Popular Wireless Keyboards From HP, Toshiba and Others Don't Use Encryption, Can Be Easily Snooped On (threatpost.com) 85
Reader msm1267 writes: Wireless keyboards made by eight different companies suffer from a vulnerability that can allow attackers to eavesdrop on keystrokes from up to 250 feet away, researchers warned Tuesday. If exploited, the vulnerability, dubbed KeySniffer, could let an attacker glean passwords, credit card numbers, security questions and answers -- essentially anything typed on a keyboard, in clear text. Keyboards manufactured by Hewlett-Packard, Toshiba, Kensington, Insignia, Radio Shack, Anker, General Electric, and EagleTec are affected, according to Marc Newlin, a researcher with Bastille Networks who discovered the vulnerability. Bastille gave the manufacturers of the keyboards 90 days to address the vulnerability, but most vendors failed to respond to their findings. Newlin said only Jasco Products, a company that manufactures the affected keyboard (GE 98614) for General Electric, responded and claimed it no longer manufactures wireless devices, like keyboards. As there doesn't appear to be a way to actually fix the vulnerability, it's likely the companies will eventually consider the devices end of life.
Solution found (Score:2, Insightful)
Re:Solution found (Score:5, Insightful)
I hate wireless everything because it means that each of these devices has batteries I have to care about. Plus, this pairing bullshit. And the security for wireless keyboards is 100x worse than for wired ones, like observable here. Even if they use encryption (which on the outside, you can't easily find out), is the encryption secure? I doubt it uses something secure like AES because for low power devices usually weaker encryption is used. And even then issues remain. Do all keyboards of a model share the same secret key? If not, is the key non guessable? Unless I have looked at it, I won't trust them a bit. And which manufacturers actually document the protocol down to this level.
Sorry, but I do not want things to be wireless. I simply don't have the time to review each of these devices.
Re: (Score:2)
Re: (Score:2)
I do agree, wireless devices should be secure. Just right now, the missing security is a problem for me.
Re: (Score:2)
I suspect the vast majority of people wanting a wireless keyboard only wanted it because it was new and cool, and not for any practical reasons.
Re: (Score:2)
Wireless network links suck as well. I use them for mobile devices because you don't transit much data there but having wifi definitely has not eliminated the need for faster and lower latency wired links around the house.
Re: (Score:2)
Wireless keyboards typically have extremely good battery life the alkaline batteries in the dell wireless keyboard I'm typing on now are over a year old.
It has no noticeable delay and no wakeup resync delay.
All aren't equal though I have a $20 mini htpc mouse keyboard combo that is rechargeable It runs two days on a charge at the most.
Wifi? If it's important it gets a wire.
Re: (Score:2)
Re: (Score:3)
I've used a Logitech K760 for years. It's Bluetooth and has a small solar cell array across the top so it's always charged. Never have to worry about changing batteries. Has been 100% reliable used with various computers I've had over the years (currently Chromebook and MacBook Air). (Also, since it didn't make the list of vulnerable proprietary keyboards and it's Bluetooth, it should be more secure.)
Wireless really is better
Re: (Score:3)
The crappiest encrypted bluetooth keyboard is better than virtually any of these proprietary wireless systems, almost none of which use encryption and virtually all of which use common off-the-shelf wireless chips.
Logitech has something called secure connect, no idea if that is worth a crap. Not tested here, unfortunately. Their normal non-bluetooth wireless is known to be insecure, however.
Re: (Score:2)
not only is logitech encrypting the communication, they actually release security updates when vulnerabilities are discovered. https://threatpost.com/mouseja... [threatpost.com]
Re: (Score:2)
not only is logitech encrypting the communication, they actually release security updates when vulnerabilities are discovered. https://threatpost.com/mouseja [threatpost.com]...
They're NOT meaningfully encrypting the communications between their universal receiver and their devices; only bluetooth devices have meaningful encryption, and it's considered breakable anyway. That fix was for mousejacking.
