7

I have bought the Logitech Wireless Presenter R400, and it includes a Wireless receiver that it should be plugged in to the computer in order for the remote send signals to the computer.

I would like to know if that receiver is a weak point that can give an attacker the ability to breach into the computer? I would like to know if you know about any attack against wireless receivers.

I guess that the Wireless reviecer is just like any Wireless card (maybe with less features) hence it isn't a good idea for me to use it with the computer.

My security needs are at the highest level, so is this device appropriate?

Improve this question
2
  • 4
    You say your security needs are at the highest level but this could mean a lot of things. To some it would mean all wireless devices are banned. To others it may mean something very different.
    – Rory Alsop ♦
    Commented Jan 16, 2012 at 12:50
  • In my situation is indeed that all wireless devices are banned, but I thought since it is a remote control maybe there's far less concern about a breach through it.
    – Hanan
    Commented Jan 16, 2012 at 19:13

4 Answers 4

Reset to default
5

It's wireless, so you might be able to sniff it if it doesn't use encryption by monitoring the connection.

However since it probably closed source you will not know if the program driver supplied is safe. Does it use RSA or AES encryption ? Even if they use these protocols, might they be extracted from either remote or receiver ?

Can someone else send signals with their remote (maybe by analyzing their remote and apply some homebrew that hasn't been published yet) ?

Wireless devices are per definition often less secure than their wired equivalents. If you want complete security, don't use it.

Improve this answer
10
  • Certainly some of Logitech's 2.4GHz products use 128-bit AES, but I can't see any indication that they include that in the R400. Their thinking is probably that you need encryption on keyboards, and maybe mice, but not on a clicker.
    – Graham Hill
    Commented Jan 16, 2012 at 11:52
  • Yea, and even with AES encryption I'm wondering if a repeater attack wouldn't be possible.
    – Lucas Kauffman
    Commented Jan 16, 2012 at 12:04
  • 1
    Ah, Lucas, I just realised we're reading the question wrong. We're thinking of an attacker compromising the 2.4GHz transmission (eavesdropping or altering it) but Hanan is wondering if this is an avenue for rooting the computer the device is connected to.
    – Graham Hill
    Commented Jan 16, 2012 at 14:34
  • mmm I think that would be highly unlikely no ?
    – Lucas Kauffman
    Commented Jan 16, 2012 at 14:43
  • 1
    And of course, at the highest level of security, you're presenting to people cleared for everything on the laptop, in a TEMPEST shielded room, with your USB ports epoxyed shut, and the threat of criminal prosecution if you attempt to plug in something bought in a shop. So you're not really going to have a problem. :-)
    – Graham Hill
    Commented Jan 16, 2012 at 14:47
3

Turns out the Logitech R400, R700 and (apparently) the R800 are vulnerable to remote keypress injection attacks; meaning that an attacker can send any keypress to the device where the presentation dongle is plugged in.

A few advisories have been published:

Thus, an attacker is able to send arbitrary keystrokes to a victim's computer system, for example in order to install malware when the target system is unattended. In this way, an attacker can remotely take control over the victim's computer that is operated with an affected receiver of a Logitech R700 wireless presenter.

c't (German) is also adding the R800 to the list: https://www.heise.de/select/ct/2019/8/1555074882087318 (German, paywall).

Finally, Heise is reporting of a possible recall program by Logitech: https://www.heise.de/security/meldung/Angreifbare-Logitech-Presenter-Hersteller-tauscht-gefaehrliche-USB-Empfaenger-aus-4423627.html?wt_mc=rss.ho.beitrag.atom (German):

Darüber hinaus brachte Logitech erstmals eine Austauschmöglichkeit ins Spiel: "Sie [die Kunden, Anm. der Redaktion] können sich auch an den Logitech-Kundendienst wenden, um einen Ersatzempfänger zu erhalten: www.logitech.com/contact".

Google translation:

In addition, for the first time, Logitech has introduced an exchange opportunity: "You [the customer, editor's note] may also contact Logitech Customer Support for a replacement receiver: www.logitech.com/contact".

Improve this answer
2

It is possible that the USB device plugged in the host computer is seen by the host computer as a kind of mouse or keyboard. As such, this would make the computer ready to accept mouse-like or keyboard-like events (as if someone was clicking or typing text).

It is conceivable that the USB device is itself ready to receive and process keyboard-like event. The clicker will not send those, of course; but Logitech also manufactures wireless keyboards and it would make sense that they reuse components between products, to save on development and production costs.

Take this two together, and you have it: possibly, you just gave any attacker a keyboard to your machine. At that point, many things are possible...

Hopefully, the clicker and the receiver have some sort of automatic cryptographic pairing procedure which reduces the possibilities of an hostile hijack (a man-in-the-middle could still be possible, since avoiding it may entail substantial computing effort from the involved devices). However, since this communication is between a Logitech device and another Logitech device, and the two of them are sold together, then there is no incentive for this protocol to be standard or at least documented. So you cannot be sure that things were done properly.

Also, any wireless receiver implies that there must be some driver software which analyzes data obtain from "the outside". Any bug in such a driver could be exploited (and yield kernel-level access to the host computer).

To sum up: yeah, there are conceivable risks for the host computer.

Improve this answer
1

There is a nice recording in English of this years Confidence (security conference taking place in Poland) showing how to hack the remote controller: https://youtu.be/ZZr-OtNFW9g?t=62

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .