Could the USB-Receiver of a wireless mouse/keyboard be a security risk?

Question

I bought a wireless keyboard and mouse from a no-name brand (made in China) with a USB receiver. I'm currently wondering if the USB receiver could be compromised in a way, that my computer could get infected with malware or that allows someone to gain access to my computer.

Should I be more careful with such USB sticks? How can I check if the USB receiver is clean? I'm not sure if I should use the keyboard/mouse, am I too cautious?

I quote from an article:

"If your mouse has programmable memory, like a gaming mouse that allows you to program macro buttons, the mouse itself could store and spread malware.

To make matters worse, there are no known defensive mechanisms when it comes to attacks through USB devices. The reason is that all of that well-paid-for malware detection software you purchased can’t detect firmware that is running on USB devices.

The good news is there isn’t really any monetary gain in creating viruses that specifically target hardware like computer mice, but malware can have an effect on the drivers that mice utilize, and this may result in hardware issues like key-swapping or keys not working."

Would you agree with that analysis?

Answer 1

I'm currently wondering if the USB receiver could be compromised in a way, that my computer could get infected with malware or that allows someone to gain access to my computer?

It could. Malicious malware could be programmed into any of the controllers to do some funky stuff. Unless the mouse enumerates as anything other than a generic mouse, it's pretty unlikely. Worst case maybe some zero-day vuln in the mouse drivers (highly impractical).

Should I be more careful with such USB sticks?

One should never plug unknown USB drives into a computer one does not wish to get infected.

How can I check if the USB receiver is clean?

Fundamentally, you probably can't ever know for sure. But you could break it open, look at all the chips in the device, see if any have memory. If it does, dump the memory and perform reverse engineering to see if any routines looks suspicious. This does not cover ASICs, probably much too hard to verify without serious equipment.

I'm not sure if I should use the keyboard/mouse, am I too cautious?

Evaluating on the standard of an average user's risk, yes, you're probably being too cautious. But if you're dealing with highly sensitive data, it's best to know even your peripheral manufacturers.

Would you agree with that analysis?

Yes, malware in a keyboard or mouse is an impractical, usually targeted, attack. I would not expect it out of a commercial product. That would probably betray the companies objective to make as much money as possible selling products when the malware is found.

Answer 2

Since your hardware is wireless, it means an attacker does not need physical access to potentially hijack it. They just need to be within radio range. If your keyboard can be hijacked, then so can your computer.

One critical aspect is which kind of wireless we are talking about. I would be wary of wireless devices that are not Bluetooth but instead rely on more rudimentary RF protocols. Bluetooth is a complex protocol. But your mouse and keyboard may be using a much less sophisticated radio transmission scheme, that can be reversed engineered with moderate difficulty.

Look up "KeySniffer" for example. Note that Bluetooth devices have flaws too, and many devices will not get any patches for vulnerabilities that are discovered post-manufacturing. A keyboard is treated almost like a disposable item.

Try to find out more about your equipment - more specifically identify the wireless technology being used. Locate the datasheet if possible, also look at the stickers, the FCC certifications if any, that kind of stuff. In particular, look at the frequency ranges. They can provide some clues.