Slashdot Mirror
Popular Wireless Keyboards From HP, Toshiba and Others Don't Use Encryption, Can Be Easily Snooped On (threatpost.com)
Reader msm1267 writes: Wireless keyboards made by eight different companies suffer from a vulnerability that can allow attackers to eavesdrop on keystrokes from up to 250 feet away, researchers warned Tuesday. If exploited, the vulnerability, dubbed KeySniffer, could let an attacker glean passwords, credit card numbers, security questions and answers -- essentially anything typed on a keyboard, in clear text. Keyboards manufactured by Hewlett-Packard, Toshiba, Kensington, Insignia, Radio Shack, Anker, General Electric, and EagleTec are affected, according to Marc Newlin, a researcher with Bastille Networks who discovered the vulnerability. Bastille gave the manufacturers of the keyboards 90 days to address the vulnerability, but most vendors failed to respond to their findings. Newlin said only Jasco Products, a company that manufactures the affected keyboard (GE 98614) for General Electric, responded and claimed it no longer manufactures wireless devices, like keyboards. As there doesn't appear to be a way to actually fix the vulnerability, it's likely the companies will eventually consider the devices end of life.
Use a wired keyboard.
I'm fairly sure that these rely on the "signal that can barely reach my couch let along outside my house" method of "security" :-)
In 2001 Security - Logitech Wireless Mice & Keyboards Can Be Sniffed
In 2007 Wireless Keyboard "Encryption" Cracked
And In Feb 2016 Mousejack Attacks Exploit Wireless Keyboards and Mice
And I am sure there are plenty more stories on slashdot just on this subject
I am Slashdot. Are you Slashdot as well?
https://forums.logitech.com/t5/Keyboards-and-Keyboard-Mice/Wireless-keyboard-stream-encryption-scrambling-encoding/td-p/584316
TL;DR: Logitech devices using both bluetooth and the unifying receiver are encrypted by default. Glad I don't have to toss out a bunch of devices.
It's like any software that comes with hardware. Printer software, camera software, random usb device software. It's always shit, written by some fucking idiot in china (nowadays it'll be their fuckwit cousin in India). When you pay for software it's usually fine otherwise the vendor will go out of business but the only requirement for "software that comes with hardware" is that it's legally functional; that is, it's not so useless that it allows the customer to immediately get their money back. That's a pretty low bar. It used to be limited to just those bits of hardware, but with the Internet of Shitty Cheap Things millions of people are going to experience this really, really software. I imagine Stack Overflow has already invested in the servers and ssds required to process the sheer number of "i am having the problem reading from rest json i get the error pls fix me yes" posts.
Yes, there is.
No there isn't.
Simple encryption with a companion driver doing the decryption.
Nobody expects to install a driver to use a keyboard. So they will buy the unencrypted KB from a competitor that JUST WORKS.
It would take a fifty cent chip
Wireless keyboards are under $20 retail, about half that in bulk, and margins are thin. It is likely that the OEM isn't even making 50 cents per piece. Why should they incur that expense for near zero additional sales? Anyone that cares about security isn't using a wireless keyboard, encrypted or not.
I don't suspect that anyone ever thought that they did. Hey, my wired keyboard can be snooped on from up to a million feet above, with nothing more than a child's telescope. Good thing I'm not a target, because there's also a window nearby. Can you imagine typing on a laptop on a park bench? Martians with telescopes could see my slashdot password!
Or, they could have better things to do.
Based on my cursory Googling:
Microsoft keyboards have been broken for a while.
http://arstechnica.com/securit...
Logitech apparently actually uses 128-bit AES, though the question of how they generate their symmetric key isn't exactly answered in a way that's satisfying.
http://www.logitech.com/images...
Not sure about Dell. Couldn't find much on their keyboards with my cursory Googling. They seem to mostly rebrand other people's wireless keyboards?
And Apple keyboards all seem to be bluetooth.
Logitech, easily as popular as Microsoft and more popular than ANY of the named brands, wasn't tested? Why not?
Their hardware is already known to be vulnerable.
If your keyboard doesn't use bluetooth, it is certainly vulnerable.
If your keyboard does use bluetooth, it might still be vulnerable.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Holy shit, my neighbor put up 123 different antennas directed at my rural home about two years ago. The three acre array seemed suspicious but I'm a trusting guy. Time to do away with my wireless keyboard.
Too bad Bluetooth's encryption is still so easy to break.
except for the thousands of dollars in medical expenses and lost wages when you develop carpal tunnel syndrome.
You aren't likely to develop carpal tunnel syndrome unless you're already predisposed to the condition, which is usually predicted by having a more square wrist than a more rectangular one, in addition to other anatomical features in your hand, such as its relative height and width.
And if you are predisposed to it, then lots of actions (ranging from writing to beating the captain) can cause it when repeated often.
If you aren't predisposed to it however, then you aren't likely to ever get it no matter how much you write, type, or polish the pewter.