Earlier this year, security researchers went to local suppliers of office supplies and bought numerous wireless keyboards.
“We’re in the business of scanning the enterprise airspace to look for vulnerabilities in IoT, mobile, and other wireless devices,” said Ivan O’Sullivan, CRO at California-based Bastille Networks Inc. “We look at all the wireless devices that we see broadcasting on many different protocols and look for data security vulnerabilities for our enterprise customers. So we buy all the toys and devices and hack them to find out if they’re secure.”
Overall, the team collected keyboards from 12 different manufacturers — and eight were found to be completely unencrypted in their wireless communications.
Plain text transmission
“The data that is transmitted to the USB dongle is in plain text,” said Marc Newlin, a member of the company’s research team, which means that outsiders could listen in on anything the users were typing, including sensitive documents or passwords.
“We tested with 100 percent reliability up to 250 feet, and it’s possible that the range is further,” Newlin added.
The attacker does not even have to be physically within the targeted building, he said.
All it takes to spy on the keyboards is less than $100 (€91) worth of commonly-available equipment, such as the $30 (€27) Crazyradio PA USB radio dongle, combined with a directional antenna. Those run between $20 (€18) and $80 (€72), he said.
Plus, finding susceptible keyboards is easy because they are always sending packets to their USB dongles to let them know where they are.
“These keyboards are constantly transmitting,” said Balint Seeber, the company’s director of vulnerability research.
And while it might be suspicious for a stranger to hang around an office holding a directional antenna, waiting for someone to type in a password, there are easier ways to do it.
Proof of concept
“We haven’t developed a proof of concept where you can leave behind a small device,” Seeber said, “But there have been examples of other people building small, battery-powered relay devices.”
So all a hacker would have to do is drop an inconspicuous little box behind a plant or in some other hiding place.
This is a vulnerability that has been around for years, and the problem is wide-spread.
“These aren’t no-name manufacturers,” said O’Sullivan. “These are brands that you trust.”
Vulnerable keyboards include those made by Hewlett-Packard, Toshiba, Kensington, Insignia, Radio Shack, Anker, General Electric, and EagleTec.
Secure keyboards included Bluetooth keyboards and higher-end wireless keyboards from manufacturers including Logitech, Dell, and Lenovo.
Since there is no way to update the keyboards, Seeber recommended that companies replace standard wireless keyboards with ones that use Bluetooth.
Bluetooth secure
Bluetooth is currently the most secure connection method, he said. Some manufacturers use their own encryption methods, but those might have other issues and bugs in them, he added.
“But the most secure option is to just use a wired keyboard,” he said.
Bastille also notified all the vendors involved 90 days ago, so that they could address the issue.
The company has collected all the relevant information on its KeySniffer web site, as well as some open source software that detects vulnerable wireless keyboards and mice.
IDG News Service
Subscribers 0
Fans 0
Followers 0
Followers