Microsoft wireless keyboards crypto cracked
Tapping up
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Security researchers have cracked the rudimentary encryption used in a range of popular wireless keyboards.
Bluetooth is increasingly becoming the de-facto standard for wireless communication in peripheral devices and is reckoned to be secure. But some manufacturers such as Logitech and Microsoft rely on 27 MHz radio technology which, it transpires, is anything but secure.
Using nothing more than a simple radio receiver, a soundcard and suitable software, Swiss security firm Dreamlab Technologies managed to capture and decode the radio communications between a keyboard and a PC. The attack opens the way up to all sorts of mischief including keystroke logging to capture login credentials to online banking sites or email accounts.
Dreamlab cracked the encryption key used within Microsoft Wireless Optical Desktop 1000 and 2000 keyboards. As most products in Microsoft's wireless range are based on the same technology other products are likely to be insecure. Max Moser and Phillipp Schrödel of Dreamlab Technologies succeeded in eavesdropping traffic from a distance of up to ten meters using a simple radio receiver. More sensitive receivers may make it possible to capture keystrokes over larger distances.
Sniffing traffic between wireless keyboards and their base stations was possible because of the weak encryption used, as explained in a white paper from Dreamlab:
To our surprise, only the actual keystroke data seems to be encrypted. The Metaflags and identifier bits aren't encrypted or obfuscated. The one byte USB Hid code is encrypted using a simple XOR mechanism with a single byte of random data generated during the association procedure.
This means that there are only 256 different key values possible per keyboard and receiver pair. We did not notice any automated key change interval and therefore assume that the encryption key stays the same until the user reassociates the keyboard. 256 key combination can be brute forced even with very slow computers today. We did not analyze the quality of the random number so far because it was not needed to successfully break the encryption.
"Wireless communication is only as secure as the encryption technology used. Due to its nature, it can be tapped with little effort," said Dreamlab's Max Moser.
Dreamlab has reported the security loophole to Microsoft. The security researchers are holding off releasing details on exactly how the hack was pulled off pending the release of a fix, which it reckons may be a difficult and drawn-out process. The security researchers have however published a video of the attack here. ®
COMMENTS
insignificant
All this talk of encryption is insignificant. my MS wireless KB (brought cos i'm a student and it was going CHEAP) has such a poor range that if someone wanted to eavesdrop they's have to be actually INSIDE the plastic body of the Keyboard. (oh, yes, the mousewheel broke after a month too.
Monitor found to be insecure as well
Can you believe Microsoft hasn't encrypted the connection between the monitor and the user's eyes yet? This is a blatent oversight that should have been fixed years ago. ...And you're worried about keyboard encryption...sheeish
This IS just to prevent keyboard conflicts
To those who are supposing this is to prevent keyboard conflicts, you are exactly right!
Probably 10 years ago or so, a story popped up about someone with one of the RF keyboards of the time, well, their computer started going crazy, they'd have random stuff typed into office, etc. It turned out, yes, they were picking up their neighbors keyboard. At this point, the RF keyboard vendors realized, hey! If the product actually becomes popular, they'll have neighbors interfering quite often. So they put on this synchronizing between the base and keyboard, using 8-bit code. It's just to avoid interference.
Rather than worrying about people getting your data over radio (which bluetooth worries about), I think they thought about this more the way the old portable phone makers did. With the analog portable phones, the phone and base would sync. But, this would just pick out the clearest channel, and set a code so your neighbor's phone base doesn't ring your phone. Your call was still in the clear, it was simply meant to avoid your phone and your neighbor's phone interfering as much as possible.
However, this certainly does bring to light the fact that keyboards really shouldn't use something so weak anymore; if people are going to pull credentials off wifi, they certainly could get them off keyboard streams. (usernames, passwords, etc.)
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