Re: (Score:2)
It sounds like two of the biggest manufacturers of "good" wireless keyboards (Microsoft and Logitech) are encrypting their transmissions. I'm not surprised to find that Chinese bottom-dwellers like Insignia (Best Buy store brand) does not care about such things. I am a bit more surprised by big corporate vendors like HP.
Re: (Score:2)
Even with batteries my wireless keyboard at work goes for about a year on a set, and the mouse maybe 6 months. It's worth it to just be able to chuck the keyboard out of the way when I want to write, and to free up some space where cables would need to pass.
As for security, while it's obviously quite important I'd point out that I rarely type any of my passwords these days. They are mostly very long and impossible to remember, and simply copy/pasted out of Keepass.
Re: (Score:2)
I've been fairly happy with my Logitech wireless home theater keyboard. I believe it uses AES encryption and uses USB for charging. There also isn't any pairing to deal with either, just plug in the tiny USB receiver.
Document covering Logitech wireless encryption [logitech.com].
Even better... (Score:2)
...use a laptop; it comes with a keyboard at no extra cost.
(what?)
Re: (Score:2)
...use a laptop; it comes with a keyboard at no extra cost.
... except for the thousands of dollars in medical expenses and lost wages when you develop carpal tunnel syndrome. I use a keyboard about 10 hours per day. There is no way I am going to do that with the crappy chiclet keyboard that came with the laptop. Also, using a built in keyboard is awkward with my 43" 4k external display [amazon.com].
Re: (Score:3)
except for the thousands of dollars in medical expenses and lost wages when you develop carpal tunnel syndrome.
You aren't likely to develop carpal tunnel syndrome unless you're already predisposed to the condition, which is usually predicted by having a more square wrist than a more rectangular one, in addition to other anatomical features in your hand, such as its relative height and width.
And if you are predisposed to it, then lots of actions (ranging from writing to beating the captain) can cause it when repeated often.
If you aren't predisposed to it however, then you aren't likely to ever get it no matter how mu
Re: (Score:1)
...use a laptop; it comes with a keyboard at no extra cost.
(what?)
Not if that laptop comes with Microsoft Windows 10, it has a perfectly good keystroke logger that is turned on by default.
At least a desktop is fully upgradable if you so desire, unlike a laptop which has limited upgradability usually in memory and storage. Comparing performance and price a desktop wins over a laptop all the time. The only thing the laptop wins is in portability.
Re: (Score:3)
Agreed. I never wanted a wireless keyboard from the first day they existed, for three reasons. The pain of having to change and hunt down batteries, the utter and complete lack of security, and because it's pointless to be wireless. So other people just NOW realized there were security problems? Were these the same people who were surprised that their parents could see their drunken party photos on facebook?
Re: (Score:1)
Agreed. I never wanted a wireless keyboard from the first day they existed, for three reasons. The pain of having to change and hunt down batteries, the utter and complete lack of security, and because it's pointless to be wireless. So other people just NOW realized there were security problems? Were these the same people who were surprised that their parents could see their drunken party photos on facebook?
Depends on your computing needs. Personally, I prefer wireless to cables and as for hunting batteries my Logitech MK710 and matching mouse I only need to change them every one to two years. I also have a popup display that tells me their battery strength. My keyboard is also encrypted between itself and the unifying receiver.
Wireless range (Score:2)
I'm fairly sure that these rely on the "signal that can barely reach my couch let along outside my house" method of "security" :-)
That was one of the details wardriving and later.. (Score:1)
wireless snooping techniques confirmed: The limitations for household wireless services are strictly due to the antennas in use. Build a big/sensitive enough antenna or array of antennas and you can accurately recieve and decode most if not all of the signals, even if the consumer devices in question can't pick them up despite being much closer together.
Just because cheap electronics seem low range given the endpoints you have available doesn't mean they actually *ARE* low range for an adversary dedicated t
Re: (Score:2)
With the right antennas, NASA routinely deciphers transmissions sent with a power comparable to a CB radio coming from three times the distance to Pluto.
Re: (Score:2)
I'm sure that a makeshift homebrew directional antenna could sniff these signals out in a suburban or office park area just fine.
