Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I recently purchased a keyboard replacement for my laptop, manufactured out of country.
Is it theoretically possible for a hardware keylogger to be installed? If so, would it be possible to transmit data remotely?
The replacement itself is quite thin and doesn't look like it has any flash memory devices.
Yes, it would be possible for a laptop keyboard replacement to have a keylogger installed. While they are quite thin, they still have a small low-power microcontroller chip which processes the keyboard input. A different microcontroller of the same form-factor that has its own flash memory and which keeps a log of keystrokes could easily be installed instead. Transmitting the data remotely would also be possible simply by adding a transmitter to the system (which can be very small and very thin).
The chances of a hardware keylogger existing in the keyboard replacement you purchased are remote, unless you work with classified or otherwise valuable information. If it really concerns you, you should try to buy the keyboard locally off the shelf. This will ensure that you are getting the same keyboard that anyone else would get, and that no modifications have been done beforehand specifically for you.
You should be aware that virtually all consumer keyboards actually act like wireless keyloggers in that they emit electromagnetic radiation that specifies the key pressed whenever you press a key. This is not an intentionally malicious design decision, but an unfortunate result of the type of electronics that are used. While it does not mean that keyboards will store what you type, it does mean that someone who is dozens of meters away with specialized equipment may be able to detect what is being entered on the keyboard. Just as with getting a keylogger, the risk that this will be used against you is low.
Yes, it is theoretically possible that any keyboard contains a keylogger. That the keyboard is thin doesn't mean it's not possible (especially not if the keylogger is part of the original design of the keyboard). Given a powerful connection such as USB, it is also possible that a keylogger would be able to transmit data over the internet. Or, as Lie Ryan suggests, data could just be transmitted over 3G.
But is likely, or something you should worry about? For a normal home user, not really. As long as you don't work in some very sensitive and special area, I wouldn't loose any sleep over it.
Yes, a general purpose chip that can drive a keyboard, have 3G connectivity, and be generically programmable can be very small and very thin. Some example chips of this size:
Special purpose key logger chips can be made even smaller than that, with small 3G antenna that can be very small and thin like these ones:
