Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I discovered a hidden microphone on a Chinese NanoKVM

telefoncek.si

Post reply on HN
Print view View original

81–90 of 138 posts

Re: How I discovered a hidden microphone on a Chinese NanoKVM

#81

Post by [deleted] »

PunchyHamster wrote: post #78
ndsipa_pomu wrote: post #13

Earlier quoted context omitted.

It doesn't strike me as that useful to have a hidden microphone in a KVM product as most of the time, they're going to be stuck in server rooms with just lots of fan noise to record. Far more of an issue would be any kind of keylogger built into the software, which is why it's best to go for devices that support open source software.

The KVM just uses a devboard that's also sold separately and just happens to have a microphone, given how cheap the mics are having one extra SKU would probably just cost them more than savings. Also I wouldn't really consider it "server room" product. Pretty much any new server has KVM, this is more "a hobbyist needing KVM for their home server"

[deleted]

Re: How I discovered a hidden microphone on a Chinese NanoKVM

#82

Post by hinkley »

ndsipa_pomu wrote: post #13
tayiorrobinson wrote: post #3

To be fair, the microphone _is_ listed on the specsheet of the LicheeRV Nano https://wiki.sipeed.com/hardware/en/lichee/RV_Nano/1_intro.h... I assume they didn't intend to put a mic on the KVM product, but they wanted to make a KVM product, already had this SBC product, which reusing their existing stock of helped keep cost low. Should they have been more up front about it it? Sure, and it's not great that they had a…

It doesn't strike me as that useful to have a hidden microphone in a KVM product as most of the time, they're going to be stuck in server rooms with just lots of fan noise to record. Far more of an issue would be any kind of keylogger built into the software, which is why it's best to go for devices that support open source software.

Ultrawideband never caught on because it turns out that the speed of light and sound in air is frequency dependent, so you have to know the distance to the target pretty accurately and then skew the signal to send or receive. (Imagine a phased array antenna but also with a frequency domain to work out as well).

But that doesn’t mean you can’t make it function in a loud server room. The whole point of it is working in and around noise.

Re: How I discovered a hidden microphone on a Chinese NanoKVM

#83

Post by jlward4th »

CoastalCoder wrote: post #32
jlward4th wrote: post #11

I recently discovered a similar concerning security issue with my KVM. In my case it was a pretty standard KVM for multiple machines to share a keyboard, mouse, and screen but also Ethernet. One day while looking at my home network I noticed the KVM had its own IP and was transferring GBs of data everyday. I quickly blocked it from my network. But having used it for a number of months I worried that with screen captu…

Is it possible for you to name the KVM model? It sounds like a potential risk is to the public.

It is this one: https://www.amazon.com/dp/B0CP4PD3SM

I did post a review there citing my security concerns.

Honestly I didn't go further with the investigation because if someone really has all my data, I'm worried about retribution.

Re: How I discovered a hidden microphone on a Chinese NanoKVM

#84

Post by jlward4th »

stragies wrote: post #17
jlward4th wrote: post #11

I recently discovered a similar concerning security issue with my KVM. In my case it was a pretty standard KVM for multiple machines to share a keyboard, mouse, and screen but also Ethernet. One day while looking at my home network I noticed the KVM had its own IP and was transferring GBs of data everyday. I quickly blocked it from my network. But having used it for a number of months I worried that with screen captu…

Why did you not just login to the device, and switched off "Broadcast to multicast", or changed the destination address? Edit: Some brands of Network-KVM use this, so that you can control the target device from another device, like e.g. an App on a tablet. That way you don't have to stand next to the target device in the noisy and cold machine room

The KVM didn't have any documentation on anything related to its network interface. I ran a port scan on it but didn't know if there was a way to log into it.

Re: How I discovered a hidden microphone on a Chinese NanoKVM

#85

Post by hinkley »

BenjiWiebe wrote: post #16
i_am_proteus wrote: post #14

Earlier quoted context omitted.

It is possible to keylog via audio. https://ieeexplore.ieee.org/abstract/document/10190721

But the point of a device like this is that you (and your keyboard) are NOT physically present.