Even in your high-rise case, the signal could be narrowed down to a small subset of all devices. Processing the sum of a few signals to pick out "words" shouldn't be too hard, either.
Not to mention, I said three times the distance to frigging PLUTO. Presumably, attackers could get within 100m of most targets. I don't think you realize how much easier that is.
Re: (Score:2)
Also they have direct line of sight, which an attacker is very unlikely from the USB dongle, they have to look for reflections.
Re: (Score:2)
Re: (Score:3)
Never underestimate the power of a high gain directional antenna. The chip antennas in the USB dongles aren't that great.
Re: (Score:3)
Collection is then just a local device away e.g. UK spied on Russians with fake rock http://www.bbc.com/news/world-... [bbc.com] "contained electronic equipment and had been used by British diplomats to receive and transmit information".
Thats how the range problem is never an issue. The real trick is getting nations, people, groups to use and trust leaky fully imported wireless devices.
Wireless Keyboards (Score:2)
I always assume wireless keyboard are cheap consumer products built by the lowest bidder and designed by people whose primary interest is getting a product out the door in advance of or for the next big release of whatever their company's actual product is.
Most wireless keyboards' performance reflects that. It doesn't surprise me in the slightest their security is similar.
Re: (Score:2)
I always assume wireless keyboard are cheap consumer products built by the lowest bidder and designed by people whose primary interest is getting a product out the door in advance of or for the next big release of whatever their company's actual product is.
Right, I have always wondered about this, which is why I don't use a wireless keyboard for passwords even when it is available. (Yes that means using two keyboards at times.)
But my question: Has anyone studied how secure keyboards from Logitech, Apple, Microsoft and Dell are? You would think the big vendors would say something about it in their product descriptions, but I have never found anything on security. Anyone work for a keyboard manufacturer who can enlighten us?
Re: (Score:3)
Based on my cursory Googling:
Microsoft keyboards have been broken for a while.
http://arstechnica.com/securit... [arstechnica.com]
Logitech apparently actually uses 128-bit AES, though the question of how they generate their symmetric key isn't exactly answered in a way that's satisfying.
http://www.logitech.com/images... [logitech.com]
Not sure about Dell. Couldn't find much on their keyboards with my cursory Googling. They seem to mostly rebrand other people's wireless keyboards?
And Apple keyboards all seem to be bluetooth.
Re: (Score:1)
Re: (Score:1)
"But the key-exchange for AES is hard/impossible to do without adding something else into the solution."
For dedicated wireless hardware the key can be set at the factory on both the dongle and the device. A strong master key should last the lifetime of the device, and can be used to exchange session keys chosen at intervals appropriate for the application and power requirements of the device.
Re: (Score:2)
It's like any software that comes with hardware. Printer software, camera software, random usb device software. It's always shit, written by some fucking idiot in china (nowadays it'll be their fuckwit cousin in India). When you pay for software it's usually fine otherwise the vendor will go out of business but the only requirement for "software that comes with hardware" is that it's legally functional; that is, it's not so useless that it allows the customer to immediately get their money back. That's a
wishful thinking on the author's part (Score:2)
No shit sherlock (Score:5, Interesting)
In 2001 Security - Logitech Wireless Mice & Keyboards Can Be Sniffed [slashdot.org]
In 2007 Wireless Keyboard "Encryption" Cracked [slashdot.org]
And In Feb 2016 Mousejack Attacks Exploit Wireless Keyboards and Mice [slashdot.org]
And I am sure there are plenty more stories on slashdot just on this subject
Make your own submission (Score:1)
Security researchers at firm [pick a company] have [discovered] a [flaw/bug/exploit] [enabling] the collection of [data...of which we will enumerate all types to drive the point home: passwords, logins, keystrokes, pin codes, secure access numbers, credit card information, birthdays, AC posts, or even missile launch codes!]
Re: (Score:3)
Yes, there is.
No there isn't.
Simple encryption with a companion driver doing the decryption.
Nobody expects to install a driver to use a keyboard. So they will buy the unencrypted KB from a competitor that JUST WORKS.
