Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Eavesdropping on a wireless keyboard (2013)

windytan.com

Post reply on HN
Print view View original

11–19 of 19 posts

Re: Eavesdropping on a wireless keyboard (2013)

#11

Post by [deleted] »

drdaeman wrote: post #9
sp332 wrote: post #7

Earlier quoted context omitted.

If you get an Ubertooth http://ubertooth.sourceforge.net/ you can sniff bluetooth as well. If you use the default PIN (0000 or 1234) then it's possible to decrypt the signal. Here's an overview of how feasible decryption is: http://css.csail.mit.edu/6.858/2012/projects/echai-bendorff-... Also, Bluetooth LE provides no eavesdropping protection. If an attacker can capture the pairing frames, they may be able to determi…

(As a side note) Seeing the comment on acoustic fingerprinting, I guess it applies to wireless keyboards as well - even if the exact keycodes could be securely encrypted, keypress timing data, paired with finger movement model and typist habits analysis, would probably still leak information on what's typed.

[deleted]

Re: Eavesdropping on a wireless keyboard (2013)

#12

Post by dan_bk »

> Some time ago, I needed to find a new wireless keyboard. With the level of digital paranoia that I have, my main priority was security.

If my main priority was security, then I would never even think about wireless (network, keyboard, etc.).

Re: Eavesdropping on a wireless keyboard (2013)

#13

Post by [deleted] »

[deleted] wrote: post #11
drdaeman wrote: post #9

Earlier quoted context omitted.

(As a side note) Seeing the comment on acoustic fingerprinting, I guess it applies to wireless keyboards as well - even if the exact keycodes could be securely encrypted, keypress timing data, paired with finger movement model and typist habits analysis, would probably still leak information on what's typed.

[deleted]

[deleted]

Re: Eavesdropping on a wireless keyboard (2013)

#14

Post by chmars »

sp332 wrote: post #7
chmars wrote: post #4

Earlier quoted context omitted.

… or get a wireless keyboard with Bluetooth – it should be safe enough .

If you get an Ubertooth http://ubertooth.sourceforge.net/ you can sniff bluetooth as well. If you use the default PIN (0000 or 1234) then it's possible to decrypt the signal. Here's an overview of how feasible decryption is: http://css.csail.mit.edu/6.858/2012/projects/echai-bendorff-... Also, Bluetooth LE provides no eavesdropping protection. If an attacker can capture the pairing frames, they may be able to determi…

Thanks for sharing your knowledge!

Is anything known about the security of Apple's current bluetooth keyboard?

Re: Eavesdropping on a wireless keyboard (2013)

#15

Post by kabdib »

The problem is that the company who's saying "Trust us, we have 128 bit encryption in our product" isn't giving you enough information to make an informed decision about how secure the device really is.

Choosing a keyboard because the box says "128 bit encryption" doesn't help if the manufacturer bakes in the same key on every device. Or a predictable key. Or really, any static session key even if it varies by device serial number or something like that. And a marketing or advertising guy doesn't know this, they just see a checkbox they can stick on the artwork. "Just get that 128 bit stuff in there so we aren't lying" is the most likely scenario for something like a keyboard, where competition is tough and margins are wafer thin.

Personally I'd use copper if I was at all worried, because the likelihood of some random firmware engineer getting a security protocol right is pretty slim.

Re: Eavesdropping on a wireless keyboard (2013)

#16

Post by dnautics »

dan_bk wrote: post #12

> Some time ago, I needed to find a new wireless keyboard. With the level of digital paranoia that I have, my main priority was security. If my main priority was security , then I would never even think about wireless (network, keyboard, etc.).

do you think a wired keyboard might emit tappable rf? Should users take care to not have coils in their wires? Do solenoided keyboards (with the flexy chord coils) also pose a transmission risk?

Re: Eavesdropping on a wireless keyboard (2013)

#17

Post by kpreid »

dnautics wrote: post #16
dan_bk wrote: post #12

> Some time ago, I needed to find a new wireless keyboard. With the level of digital paranoia that I have, my main priority was security. If my main priority was security , then I would never even think about wireless (network, keyboard, etc.).

do you think a wired keyboard might emit tappable rf? Should users take care to not have coils in their wires? Do solenoided keyboards (with the flexy chord coils) also pose a transmission risk?

The cable is the least likely part to be the source of the problem. The data lines are inside a shield, and in USB they are balanced (“D+” and “D-”). Both of these act to prevent radiation of the signals.

If a keyboard radiates it is likely to be either from the unshielded, unbalanced matrix wires going to the keyswitches, or leakage from the controller going onto the outside of the shield. (I think the latter could be reduced by using (more/bigger) decoupling capacitors, i.e. shorting out the RF.)

Coiling a wire does not generally make it a more effective antenna; it may or may not make it less effective depending on the circumstances. (The reason some antennas are coiled is to get the same length of conductor into a smaller space.)

Re: Eavesdropping on a wireless keyboard (2013)

#18

Post by dominicgs »

sp332 wrote: post #7
chmars wrote: post #4

Earlier quoted context omitted.

… or get a wireless keyboard with Bluetooth – it should be safe enough .

If you get an Ubertooth http://ubertooth.sourceforge.net/ you can sniff bluetooth as well. If you use the default PIN (0000 or 1234) then it's possible to decrypt the signal. Here's an overview of how feasible decryption is: http://css.csail.mit.edu/6.858/2012/projects/echai-bendorff-... Also, Bluetooth LE provides no eavesdropping protection. If an attacker can capture the pairing frames, they may be able to determi…

> Also, Bluetooth LE provides no eavesdropping protection. If an attacker can capture the pairing frames, they may be able to determine the "long-term key"

There's a practical attack for that, and it's quick. It also uses Ubertooth[1].

For all Bluetooth keyboards that I've seen in the past ~5 years the pairing process uses one of the "Secure Simple Pairing" modes. none of these have been broken, although "Just Works" is probably vulnerable. The keyboard that I've see use the "enter a 6 digit number" mode, which is not susceptible to man in the middle attacks that have been used against Bluetooth keyboards before[2].

Disclosure: I work on the Ubertooth and related projects.

[1] https://www.usenix.org/conference/woot13/workshop-program/pr...

[2] https://www.youtube.com/watch?v=X0RUN6SB6c8

Re: Eavesdropping on a wireless keyboard (2013)

#19

Post by sp332 »

dominicgs wrote: post #18
sp332 wrote: post #7

Earlier quoted context omitted.

If you get an Ubertooth http://ubertooth.sourceforge.net/ you can sniff bluetooth as well. If you use the default PIN (0000 or 1234) then it's possible to decrypt the signal. Here's an overview of how feasible decryption is: http://css.csail.mit.edu/6.858/2012/projects/echai-bendorff-... Also, Bluetooth LE provides no eavesdropping protection. If an attacker can capture the pairing frames, they may be able to determi…

> Also, Bluetooth LE provides no eavesdropping protection. If an attacker can capture the pairing frames, they may be able to determine the "long-term key" There's a practical attack for that, and it's quick. It also uses Ubertooth[1]. For all Bluetooth keyboards that I've seen in the past ~5 years the pairing process uses one of the "Secure Simple Pairing" modes. none of these have been broken, although "Just Works"…

I haven't seen many keyboards that seemed secure, but now that you mention it, they are pretty old. Thanks for the update :)
Post reply on HN