They mean the K in KVM could trivially have a keylogger. For the computers attached to that KVM. Audio is for logging for computers not attached to the device in question. Which could be up to and including a whole server room save a couple machines.

Re: How I discovered a hidden microphone on a Chinese NanoKVM

#86

Post by snapdeficit »

Ekaros wrote: post #49
snapdeficit wrote: post #42

A kvm that requires Chinese dns servers? Just the fact it KvM over Ethernet should set off alarm bells from here till next Thursday. I would have a hard time trusting an internet based kvm.

Should I really be more trusting of some NSA controlled DNS server?

Yes. Hahaha. Of course not. Or maybe?? No, just kidding. But am i?

Re: How I discovered a hidden microphone on a Chinese NanoKVM

#87

Post by close04 »

nine_k wrote: post #76
overfeed wrote: post #65

Earlier quoted context omitted.

> Any signal that you can modulate can be an exfiltration channel, and fan noise is no different. This KVM has HDMI input and can directly emulate USB mass storage; fan-modulation is the lowest-bandwidth (side-)channel available to the attackers.

You can exfiltrate data from a machine which is not connected to the KVM. A high-security machine may be even air-gapped most of the time, but be physically nearby.

I don’t think too many of these devices will end up in server rooms as opposed to home labs. And the ones that do end up in a datacenter are very unlikely to be allowed to ever reach the internet.

If the microphone was used for exfiltrating data, it would work against random targets that happened to let the KVM connect to the internet, and who have a nearby machine infected with some malware. That kind of non-targeted attack can be damaging but is semi-useless to the attacker.

Re: How I discovered a hidden microphone on a Chinese NanoKVM

#88

Post by milesvp »

Mics have a pretty standard look, and are hard to miss on the board. It would be more insideous if there were cheap film caps leading into a very expensive ADC. I work with with analogue audio, and it’s very important to design around the noise of cheap caps. They are for all intents and purposes microphones and if you were clever about different caps for different frequencies and good digital processing I have no doubt you could build something with comparable fidelity to some of the cheapers MICs in the vocal range.

Re: How I discovered a hidden microphone on a Chinese NanoKVM

#89

Post by CamperBob2 »

f1shy wrote: post #30
ErroneousBosh wrote: post #24

Earlier quoted context omitted.

A long time ago (maybe in the mid-90s) I knew an elderly radio amateur who could not just "copy" CW by ear, but also RTTY. He could also pretty much tell what a teleprinter was printing just by listening to the noises it made, like he'd be facing away from it on the other side of the room reading out entire words from what was coming through. Apparently in the 50s when he did his National Service he'd been in the Sig…

Do you have a pointer to learn more about the ATM keyboards? I would love to learn more about it

One really-cool way to solve that problem is to embed a 7-segment LED under each keycap. You walk up to the keypad and the 0-9 digits appear in random order. No one can shoulder-surf, look for wear or IR emission from the buttons, or train on the click sounds.

Dell had those on every lab door in the building back in the early 90s. You felt like 007 every time you punched in your access code. I've never seen them anywhere since.

Re: How I discovered a hidden microphone on a Chinese NanoKVM

#90

Post by butvacuum »

ghostpepper wrote: post #50

A lot of the complaints here don't make a lot of sense and read like the author has never used an embedded linux device. The previously reported bugs are more substantial - hardcoded secrets for JWT access and firmware encryption, everything running as root, etc. However, "Chinese product uses Chinese DNS servers and it's hard to change them" or "no systemd nor apt installed" are totally expected and hardly make it "…

I think you haven't gone far enough. Most of this thread is rampant ignorance and propaganda influenced bandwagoning.

1) It's from a company known for dev boards and SoCs- not consumer products.

2) The code is available on GitHub (nice!)

3) SiSpeed actively contributes to the mainline linux kernel for RISC-V in general as well as their SoCs.

4) Security in Embedded Applications is just... Bad. Amercian, Chinese, European, Russian, Indian- it doesn't matter.

Post reply on HN