


EDIT: I suppose I should be clear, in that I'm only looking to see if there are keyboards designed to prevent interception or monitoring of their electronic signals. Please do not address any other attack vectors in answering this question, except perhaps as a sidenote. I am aware that these attacks still exist, but the measures available to defend against them are beyond the scope of this query.

share|improve this question
    
If you don't want people to talk about physical attacks like keyloggers, I'd suggest editing that out of your question. It's confusing to bring it up then say elsewhere that you don't want to include it. So are you basically just looking for systems immune from passive radio monitoring? How about optical or sonic? –  nealmcb Mar 9 '11 at 21:27
    
@nealmcb - Most physical keyloggers generally comes in one of two forms, one of which is outside the scope of my query. The first is one which intercepts or monitors a signal from an existing keyboard. This type is included in my question. The second type is built-in to a replacement keyboard that is swapped out for the victim's. Since my question is about specialized hardware that could be purchased to defend against an attack, this type of keylogger would be out of scope. –  Iszi Mar 9 '11 at 23:01
    
@nealmcb - Also, since this question is expressly targeted at monitoring of electronic signals, optical or acoustic loggers are out of scope. –  Iszi Mar 9 '11 at 23:02
    
It remains hard to figure out what sort of realistic threat model you're talking about (see the faq). In a comment on one of the answers you say you're not worried about attacks on a virtual keyboard by eavesdropping on the electronic signals coming out of the display. What assets are you trying to protect from what kind of threats? –  nealmcb Mar 10 '11 at 15:27
    
@nealmcb - This question is meant to address the electronic transmissions from the keyboard to the computer. I suppose in the case of a virtual keyboard, as @mrnap describes, those transmissions could be construed to include the monitor's emanations also, but that is a characteristic unique to that particular subset. With hardware-based keyboards, you would not be able to read a password off the monitor because (in most cases) the passwords are masked on the display. –  Iszi Mar 10 '11 at 15:38

5 Answers 5

up vote 5 down vote accepted

I wouldn't be surprised if there is hardware out there that can solve the problems you listed, but I would hazard a guess that they are very domain/environment-specific.

Then again, when you think about each problem seperately...

Actually, that last one solves all (most?) of the problems.

Seperating each problem into seperate solutions in this case (IMO) is sort of like remedying the symptoms of a disease, instead of the disease itself.

EDIT: While the question was intended to be very specifc in nature with regard to devices on the market, I don't really know if an answer can be given without adding proper context.

share|improve this answer
    
And what would you say that "disease" is? –  Iszi Mar 10 '11 at 3:42
    
@Iszi the 'disease' would be environmental security. See edited note. –  Steve Mar 10 '11 at 8:27
    
Even environmental security in most cases is compromisable by insider threats. A secure keyboard is one way of defending against such compromise. –  Iszi Mar 10 '11 at 16:26
    
@Iszi err...how? The insider could just watch the person type in the password... –  Steve Mar 10 '11 at 19:06
    
I said "one way", not "the only way" or "the ultimate way". Besides, EMF snooping is much more surreptitious than shoulder-surfing or even using a spy camera. (And again, it is the only method intended to be within the scope of this question.) –  Iszi Mar 10 '11 at 19:41

TEMPEST is the program designed to protect against EM compromise. This type of hardware is expensive, but is available for both commercial and governmental usage.

Look here for one example: http://www.advprograms.com/accessories.htm

There are other manufacturers of this equipment conforming to higher (and of course lower) levels of the TEMPEST specification. If you're not familiar with the program, wikipedia has a decent enough primer (and links to good NATO/DOD resources) of what has been declassified.

http://en.wikipedia.org/wiki/TEMPEST

share|improve this answer

Are there any keyboards that are secured (via encryption, shielding, and/or other means) against monitoring via electronic signal leakage or interception?

Yes, some (all?) Bluetooth keyboards encrypt all keystroke data transmitted over the air. The Bluetooth protocol specifies several public-key pairing techniques that are resistant to man-in-the-middle attacks. (Does any keyboard actually use any of those anti-MITM techniques?)

Related: Serverfault: How secure is a bluetooth keyboard against password sniffing?

share|improve this answer

Virtual keyboards are the most secure. If you want to have a truly secure keyboard, you need to have something onscreen that the user can click. Anything physical/wireless is vulnerable to access.

share|improve this answer
2  
Many display technologies also emit radiation which can be detected and remotely monitored, so virtual keyboards are by no means "truly secure". See e.g. en.wikipedia.org/wiki/TEMPEST –  nealmcb Mar 10 '11 at 6:22
    
@nealmcb - Good point, but @mrnap's solution is still a good answer here since the question is specifically targeted at the keyboard itself. Maybe we should start another topic on monitors? –  Iszi Mar 10 '11 at 13:52
1  
@iszi Proper security analyses are based on protecting assets from threats. A typical display of a password entry from a physical keyboard does not show the password. If the display of the virtual keyboard leaks the actual keystroke information via the same electromagnetic spectrum, its not clear under what circumstances it might be better or worse than a physical keyboard. –  nealmcb Mar 10 '11 at 15:40
    
@nealmcb - Very good point. I didn't think of that until I was replying to your other comment on the question. –  Iszi Mar 10 '11 at 15:45

An attacker with physical access can beat anything. Period.

She can replace a known secure keyboard with an identical one that contains a keylogger. Install cameras that watch the screen, keyboard, etc.

A faraday cage can help you somewhat along, but data can leak anywhere, so you need to enclose all the components of your system or use optical links to transfer data between individual systems. And then you need to monitor that optical link for bugging devices.

http://en.wikipedia.org/wiki/Faraday_cage

Certain places have entire buildings built as a faraday cage, but what good is that when KGB intercept your secured typewriters in transit and install keyloggers.

share|improve this answer
    
Thanks, but this was not intended to be yet another generic "physical access trumps all" discussion. I'm looking to see if a very specific vulnerability can be addressed through purchase of the proper hardware. –  Iszi Mar 9 '11 at 20:40
1  
Not quite true @Alex - there are secure sealed keyboards with trusted hardware platforms that are in use in some specific environments... But yes, in 99% of situations physical access wins! –  Rory Alsop Mar 9 '11 at 22:44
    
@RoryAlsop - What you describe sounds like exactly what I'm looking for in this question. Care to post your own answer? –  Iszi Mar 9 '11 at 23:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.