Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeySweeper – Arduino-based passive wireless keyboard sniffer

samy.pl

Post reply on HN
Print view View original

51–60 of 61 posts

Re: KeySweeper – Arduino-based passive wireless keyboard sniffer

#51

Post by cortesoft »

tokenizerrr wrote: post #44
cortesoft wrote: post #26

Earlier quoted context omitted.

Logitech keyboards (and probably others as well) let you use a single receiver for all the logitech wireless devices ( http://www.logitech.com/en-us/promotions/6072 ). If you have a unique key embedded in each keyboard/dongle pair, you would lose the ability to do this. In addition, if you lost the dongle, you would be SOL. I think more people will care about the convenience instead of the security. Ideally, you coul…

> If you have a unique key embedded in each keyboard/dongle pair, you would lose the ability to do this. In addition, if you lost the dongle, you would be SOL. I'm not sure I understand why? If public/private key cryptography were used then each dongle & keyboard would contain a private key. The dongle then contains a store for up to X public keys. The pairing procedure starts due to a physical button press on the tw…

The comment I was replying to stated that each pair would have an AES key generated for them at manufacture, and that is the key they would use to communicate together.

After I posted my reply, the comment was edited to mention this sort of public key exchange you describe happening with a button push. My comment does not apply to this sort of functionality. It would work great, with only the concern you mentioned about a relay attacker. I was only saying having a symmetric key generated at manufacture wouldn't allow for dongle changing and/or dongle consolidation.

Re: KeySweeper – Arduino-based passive wireless keyboard sniffer

#52

Post by cortesoft »

venaoy wrote: post #32
cortesoft wrote: post #26

Earlier quoted context omitted.

Logitech keyboards (and probably others as well) let you use a single receiver for all the logitech wireless devices ( http://www.logitech.com/en-us/promotions/6072 ). If you have a unique key embedded in each keyboard/dongle pair, you would lose the ability to do this. In addition, if you lost the dongle, you would be SOL. I think more people will care about the convenience instead of the security. Ideally, you coul…

> If you have a unique key embedded in each keyboard/dongle pair, you would lose the ability to do this. In addition, if you lost the dongle, you would be SOL. What about initializing the key during pairing? See parent's edit

Yes, initializing the key during pairing would work great.

I posted my reply before the parent's edit. I don't think this is an intractable problem; my suggestion of a physical connection for pairing or even a remote pairing with a button press would work fine. My ONLY point was that hard coding a symmetric key into the keyboard/dongle pair and then using that key for all communication wouldn't be practical.

Re: KeySweeper – Arduino-based passive wireless keyboard sniffer

#54

Post by alllways »

Are there any good resources for learning more about wireless communication? Its something I have been wanting to learn for a while but compared to resources for programming, resources for learning about wireless communication are scarce. I am especially referring to embedded wireless, I would love to know how the nRF24 works.

Re: KeySweeper – Arduino-based passive wireless keyboard sniffer

#55

Post by leni536 »

pjonesdotca wrote: post #2

Looking at the list of projects also done (by going to root of url) is quite impressive. http://samy.pl/

Oh, I do know pwnat. It could be quite useful.

edit: It seems like this guy really likes to show how useless NAT is. His "NAT pinning" demonstration is quite scary.

Re: KeySweeper – Arduino-based passive wireless keyboard sniffer

#56

Post by spiritplumber »

omgitstom wrote: post #43
Xeoncross wrote: post #31

Earlier quoted context omitted.

This case still gets me. Showing some text on MySpace is a "felony" charge? > Felonies: Felonies are the most serious types of crimes... ...Felonies are usually crimes that are viewed severely by society, and include crimes such as murder, rape, burglary, kidnapping, or arson. However, felonies can also be punished in a range of ways so that the punishment matches the severity of the crime. - http://criminal.findlaw.…

Some states view these types of crimes as crimes of 'moral turpitude' and it doesn't matter if it is a felony or misdemeanor. It will definitely effect your ability to get a security clearance or job in the security space.

