Slashdot Mirror
Apple Keyboard Firmware Hack Demonstrated
Anonymouse writes with this excerpt from SemiAccurate:
"Apple keyboards are vulnerable to a hack that puts keyloggers and malware directly into the device's firmware. This could be a serious problem, and now that the presentation and code (PDF) is out there, the bad guys will surely be exploiting it. The vulnerability was discovered by K. Chen, and he gave a talk on it at Black Hat this year (PDF). The concept is simple: a modern Apple keyboard has about 8K of flash memory, and 256 bytes of working RAM. For the intelligent, this is more than enough space to have a field day. ... The new firmware can do anything you want it to. Chen demonstrated code which, when you put in a password and hit return, starts playing back the last five characters typed in, LIFO. It is a rudimentary keylogger; a proof of concept more than anything else. Since there is about 1K of flash free in the keyboard itself, you can log quite a few keystrokes totally transparently."
Why does a keyboard even need flash in the first place? Being a keyboard isn't a complex job.
---- Booth was a patriot ----
Pardon my ignorance. I have a lot of it. What is the advantage of having flash memory in a keyboard? I remember that the keyboard (at least at one time, I don't know if that's still the case) used an interrupt call to process input... But the load the keyboard placed on system resources should be so low, that there wouldn't be a need to offload that right? I have to be missing something here. It seems to me that by having something like this, you're just begging for trouble since it opens another attack surface. Anywhere you have processing and memory is a place for malware to reside. This doesn't impress me much Apple.
Unless you also have some hidden program on the computer to flash the keyboard and later download the data (in which case you could just log the keys by software), you'd need to physically remove the keyboard, flash it with a keylogging BIOS, return the keyboard, then later retrieve the keyboard to get the logged keys.
And, as they say, physical access is root access. There are an unlimited number of ways someone could compromise your computer if they are given access to the hardware and firmware. This hack is just further proof of that.
Oh, and don't let anyone lend you their keyboard.
How can I believe you when you tell me what I don't want to hear?
Microcontrollers in keyboards, BIOS flash, USB-sticks, SD-cards: Please give us hardware write protection. Whether we want our keyboards to be just keyboards, our BIOS unmodified by root kits, USB sticks which we can insert into someone else's system without worrying that our stick gets infected or boot of an SD-card, a simple write protect switch is the easiest and most reliable way.
Is the Apple implementation any different from what other USB HID makers use? I'd be kind of surprised if Apple did anything original with its keyboard design other than making them shiny and thin (and giving them no tactile feedback whatsoever.)
And if so, are other USB keyboards vulnerable to similar hacks?
Why do you assume only Apple keyboards are hackable?
I'm sure every microwave out there is "hackable" in the sense you can replace its firmware and make it burn users popcorn each time. So what?
Unless you discovered a way to hack someone's keyboard remotely without user intervention, this is not even worth mentioning on a geek site.
As the island of our knowledge grows, so does the shore of our ignorance.
If someone has sufficient permissions on your machine to update your firmware, aren't you kind of screwed already? I suppose they could swap your (external) keyboard for a compromised one, but that still implies physical access.
That said, given that the ability to update is useful, and that the flash memory size we're talking about is so small, is there a significant downside to having the OS check hashes of the firmware code on initialization?
As the article points out, "For a device as simple as a keyboard, it is hard to imagine why a firmware update mechanism is even required." There's no justification for including an update feature other than as a designed-in security hole. The keyboard CPU should be running off a ROM, or at least an MPU where the security bit has been set to prevent future changes.
This looks like a "feature" put in for development that should have been pulled before release.