{"id":4220,"date":"2016-07-28T02:16:52","date_gmt":"2016-07-27T18:16:52","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=4220"},"modified":"2016-07-28T02:17:28","modified_gmt":"2016-07-27T18:17:28","slug":"2016-wireless-keyboard-security-still-sucks","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2016\/07\/2016-wireless-keyboard-security-still-sucks\/","title":{"rendered":"In 2016 Your Wireless Keyboard Security Still SUCKS &#8211; KeySniffer"},"content":{"rendered":"<p>So you&#8217;d probably imagine that Wireless Keyboard Security is a 1998 problem and you shouldn&#8217;t even have to worry about that any more. And you&#8217;d be wrong &#8211; two-thirds of wireless keyboards, from MAJOR manufacturers are not even vaguely secure.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2016\/07\/In-2016-Your-Wireless-Keyboard-Security-Still-SUCKS-KeySniffer-640x334.png\" alt=\"In 2016 Your Wireless Keyboard Security Still SUCKS - KeySniffer\" width=\"640\" height=\"334\" class=\"aligncenter size-medium wp-image-4221\" srcset=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2016\/07\/In-2016-Your-Wireless-Keyboard-Security-Still-SUCKS-KeySniffer-640x334.png 640w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2016\/07\/In-2016-Your-Wireless-Keyboard-Security-Still-SUCKS-KeySniffer.png 728w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<p>It turns out, in 2016 when cryptography is mainstream, open-source and fairly easy to implement with proven libraries for every language &#8211; wireless keyboards still communicate in plain text.<\/p>\n<blockquote><p>Millions of low-cost wireless keyboards are susceptible to a vulnerability that reveals private data to hackers in clear text.<\/p>\n<p>The vulnerability \u2013 dubbed KeySniffer \u2013 creates a means for hackers to remotely \u201csniff\u201d all the keystrokes of wireless keyboards from eight manufacturers from distances up to 100 metres away.<\/p>\n<p>\u201cWhen we purchase a wireless keyboard we reasonably expect that the manufacturer has designed and built security into the core of the product,\u201d said Bastille Research Team member Marc Newlin, responsible for the KeySniffer discovery. \u201cUnfortunately, we tested keyboards from 12 manufacturers and were disappointed to find that eight manufacturers (two thirds) were susceptible to the KeySniffer hack.\u201d<\/p>\n<p>The keyboard manufacturers affected by KeySniffer include: Hewlett-Packard, Toshiba, Kensington, Insignia, Radio Shack, Anker, General Electric, and EagleTec. Vulnerable keyboards are always transmitting, whether or not the user is typing. Consequently, a hacker can scan for vulnerable devices at any time.<\/p><\/blockquote>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>And yah, this vulnerability has a name, it&#8217;s called KeySniffer and it even has a a fancy website too:<\/p>\n<p>&#8211; <a href=\"http:\/\/www.keysniffer.net\/\">http:\/\/www.keysniffer.net\/<\/a><\/p>\n<p>This is not the first time similar flaws have been exposed, and fortunately (because all the wireless stuff I use is Logitech) Logitech is not vulnerable to KeySniffer.<\/p>\n<blockquote><p>Wireless keyboards have been the focus of security concerns before. In 2010, the KeyKeriki team exposed weak XOR encryption in certain Microsoft wireless keyboards. Last year Samy Kamkar\u2019s KeySweeper exploited Microsoft\u2019s vulnerabilities. Both of those took advantage of shortcomings in Microsoft\u2019s encryption.<\/p>\n<p>The KeySniffer discovery is different in that it reveals that manufacturers are actually producing and selling wireless keyboards with no encryption at all. Bluetooth keyboards and higher-end wireless keyboards from manufacturers including Logitech, Dell, and Lenovo are not susceptible to KeySniffer.<\/p>\n<p>Bastille notified affected vendors to provide them the opportunity to address the KeySniffer vulnerability prior to going public on Tuesday. Most, if not all, existing keyboards impacted by KeySniffer cannot be upgraded and will need to be replaced, it warns.<\/p><\/blockquote>\n<p>Do remember, these are lower end keyboards &#8211; so most of us here probably wouldn&#8217;t be using them. Unless you have a HTPC or home-media center, you probably have an el-cheapo wireless keyboard on that.<\/p>\n<p>But you&#8217;re also not typing sensitive information on it (apart from your Netflix login) so it doesn&#8217;t really matter.<\/p>\n<p>Source: <a href=\"http:\/\/www.theregister.co.uk\/2016\/07\/26\/keysniffer_wireless_keyboard_vuln\/\">The Register<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>So you&#8217;d probably imagine that Wireless Keyboard Security is a 1998 problem and you shouldn&#8217;t even have to worry about that any more. And you&#8217;d be wrong &#8211; two-thirds of wireless keyboards, from MAJOR manufacturers are not even vaguely secure. It turns out, in 2016 when cryptography is mainstream, open-source and fairly easy to implement [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"So you'd probably imagine that Wireless Keyboard Security is a 1998 problem and you shouldn't even have to worry about that any more..","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[10,22],"tags":[776],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4220"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=4220"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4220\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=4220"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=4220"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=4220"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}