I have a computer which is virus infected. Can I use the same keyboard on both it and a "safe/clean" computer without fear?
Keyboards these days seem to come with built in software and thus must have a small amount of memory... right?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
An USB device necessarily has some circuitry to implement the USB protocol: enough to identify itself as a keyboard, negotiate some current to draw from the host, and send key press/release events. This means that there is, in the keyboard, some skeletal CPU with its software (often dubbed "firmware"). Correspondingly, this is potentially hackable.
In particular, some keyboards have upgradable firmwares, so some malware on a machine could send a malicious upgrade to the keyboard, contaminating it permanently. This has been demonstrated for an Apple keyboard (not a gaming keyboard with an open API for running custom application, just a regular keyboard): a malicious firmware upgrade which embeds a keylogger in the keyboard itself. The really nasty part of the demo is that a firmware upgrade, by nature, is written to some sort of permanent storage (EEPROM or Flash), so it will resist poweroff states.
Conversely, if a keyboard firmware is not upgradable, then it probably is incapable (physically) of retaining any altered data when power is cut. Such a keyboard would be safe to exchange between an infected and a non-infected machines -- as long as it is not a wireless keyboard, because these ones have batteries.
However, how would you know if your keyboard firmware can be reflashed ? It is rarely documented...
Probability of keyboard-transmitted infection is still low; I have not heard of any case beyond the Apple keyboard demo. However, you've been warned.
Keyboards typically do not have any software or memory. There are a few rare exceptions, such as the Logitech G19 gaming keyboard which has a little computer built into it to run applications, but for a typical USB (or P/S 2) keyboard, you have nothing to fear.
All USB devices have software of one sort or another, but typically this software is not modifiable once the device leaves the factory, and certainly not over the USB wire.
Some less-common keyboards have upgradable firmware, but this is the exception rather than the rule.
Most wireless keyboards in particular don't even support bi-directional communication; the keyboard has a transmitter only, no receiver (which is why they don't have num lock, scroll lock, and caps lock lights). Though it is technically possible for the transmitter dongle to have some amount of programmable memory.
Certainly the cheaper the keyboard, the less likely it is to have sufficient hardware to be exploitable.