I have read many blogs on how to intercept wireless keyboard keystrokes. Similarly is there any way where we can send keystrokes to any keyboards USB receiver module? can we kick out the existing keyboard from the connection and manipulate the keyboard using some radio transmitter module?
2 Answers
In short, yes - for some keyboards. The technique used to intercept and sniff on some (mostly older than 5 years) wireless keyboards can be pretty easily leveraged to allow an attacker to transmit back to the receiver on those keyboards.
You say you are aware of blog posts that discuss how to intercept wireless keyboard keystrokes. If you are, then you know that those methods include breaking the 'encryption' of those devices. The 'encryption' used by those keyboards is as simple as XOR'ing the data with the MAC of the keyboard. Now consider an attacker has successfully obtained the key of the encryption, from there, he/she can use the same radio transmitter they used to sniff to start transmitting, instead of just passively intercepting.
Since this is RF we're talking about, there is no state-full 'connection' between the keyboard and receiver other than the predetermined protocol. This enables the attacker (that now knows the protocol, since he/she successfully sniffed the traffic) to start transmitting to the receiver pretending to be the keyboard.
An HID attack can then take place. The attacker could do many malicious things to the victim machine. Although, if the owner is using the machine, the attack is easily thwarted, simply by injecting random keystrokes or by disconnecting the receiver, so the attacker must initiate the attack at an opportune moment.
Edit: According to daniel's comment, I have tried to make my answer clearer and more accurate.
answered Apr 4, 2017 at 12:38
-
1thank you. Is there any such working project on this out there? Has anybody created this? If so, please provide me with useful links.– knobiDevCommented Apr 4, 2017 at 12:52
-
The sniffers you are talking about are 10 years old, here is a recent article that shows they can't do this anymore, and have to use replay attacks or go for the mouse instead theregister.co.uk/2016/10/24/…– danielCommented Apr 4, 2017 at 12:55
-
@daniel Although you are correct, the XOR encryption discovery is old news, the question is if there is a way. And considering the fact that most people don't buy new keyboards when they learn of a vulnerability in their current one (if they ever find out...), you can be sure that those decade old vulnerable keyboards are very much alive, not to mention companies that didn't necessarily started using strong encryption right away. Commented Apr 4, 2017 at 13:14
-
@Susmith Sorry, but I am not aware of work done on this. Commented Apr 4, 2017 at 13:36
-
I'm downvoting this one because I cant upvote my own answer. I'd be neutral if you said you could inject some characters but not the ones you wanted, or if you said it would only work for 10 year old wifi keyboards. At the moment it reads like you are saying its easy peasy and that XOR based encryption such as AES is a piece of cake.– danielCommented Apr 4, 2017 at 16:53
Probably not without physical access. The keyboard sending the keys and the receiver are paired, and the wireless signals are now encrypted so even if you somehow set up the equipment to send to that receiver you still would have to beat the encryption or your intended keystrokes would come out as some other character.
-
"the wireless signals are now encrypted" Is this really the case for all infra-red keyboards you can buy? Even the cheap ones?– PhilippCommented Apr 4, 2017 at 12:39
-
What if i could crack the encryption? link here in this blog its said that most of the keyboard use XOR encryption method so there can be only 256 keys used for encryption. Bruteforcing that is very simple. so my question is what if i could crack the encryption? can i pair my malicious device of genuine one instead?– knobiDevCommented Apr 4, 2017 at 12:40
-
Its the case for common wireless keyboards people use today, you are free to do whatever you want with your bespoke infra red keyboard tv remote control custom box.– danielCommented Apr 4, 2017 at 12:42
-
1that articles from 2007, the encryption is now claiming to be AES and its a hard problem to try and solve, maybe possible if you are there listening when the keyboard and receiver are paired but that practically requires physical access anyway.– danielCommented Apr 4, 2017 at 12:45
-
@daniel Who is claiming that where for what product? I doubt that it would be possible to build wireless keyboard for $9.99 which includes a microcontroller powerful enough to do AES encryption in realtime.– PhilippCommented Apr 9, 2017 at 20:09