Wireless Presenters Attacked Using an Arduino

An anonymous reader writes "This week Dutch security researcher Niels Teusink described a method of attacking wireless presenter devices at an Amsterdam security conference. He had a demo showing how it is possible to use an Arduino and Metasploit to get remote code execution by sending arbitrary keystrokes to the presenter dongle. He has now released the code and made a blog post explaining how it all works. Better watch out the next time you're giving a presentation using one of these devices!"

This is why standard protocols help

[Anonymous Coward]

While Bluetooth certainly has its issues and took a while to address all the early security concerns, I really wish wireless device creators would stop rolling their own protocols. With limited engineering, they are almost certainly guaranteed to do it badly. As of Bluetooth 2.1, all communication aside from service discovery is encrypted. There are still pairing exploits and implementation defects, but at least they have the core idea right. In order to monkey with a Bluetooth presentation remote, you would have to (a) discover the shared key during the speakers presentation, (b) convince the presenter to redo pairing prior to speaking and somehow get them to pair with your evil device instead (has a Bluetooth man-in-the-middle attack been tried yet?), or (c) give up and settle for just jamming the communication, causing a whopping 30 seconds of confusion. If you design a wireless protocol now without over-the-air encryption, you are doing it wrong.

Re:This is why standard protocols help

[mc6809e]

While Bluetooth certainly has its issues and took a while to address all the early security concerns, I really wish wireless device creators would stop rolling their own protocols.

Yeah, but then the maker would have to licence the technology and that adds cost. The chip used in the device doesn't come with Bluetooth. It's a very simple chip.

I suspect that the problem here is that the engineer just didn't think about security.

Re:TV / VCR Remote in class

[fuzzyfuzzyfungus]

In many of these cases the little proprietary receiver dongle accepts arbitrary keystrokes, not just the ones that the remote has buttons for, because it is exactly the same item as the one being sold(under that brand, or one or more others) in a package with a wireless keyboard and often a mouse as well. Some kits come with everything in one box, receiver, keyboard, mouse, little powerpoint clicker widget.

In other cases, I imagine, the engineer in charge of knocking together the receiver unit (correctly) realized that implementing a general-purpose system for taking arbitrary keycodes encapsulated in whatever the proprietary RF protocol is and dumping them to the host system just like any USB HID device wouldn't be much harder than implementing just the 6 keycodes found on revision 1 of Product X and would save him from having to do it again when revision 1.1 adds another couple of buttons, and revision 2.0 has to have a special button for the ribbon interface, or whatever it happens to be.

Re:In summary

[fuzzyfuzzyfungus]

I would agree that the desire for "cheap" is arguably behind this problem; but I would disagree about "shiny". The problem isn't that the protocol is general purpose(particularly in those cases where the receiver was sold in a set that contained a mouse and/or keyboard in addition to the little PPT remote...) but that absolutely no useful effort was made to apply what we already know about authentication and encryption. For just slightly more, you could just have a bluetooth device that(while certainly not free of security issues throughout its history) at least takes security into account, and isn't some poor bastard who knows very little about crypto reinventing the wheel at the last second.