10

And are there any mitigations except using a wired keyboard?

Improve this question
1
  • 2
    What type of keyboard are you talking about? Bluetooth? If so, what version of Bluetooth?
    – Neil Smithline
    Commented May 7, 2016 at 22:06

3 Answers 3

Reset to default
6

Here is something interesting from Bruce Schneier's blog:

Many wireless keyboards have a security vulnerability that allow someone to hack the computer using the keyboard-computer link. (Technical details here.)

An attacker can launch the attack from up to 100 meters away. The attacker is able to take control of the target computer, without physically being in front of it, and type arbitrary text or send scripted commands. It is therefore possible to perform rapidly malicious activities without being detected.

You can find on market secure wireless keyboards, which are using 128-bit AES encrypted wireless connection back to your computer, so you can check for that.

Another useful information from Logitech whitepaper:

Encryption

Computer keyboards process very private or sensitive information like passwords, credit card numbers, or personal messages. Since the range of an Advanced 2.4 GHz device may reach several tens of meters in an open environment, it is critical to take adequate measures to prevent eavesdropping.

Advanced 2.4 GHz applies state-of-the-art encryption to the keyboard reports. Since the displacements of a mouse would not give any useful information to a hacker, the mouse reports are not encrypted.

Encryption is limited to the wireless link between keyboards and the receiver. Encryption is totally transparent to the software which receives clear data from the receiver over the USB. This means that the Advanced 2.4 GHz encryption provides no protection against hackers who are able to get physical access to the PC, or who are able to remotely install spy software on the PC.

The encryption applies to all standard keyboard keys (a, s, d, f...) and modifiers (Shift, Ctrl, Alt...). The multimedia keys (Play, Pause, Mute...) that may be implemented in some keyboards are transmitted in clear text.

Encryption Algorithm

The encryption method consists of hiding the wireless messages with a cryptogram. The selected algorithm is the AES 128-bit cipher, which has been adopted as an encryption standard by the US government. As of today, the only known way to crack it is to try all possible keys. Even if it was possible to test 1 billion keys per second, billions of years would be necessary to try all combinations.

AES is based on symmetric 128-bit keys, “symmetric” meaning that the same key is used to encrypt a message in the keyboard and to decrypt the message in the receiver.

Generation of Encryption Keys

When a device that requires encryption is paired to a receiver, the pairing process includes the generation of 128-bit encryption keys. The same unique key is constructed both in the keyboard and in the receiver based on random values exchanged during the pairing procedure.

Note that the encryption keys are never transmitted over the air. By spying the packets exchanged during the pairing process, a hacker would not be able to find the encryption keys without knowing the secret algorithm implemented to construct them.

The initial encryption keys are programmed at the factory when the devices are paired to their receiver.

The encryption keys are stored in a non-volatile memory area of the keyboard and receiver. As this is hardware encrypted, software cannot access the keys.

I'm not promoting Logitech keyboard, I just took an example of how they implemented AES encryption with wireless keyboard.

Improve this answer
4
  • Note that this vulnerability affects encrypted keyboards.
    – Ángel
    Commented May 7, 2016 at 22:24
  • 2
    There might be a problem with trusting keyboards that say they use "AES" encryption though: how do they implement the encryption? For all we know, it could be AES in ECB mode, in CBC mode with a non-random IV, (insert all the cryptography wrong answers here). Plus...that key exchange done with a "secret algorithm"? Not very confidence inspiring...
    – Nasrus
    Commented May 8, 2016 at 7:10
  • 1
    The problem isn't really in the communication with the keyboard, but with the wireless mice as those are "unencrypted" and allow you to also insert commands for the keyboard.
    – hspaans
    Commented May 8, 2016 at 7:26
  • 2
    Wow, the devices agree on a symmetric key without ever exchanging they key itself and there's no mention of an asymmetric cipher? "without knowing the secret algorithm" - but didn't Logitech just say it was AES-128? I think this has lost something in the translation.
    – symcbean
    Commented May 9, 2016 at 15:42
1

If you mean man in the middle, and not eavesdropping (which the previous answer went into), then one way of safeguarding is to take the keyboard and receiver somewhere else and check it works on another computer.

For example if I was paranoid I could imagine that someone at work could swap my USB receiver with one paired to some hidden computer. I would type on my keyboard, it would (without me knowing) send to the hidden computer which would log the keystrokes and also re-transmit to the receiver plugged into my computer. But if I took what I thought was my keyboard and receiver somewhere else they would not be paired and I would know something was up.

Improve this answer
1
  • Or like you said, use a wired keyboard and check for weird ass suspicious adapters or KVMs, but even then a key logger could be inside the keyboard or the other side of the computer case.
    – daniel
    Commented Mar 1, 2017 at 17:34
1

Not very... check out this demonstration.

https://samy.pl/keysweeper/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .