KeySweeper – Arduino-based passive wireless keyboard sniffer • Hacker News Board

Re: KeySweeper – Arduino-based passive wireless keyboard sniffer

#11

Post by SchizoDuckie » Mon, Jan 12, 2015, 5:31 PM UTC

mathetic wrote: post #9

edwintorok wrote: post #6

Does this apply to all bluetooth keyboards? Sounds like some public-key crypto could make it safe: embed some unique keys at manufacturing time and use some small crypto library (like tweetnacl) to communicate and have mutual authentication. For the paranoid there could be a way to update the keys so that not even the vendor can sniff the keystrokes. Isn't there a RFC for something similar?

That's the entire point. The crypto is not very good. Also it doesn't apply to all bluetooth keyboards because Microsoft uses a proprietary protocol to communicate apparently (at least this series of keyboards).

This is very specifically for Microsoft keyboards. There's multiple bugs that are exploited (both in the $1 receiver chip he's using and the fact that all MS keyboards start with the same bit for their mac address) that make it very easy in that specific case.

Hold my beer while I perform a table flip and throw away all my Microsoft Wireless Keyboards

Re: KeySweeper – Arduino-based passive wireless keyboard sniffer

#12

Post by dominicgs » Mon, Jan 12, 2015, 5:41 PM UTC

SchizoDuckie wrote: post #11

mathetic wrote: post #9

Earlier quoted context omitted.

That's the entire point. The crypto is not very good. Also it doesn't apply to all bluetooth keyboards because Microsoft uses a proprietary protocol to communicate apparently (at least this series of keyboards).

This is very specifically for Microsoft keyboards. There's multiple bugs that are exploited (both in the $1 receiver chip he's using and the fact that all MS keyboards start with the same bit for their mac address) that make it very easy in that specific case. Hold my beer while I perform a table flip and throw away all my Microsoft Wireless Keyboards

Interestingly Microsoft aren't the only manufacturer to use the Nordic chipset for their "proprietary" 2.4GHz keyboards. I believe that Logitech's system is based on the same protocol.

I'm unsure if Logitech keyboard are affected in a similar way, I know that this attack only affects Microsoft keyboards but they may have similar issues.

Re: KeySweeper – Arduino-based passive wireless keyboard sniffer

#13

Post by e12e » Mon, Jan 12, 2015, 5:42 PM UTC

SchizoDuckie wrote: post #11

mathetic wrote: post #9

Earlier quoted context omitted.

That's the entire point. The crypto is not very good. Also it doesn't apply to all bluetooth keyboards because Microsoft uses a proprietary protocol to communicate apparently (at least this series of keyboards).

This is very specifically for Microsoft keyboards. There's multiple bugs that are exploited (both in the $1 receiver chip he's using and the fact that all MS keyboards start with the same bit for their mac address) that make it very easy in that specific case. Hold my beer while I perform a table flip and throw away all my Microsoft Wireless Keyboards

For some info on bluetoooth, I found this:

https://penturalabs.wordpress.com/2013/09/04/bluetooth-sniff...

https://penturalabs.wordpress.com/2014/02/20/ubertooth-updat...

As far as I can tell, bluetoooth keyboards should be a bit better off. Not sure how the "secure" modes work (presumably some kind of DH-exchange?) - but apparently they're not immune to brute forcing.

Re: KeySweeper – Arduino-based passive wireless keyboard sniffer

#14

Post by tomvangoethem » Mon, Jan 12, 2015, 5:46 PM UTC

kawsper wrote: post #7

pjonesdotca wrote: post #2

Looking at the list of projects also done (by going to root of url) is quite impressive. http://samy.pl/

It found my unique Imgur username. So I guess that is where he gets the username from.

If you're curious on how he "finds out", check out his other video (Quickjack - Hacking Facebook likes with Clickjacking): https://www.youtube.com/watch?v=bCkSVGhIEb4#t=217

Re: KeySweeper – Arduino-based passive wireless keyboard sniffer

#15

Post by rasz_pl » Mon, Jan 12, 2015, 5:56 PM UTC

edwintorok wrote: post #6

Does this apply to all bluetooth keyboards? Sounds like some public-key crypto could make it safe: embed some unique keys at manufacturing time and use some small crypto library (like tweetnacl) to communicate and have mutual authentication. For the paranoid there could be a way to update the keys so that not even the vendor can sniff the keystrokes. Isn't there a RFC for something similar?

its a reproduction of 4 year old hack

http://www.remote-exploit.org/articles/keykeriki_v2_0__8211_...

it doesnt apply to ANY bluetooth keyboard, only to some old Microsoft branded wireless keyboards.

Re: KeySweeper – Arduino-based passive wireless keyboard sniffer

#16

Post by stygiansonic » Mon, Jan 12, 2015, 6:05 PM UTC

I'm assuming it was intentional, but I love how the page is structured somewhat like a page from the NSA ANT catalog[0][1]. The device itself seems like it would fit right in to that list.

0. https://www.eff.org/files/2014/01/06/20131230-appelbaum-nsa_...

1. https://en.wikipedia.org/wiki/NSA_ANT_catalog

Re: KeySweeper – Arduino-based passive wireless keyboard sniffer

#17

Post by bithush » Mon, Jan 12, 2015, 6:14 PM UTC

This is a beautifully done hack.

Using a legitimate USB charger. The GSM radio for 2G internet broadcast. The built in battery for short term unplugged continued sniffing. Trigger word SMS messages. Live streaming web portal.

That is very, very cool. This is the kind of stealth monitoring device people just would never think to check and could easily be replaced without the user being any the wiser.

This is a beautiful example of a real hack superbly executed. Bravo.

Edit: Just realised this is the guy (or team?) behind EverCookie.

Re: KeySweeper – Arduino-based passive wireless keyboard sniffer

#18

Post by spydum » Mon, Jan 12, 2015, 6:25 PM UTC

perhaps the team managing the centcom twitter account[1] should be checking their offices? :)

[1] http://therightscoop.com/breaking-centcom-twitter-youtube-ac...

Re: KeySweeper – Arduino-based passive wireless keyboard sniffer

#19

Post by adamvalve » Mon, Jan 12, 2015, 6:31 PM UTC

SchizoDuckie wrote: post #11

mathetic wrote: post #9

Earlier quoted context omitted.

That's the entire point. The crypto is not very good. Also it doesn't apply to all bluetooth keyboards because Microsoft uses a proprietary protocol to communicate apparently (at least this series of keyboards).

This is very specifically for Microsoft keyboards. There's multiple bugs that are exploited (both in the $1 receiver chip he's using and the fact that all MS keyboards start with the same bit for their mac address) that make it very easy in that specific case. Hold my beer while I perform a table flip and throw away all my Microsoft Wireless Keyboards

I recently switched back to usb Microsoft Natural keyboard for comfort from multiple versions of Microsoft wireless ergonomic keyboards but this hack makes me value the wire even more.

Re: KeySweeper – Arduino-based passive wireless keyboard sniffer

#20

Post by tylersmith » Mon, Jan 12, 2015, 6:48 PM UTC

bithush wrote: post #17

This is a beautifully done hack. Using a legitimate USB charger. The GSM radio for 2G internet broadcast. The built in battery for short term unplugged continued sniffing. Trigger word SMS messages. Live streaming web portal. That is very, very cool. This is the kind of stealth monitoring device people just would never think to check and could easily be replaced without the user being any the wiser. This is a beautif…

He's done a number of (in)famous things.

E.g. http://en.wikipedia.org/wiki/Samy_%28computer_worm%29