It would take a fifty cent chip
Wireless keyboards are under $20 retail, about half that in bulk, and margins are thin. It is likely that the OEM isn't even making 50 cents per piece. Why should they incur that expense for near zero additional sales? Anyone that cares about security isn't using a wireless keyboard, encrypted or not.
"...most vendors failed to respond..." (Score:2)
In case you were curious about Logitech keyboards (Score:2)
https://forums.logitech.com/t5/Keyboards-and-Keyboard-Mice/Wireless-keyboard-stream-encryption-scrambling-encoding/td-p/584316
TL;DR: Logitech devices using both bluetooth and the unifying receiver are encrypted by default. Glad I don't have to toss out a bunch of devices.
Re: (Score:2, Insightful)
Too bad Bluetooth's encryption is still so easy to break.
Did anyone think they did? (Score:4, Interesting)
I don't suspect that anyone ever thought that they did. Hey, my wired keyboard can be snooped on from up to a million feet above, with nothing more than a child's telescope. Good thing I'm not a target, because there's also a window nearby. Can you imagine typing on a laptop on a park bench? Martians with telescopes could see my slashdot password!
Or, they could have better things to do.
No mention of Logitech (Score:2)
I'd much prefer to hear about the keyboards that did pass the test and encrypt transmissions. Logitech, easily as popular as Microsoft and more popular than ANY of the named brands, wasn't tested? Why not?
Re: (Score:3)
Logitech, easily as popular as Microsoft and more popular than ANY of the named brands, wasn't tested? Why not?
Their hardware is already known to be vulnerable.
If your keyboard doesn't use bluetooth, it is certainly vulnerable.
If your keyboard does use bluetooth, it might still be vulnerable.
Better headline (Score:2)
Popular Wireless Keyboards From HP, Toshiba and Others Don't Use Wire, Can Be Easily Snooped On
I know it's a popular joke, but it's absolutely real. If you are mildly concerned, wire beats crypto wireless, because you can implement crypto wrong a million ways, and implementing a wire wrong is not that common. Meanwhile, versus adversaries that can read the wire somehow, you'd want a wired crypto keyboard, which I'm not aware of existing.
Re: (Score:2)
I know it's a popular joke, but it's absolutely real. If you are mildly concerned, wire beats crypto wireless, because you can implement crypto wrong a million ways, and implementing a wire wrong is not that common.
So how are you going to go about wiring your cellphone?
Trusty Model-M (Score:2)
Still works after all these years, still secure from wireless snooping.
Re: (Score:2)
Not really secure from acoustic snooping though...
Re: (Score:2)
My model M uses a PS/2 connector. I have an older Northgate keyboard that does have the DIN plug. Strangely enough, the M on the Northgate keyboard is not working well. Hmmm...
How About Bluetooth Keyboards (Score:1)
I know you can pair blue tooth devices, but are newer versions of blue tooth like 4.0 encrypted and protected against someone listening in?
Also does encryption reduce battery life on the keyboard? I stopped using 2.4Ghz wireless keyboards when someone in my house and I interfered with each others keyboards. Since then we have pretty much gone wired. But I would like a wireless keyboard for a PC connected to our TV.
Re: (Score:2)
Bluetooth 2.1 and up are pretty good security wise, links are always encrypted and pairing with SSP can also protect you from an MITM attack. (e.g. using numeric comparison or passkey entry is secure from MITM. See the relevant wikipedia page [wikipedia.org] for specifics.)
Since encryption is required (and usually done in dedicated hardware), there shouldn't be a difference in battery life.
Wired (Score:2)
HP wireless keyboards ancient vulnerability (Score:2)
November 2002
http://www.theregister.co.uk/2... [theregister.co.uk]
January 2003
http://www.theregister.co.uk/2... [theregister.co.uk]
Creating a problem for a solution (Score:1)
It seems that the cited article is touting a solution in search of a problem.
How many computers that process secure information have wireless keyboards? How many computers that process sensitive information and have wireless keyboards are within 250 feet of an area where a person can set up a surreptitious sniffer system? Yep, the keyboard issue is really a non issue. Especially as wireless keyboards, in reality, have a range that is less than three meters. My bright idea of hooking the