I can' imagine whoever wrote this ever having difficulties landing a job in the security space, unless the prospective employer is really dumb.

Then again, it has happened to me that I didn't have the security clearance necessary to check out the code I was working on from a repository (this caused me to make a second repository on the laptop I carried back and forth, which more than defeats the point - dumbly enough, they were fine with this).

Re: KeySweeper – Arduino-based passive wireless keyboard sniffer

#57

Post by mkesper »

cortesoft wrote: post #26
mrb wrote: post #24

The most frustrating thing when reading about keyboard vendors implementing such insecure protocols is knowing that the nRF24LE1 chip Microsoft uses has all it needs for security: hardware accelerated support for AES , as well as a hardware random number generator [1]. Some comments here suggest using public/private crypto as a fix, but it would not even be necessary. During manufacturing they could simply generate a…

Logitech keyboards (and probably others as well) let you use a single receiver for all the logitech wireless devices ( http://www.logitech.com/en-us/promotions/6072 ). If you have a unique key embedded in each keyboard/dongle pair, you would lose the ability to do this. In addition, if you lost the dongle, you would be SOL. I think more people will care about the convenience instead of the security. Ideally, you coul…

If you use mutiple Logitech keyboards/mice in an office, chances are high someone else is controlling your mouse/keyboard input. This is absurd!

Re: KeySweeper – Arduino-based passive wireless keyboard sniffer

#58

Post by MertsA »

So since the protocol contains basically no authentication other than the MAC address of the keyboard which the attacker can easily figure out, why isn't there already a key injection portion of this exploit ala wireless USBdriveby? I can totally see this being extended to wireless keyboard and mouse combos which would give you a great way to know if the user was at the computer and when it would be safe to compromise it without someone noticing.

Re: KeySweeper – Arduino-based passive wireless keyboard sniffer

#59

Post by ddeck »

cortesoft wrote: post #26
mrb wrote: post #24

The most frustrating thing when reading about keyboard vendors implementing such insecure protocols is knowing that the nRF24LE1 chip Microsoft uses has all it needs for security: hardware accelerated support for AES , as well as a hardware random number generator [1]. Some comments here suggest using public/private crypto as a fix, but it would not even be necessary. During manufacturing they could simply generate a…

Logitech keyboards (and probably others as well) let you use a single receiver for all the logitech wireless devices ( http://www.logitech.com/en-us/promotions/6072 ). If you have a unique key embedded in each keyboard/dongle pair, you would lose the ability to do this. In addition, if you lost the dongle, you would be SOL. I think more people will care about the convenience instead of the security. Ideally, you coul…

Logitech 2.4 GHz keyboards use 128-bit AES symmetric encryption.

As I understand it, the encryptiion key is generated at the time of pairing in both the the keyboard and the receiver independently, and thus never transmitted wirelessly.

This is accomplished by having a secret algorithm that is encoded in both devices and produces the key based on some random input data that is shared between the devices at the time of pairing.

Further information here:

http://www.logitech.com/images/pdf/roem/Logitech_Adv_24_Ghz_...

Re: KeySweeper – Arduino-based passive wireless keyboard sniffer

#60

Post by ddeck »

dominicgs wrote: post #12
SchizoDuckie wrote: post #11

Earlier quoted context omitted.

This is very specifically for Microsoft keyboards. There's multiple bugs that are exploited (both in the $1 receiver chip he's using and the fact that all MS keyboards start with the same bit for their mac address) that make it very easy in that specific case. Hold my beer while I perform a table flip and throw away all my Microsoft Wireless Keyboards

Interestingly Microsoft aren't the only manufacturer to use the Nordic chipset for their "proprietary" 2.4GHz keyboards. I believe that Logitech's system is based on the same protocol. I'm unsure if Logitech keyboard are affected in a similar way, I know that this attack only affects Microsoft keyboards but they may have similar issues.

Logitech 2.4 GHz keyboards use 128-bit AES [1]

[1] http://www.logitech.com/images/pdf/roem/Logitech_Adv_24_Ghz_...

Post reply on HN