Slashdot Mirror
Wireless Keylogger Masquerades as USB Phone Charger
msm1267 writes: Hardware hacker and security researcher Samy Kamkar has released a slick new device that masquerades as a typical USB wall charger but in fact houses a keylogger capable of recording keystrokes from nearby wireless keyboards. The device is known as KeySweeper, and Kamkar has released the source code and instructions for building one of your own. The components are inexpensive and easily available, and include an Arduino microcontroller, the charger itself, and a handful of other bits. When it's plugged into a wall socket, the KeySweeper will connect to a nearby Microsoft wireless keyboard and passively sniff, decrypt and record all of the keystrokes and send them back to the operator over the Web.
I am not a security expert, but what non-nefarious purpose does this product serve?
As if having to replace keyboard-batteries every 6 months wasn't reason enough. Is there really any benefit to having a keyboard be wireless, outside of a living room TV/PC scenario?
I don't care if it's 90,000 hectares. That lake was not my doing.
Remember when we added networks to Windows 3.1? Remember how well that worked out? Remember how not having multi-user support totally didn't result in massive piles of insecure bug-ridden software full of viruses? Remember how antivirus software wasn't ever a thing?
Well, it seems we didn't learn here. Taking something that's not designed with security in mind and suddenly hitching it up to a network doesn't seem to be working well for anything really. What we've learned is that the market will quite happily replace everything we have with timebombs if it means they make a few bucks.
This is why I hate large swaths of consumer products.
If the keyboard is encrypting keystrokes and sending them to the system....and a third party device sitting in the corner with no configuration involving dumping and loading keys....then the data is NOT encrypted.
If you use the same static key, or one of a few easily derivable keys, I don't care how solid the encryption alcogrythem you use is.... I do not consider it encrypted, because the use case took "strong encryption" and turned it into "weak obfuscation".
So unless there is some esoteric trick they are using to exploit the system and get their hands on a key that should otherwise be secure.... then its a disservice to the public to even call it encryption, because unless that is the case and they were genuinely compromised from a use case that should have otherwise been secure.... then all they did was use a fancy obfuscator.
"I opened my eyes, and everything went dark again"
I've read the specs and seen the required skills to build one. If you can build one, you could come up with the relevant ideas yourself. If anything, he just saved people who want to build such a thing some time.
OTOH, he taught us not to accept strange gifts or use chargers we find lying around. Which is heaps easier than building one of those things.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
And you know, to not use wireless keyboards in any environment that could be compromised.
I have very good experience walking past grave yards whistling.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Come out of your basement, get into a corporate environment and you'll immediately spot a use case. In case that's not obvious enough, three words: Open Plan Office.
Or how about the fact that the average office building has walls that are, at best, not see-through... hmmm, I wonder if that office next to that law firm is available... what? Me spying on lawyers? Of course not officer, please come in, look around, as you can see I barely moved in yet, all I have is my laptop and my cellphone. Yeah, these new phones suck, the battery's always drained, it's almost like going back to threaded, ha, ha...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Oh, come on, people have been putting bugs in wall warts since there have been wall warts. Boris: Look, Natasha, nice little box, has constant power supply, wire for antenna. Natasha: Da. But not wood. Boris: Is now Nineteen-Sixties. Did you not see movie? Answer is "Plastic."
obviously, this will be big among executive offices, saves time trying every password they have used in the past 20 years to watch videos during phone conferences.
if this is supposed to be a new economy, how come they still want my old fashioned money?
Dang this is NOT A STORY and the claim that this can work against all Microsoft Wireless Keyboards is 100% BS, and has been since 2007, when the issue was first uncovered; covered in depth by Schneier, and remedied in all versions of the Microsoft Wireless Keyboard created since then, which use at minimum 128-bit AES; NOT XOR.
It's 2015, not 2007 people...
Did you ever wake up in the morning, with a Zombie Woof behind your eyes? -- FZ
Can I use one of these as a replacement for the original wireless keyboard receiver? If I get more than five feet from the original receiver the keyboard doesn't work. This device is probably much better.
I work in corporate environments. You're still well within the range of physical proximity attacks. Acoustic keyboard analysis works on both wired and wireless keyboards. Wired keyboards are still subject to, and perhaps even easier to listen into their EMR characteristics.
A younger generation would be better served by a general understanding of EMR, more specifically the fundamental physics of electricity, inductance, and RF. Understanding the general underlying principals from the science side, then the security side, and one needs no introduction to such attack vectors. They are natural results of knowledge.
Another reason to avoid wireless keyboards unless absolutely necessary and security is of no concern.
"Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
The receiver for my Microsoft wireless keyboard has to be 1' away from the keyboard or else I drop keystrokes pretty regularly. So unless this thing is laid right across the home-key row I'm not worried that it will pick anything useful up.
Mostly helping the hack job security companies have yet another dumb toy to trot out during demos and pentesting.
The current generation would do well to fix this shit.
It little behooves the best of us to comment on the rest of us.
Back when WiFi was a New Thing, Boeing banned them on their intranet. Many people wanted to wander around with untethered laptops, so they'd bring a WiFi hub and plug it into their office Ethernet port.
The IT people called the electronics lab for help. One day, a couple of guys were pushing an HP spectrum analyzer attached to a microwave horn antenna/converter on a cart around the office, looking for hubs. By the end of the day, they had located every microwave oven on the premises.
Have gnu, will travel.
Fine, it's harvesting keystrokes. But how does it connect to the Internet to "send them back to the operator over the Web"?
Arduino Microcontroller? Is that kind of like an Atmel one? Or one of the clones?
Is there any way I can play dumb, and get some of these from a hacker? I never ever buy wireless keyboards (just what I don't need- a less reliable human input device), but I could really use some free USB chargers.