58

A CNN article on the recent US Election hacks claims that

...the administration has traced the hack to the specific keyboards -- which featured Cyrillic characters -- that were used to construct the malware code, adding that the equipment leaves "digital fingerprints" and, in the case of the recent hacks, those prints point to the Russian government.

Now to me that sounds like total baloney. You're going to trace a character, which may in some executable code back to a specific keyboard? And you're going to know that its one particular model that is physically in one particular location?

Is this nonsense or is there something I'm missing here? Wouldn't it also be trivial to spoof whatever is the source of this info?

Improve this question
20
  • 11
    Remember that characters typed are just Unicode. I would imagine that if enough Unicode characters were collected they could hypothesize what keyboard it came from and possibly narrow it down to a keyboard used in a specific region. That said, it would take probably all of 10 sec to run code through a converter that would change the unicode to a different region. I imagine this would be trivial for just about anyone especially a government player.
    – DotNetRussell
    Jan 3, 2017 at 18:13
  • 2
    @AnthonyRussell That was my thought exactly... first that basically every Cyrillic keyboard across the world would boil down to the same unicode chars, and second that, as you said, it would be trivial to replace all the chars.
    – David says Reinstate Monica
    Jan 3, 2017 at 18:16
  • 3
    @DavidGrinberg: While it's true that every Cyrillic keyboard would produce the same Unicode characters, that does not mean they produce the same code points. In particular, й could be U+0419 or U+0418 U+0306. And I can imagine that different keyboard models use different ways to enter such diacritics, and by extension also use different encodings for those diacritics.
    – MSalters
    Jan 4, 2017 at 0:55
  • 4
    When I read “specific keyboard” I thought it meant the serial number of a specific keyboard. That's ballony. But from the comments here maybe he meant a “keyboard layout” e.g. the person made typos consistent with the standard Russian layout and character set.
    – JDługosz
    Jan 4, 2017 at 6:24
  • 3
    @MSalters Keyboards (at least any I know) do not produce code points! The keyboard only produces scancodes, indicating which key has been pressed. The interpretation of this input is entirely up to the operating system.
    – I'm with Monica
    Jan 4, 2017 at 8:20

2 Answers 2

Reset to default
64

A keyboard is not a typewriter. Keyboards produce scancodes that are interpreted by the software and mapped depending on your layout. When a key press produces a letter on your screen it's nothing more than the character value in its respective charset - keyboards don't leave "digital fingerprints" that could be traced back.

Instead, the author probably meant to say that they found strings or identifiers with Cyrillic letters in the source code. But such traces are easy to fake and wouldn't count as "hard evidence"; even metadata could have been planted.

Here's a similar case: After the Operation Aurora cyber attacks, analysts claimed they had found "Chinese source code" from which they concluded that the attack was led from China:

HBGary, a security firm, recently released a report in which they claim to have found some significant markers that might help identify the code developer. The firm also said that the code was Chinese language based but could not be specifically tied to any government entity.

Here, the case was actually stronger than the Cyrillic keyboard evidence as researchers could trace back parts of the code to a reference implementation that was only released in a Chinese paper:

Perhaps the most interesting aspect of this source code sample is that it is of Chinese origin, released as part of a Chinese-language paper on optimizing CRC algorithms for use in microcontrollers. [...] This CRC-16 implementation seems to be virtually unknown outside of China

(Source)

Improve this answer
0
5

As already stated, it's quite impossible to track keyboards. In theory it's possible to have keyboards contain some ID number that is transferred to the operating system (much like how itunes in the past knew what colour my ipod was), but appending that information to source code, Internet protocols or such so that it is traceable from the hacked system, is certainly not reality. Otherwise we'd already seen reports of it by those debugging their code or protocol messages.

I first thought about specific character encodings and it still could be the case. For example there are several parts in the ISO 8859 ("latin") standard. Many characters have the same encoding in all parts, including those that are required for scripts and such to execute. Then any extra characters to the 8859 set might give us some clues. For example it might be that when interpreting the characters using part 5 (ISO 8859-5 cyrillic) encoding, the extra characters make some sense.

Anyway, with the information at hand this is all just guessing. It may also be deliberately vague to give the impression that even your keyboards can be traced.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .