Slashdot Mirror
Apple Keyboard Firmware Hack Demonstrated
Anonymouse writes with this excerpt from SemiAccurate:
"Apple keyboards are vulnerable to a hack that puts keyloggers and malware directly into the device's firmware. This could be a serious problem, and now that the presentation and code (PDF) is out there, the bad guys will surely be exploiting it. The vulnerability was discovered by K. Chen, and he gave a talk on it at Black Hat this year (PDF). The concept is simple: a modern Apple keyboard has about 8K of flash memory, and 256 bytes of working RAM. For the intelligent, this is more than enough space to have a field day. ... The new firmware can do anything you want it to. Chen demonstrated code which, when you put in a password and hit return, starts playing back the last five characters typed in, LIFO. It is a rudimentary keylogger; a proof of concept more than anything else. Since there is about 1K of flash free in the keyboard itself, you can log quite a few keystrokes totally transparently."
Why does a keyboard even need flash in the first place? Being a keyboard isn't a complex job.
---- Booth was a patriot ----
Laptop charger hack demonstrated?
This is getting quite silly... Perhaps manufacturers should try to keep simple devices actually simple.
...Contiki?
I am TheRaven on Soylent News
Mandatory 2k long passwords to defeat possible hardware loggers.
Changed monthly, of course.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
It's a USB keyboard. That means that it communicates with the host via quite a complex protocol. A keyboard is not just a 'send a specific 8-bit signal when each button is pressed or released' device anymore. The amount of logic needed is not very large, but it's a lot more than a PS/2-style keyboard needed. The firmware could have been in ROM, but these days Flash is about as cheap as ROM and gives you the option of distributing fixes if you find bugs after the device ships.
I am TheRaven on Soylent News
Unless you also have some hidden program on the computer to flash the keyboard and later download the data (in which case you could just log the keys by software), you'd need to physically remove the keyboard, flash it with a keylogging BIOS, return the keyboard, then later retrieve the keyboard to get the logged keys.
And, as they say, physical access is root access. There are an unlimited number of ways someone could compromise your computer if they are given access to the hardware and firmware. This hack is just further proof of that.
Oh, and don't let anyone lend you their keyboard.
How can I believe you when you tell me what I don't want to hear?
If it has to have a flash BIOS for some reason, why does the flashing utility allow any image to go in without notice? Something like this should either require a signed or encrypted image that the flash utility decodes and decides is correct before putting it in. Maybe something simple as holding a distinct key sequence down on the keyboard while the utility pops up might be an alternative. This way at least the user has to be duped into knowingly flashing the keyboard, as opposed to a completely stealth compromise.
If I were making a keyboard with a flashable BIOS, rather than going the easy route and hiding a symmetric key on the chip would be eventually discovered, I'd use a SHA256 hash combined with an elliptic signing key to validate that a BIOS image was not tampered with before allowing it to be copied to the device. Yes, (barring someone breaking the public key crypto or obtaining the private key) someone could hack a particular keyboard to accept any flash image, but it would require physical access to the JTAG contacts on the device, and its well known that the game is over when an attacker obtains physical access to a machine anyway.
The firmware could have been in ROM, but these days Flash is about as cheap as ROM and gives you the option of distributing fixes if you find bugs after the device ships.
Two such examples of exactly that:
The only news here is that the same mechanism of installing these updates is able to have other third party software installed in their place as well.
Is the Apple implementation any different from what other USB HID makers use? I'd be kind of surprised if Apple did anything original with its keyboard design other than making them shiny and thin (and giving them no tactile feedback whatsoever.)
And if so, are other USB keyboards vulnerable to similar hacks?
Why do you assume only Apple keyboards are hackable?
I'm sure every microwave out there is "hackable" in the sense you can replace its firmware and make it burn users popcorn each time. So what?
Unless you discovered a way to hack someone's keyboard remotely without user intervention, this is not even worth mentioning on a geek site.
As the island of our knowledge grows, so does the shore of our ignorance.
Yeah, he should wait 24 hours and repost the whole article. That works way better around here.
Faster! Faster! Faster would be better!
That only works if you call yourself an 'editor'.
I am TheRaven on Soylent News
As the article points out, "For a device as simple as a keyboard, it is hard to imagine why a firmware update mechanism is even required." There's no justification for including an update feature other than as a designed-in security hole. The keyboard CPU should be running off a ROM, or at least an MPU where the security bit has been set to prevent future changes.
This looks like a "feature" put in for development that should have been pulled before release.
The problem here isn't really with the end user's keyboard - flashing that is a lot of work for little return, in most cases.
The bigger issue is if/when an enterprising criminal gets access at the plant that makes the keyboards. We've seen CDs/DVDs with malware installed (I'm not even thinking about Sony here); we've seen CompactFlash cards preloaded with viruses... if a batch of keyboards shipped out from manufacturing already installed with a key logger, we're really screwed - who's going to notice?
#DeleteChrome
Not entirely dumb. I have a US keyboard/top case for a late 2006 MB that began registering as a UK keyboard after a Coke spill.
That's now how you would pull off this attack. It would go something like this
"Hey, I think my keyboard's acting up. Could I borrow yours for a sec?"
"Sure."
I only need two keystrokes to hack a Mac when I have access to its keyboard: :p Start into single user mode
Cmd - "s"
Voila, root access. documented here
There are fewer illiterates than people who can't read.
Comment removed based on user account deletion
That *is* a feature. It isn't a hacked battery, it is a battery which is hacked to appear as an authentic internal tool, designed to read a certain area on a memory stick, so sony can quickly restore a problematic psp.
It was designed that way, and obscured. the 'hack' merely makes that information public and usable.