9 ms·

Penetration testing wireless keyboards

148 points by Breadmaker 4y ago

neilv 4y ago
Seems wireless keyboard vulnerabilities can also be problems accidentally... Just a couple years ago, I was finalizing and testing some factory stations we'd built (incorporating industrial NUCs) before they'd be flown to Asia for installation in a production line. Someone had ordered a name-brand wireless keyboard with USB dongle, and I'd said we probably don't want wireless keyboards nor their dongles in the factory, but I figured it was OK to use briefly for testing, since it's what we had handy. Was getting phantom key events, which initially was alarming, because I'd had to get creative with some device drivers and the Linux input system. But then it also happened during BIOS/UEFI setup. There was one other person in the shared tech/lab space at this time, so I go over and ask if they happen to be doing anything with RF... It turns out they were also using the same brand of wireless keyboard, which seemed to intermittently be barging-in or interfering with mine, in such a way to generate valid USB input device events. When I brought it up with colleagues, we were all baffled, since presumably the name-brand would like to sell fleets of wireless keyboards to entire open-plan office building floors at a time, and would design it to work well for that use case. But it did indeed seem that activity on one keyboard was triggering events out the USB dongle on another. (I won't mention the brand, since I didn't investigate rigorously, and write it up. We were crazy-busy, launching our startup's MVP. Fortunately, without the wireless keyboards, the stations were rock-solid for the entire year-plus deployment, against all odds.)
hericium 4y ago
PDF: https://kth.diva-portal.org/smash/get/diva2:1701492/FULLTEXT01.pdf https://kth.diva-portal.org/smash/get/diva2:1701492/FULLTEXT...
mtreis86 4y ago
I am disappointed that QMK isn't included in the analysis.
- dfc 4y ago
  It's a review of wireless keyboard communication protocols. I do not follow QMK development that closely. Have they implemented their own wireless protocol?
- Okkef 4y ago
  QMK is not wireless. There is ZMK, but that's bluetooth and should be safe.
pushedx 4y ago
kth is a great name for a university that teaches data science
- capableweb 4y ago
  Seems it's a bit older than the concept of "data science" (founded 1827, 195 years ago) and also just happens to also teach data science.
saulrh 4y ago
And this is why the Google security folks don't let employees use wireless keyboards unless they're bluetooth, and above a certain bluetooth protocol version at that. Not that this analysis at any time conducted attacks on the bluetooth protocols - every single one of these keyboards had a secondary 2.4GHz dongle and just happily transmitted everything over that. I'd have liked to know whether they're trying to transmit to that dongle all the time or whether it turns off when the bluetooth connects!
- teruakohatu 4y ago
  Is there a public list of Google approved keyboards?
solarkraft 4y ago
I got a Rapoo keyboard for free. Since I consider it a no-name brand I'm not at all surprised that it turns out to be insecure (perfectly matches my expectations), I'm rather surprised that the author even audited them and that they even attempted to secure the communication a little bit. So my intuition that generic "2.4GHz" communication is insecure has mostly been proven right. Now what about Bluetooth keyboards? Can they be considered secure?
- hoppla 4y ago
  From my understanding, Bluetooth is vulnerable in the pairing process, but secure after that.
adamfarhadi 4y ago
I didn’t expect to see a masters thesis from KTH on HN. I actually took a course with Roberto, one of the supervisors of this thesis, while I studied there. Small world.
- buildbot 4y ago
  KTH is pretty well known internationally!
wongarsu 4y ago
Summary of the results (page 137): Protocol Sniffing Injection Plexgear Yes Yes Rapoo Yes Yes Logitech No Yes Corsair Yes Yes iiglo Yes Yes Exibel Yes Yes Razer No No Choice quotes from Chapter 6 (Discussion): The results show that 9 out of 10 keyboards have at least some form of vulnerability. Out of all the keyboards, 8 of them were shown to contain new previously unknown vulnerabilities that could grant an attacker full control of the computer of the keyboard. The severity of these vulnerabilities in combination with how prevalent they are show that the usage of wireless keyboards should in no way be used in any situation where security, privacy, or integrity is of any concern whatsoever. [...] Out of all the keyboards, only one of them actually promised any form of encryption as part of the marketing of the keyboard and this is the Corsair K63 Wireless. The keyboard is marketed with 128-bit AES encryption but as the results of the penetration test show, this is not the case. The keyboard’s only obfuscation of the wireless transmission is a simple XOR of the payload with a static key that can potentially be reverse engineered automatically with some very simple calculations. [...] Razer BlackWidow V3 Pro was the only keyboard not shown to contain any vulnerability. As a result of this, it is deemed the most secure of the targeted keyboards but it could still be vulnerable to some unidentified vulnerability that requires more time and resources compared to the rest of the keyboards
- ClumsyPilot 4y ago
  > The keyboard is marketed with 128-bit AES encryption but as the results of the penetration test show, this is not the case. The keyboard’s only obfuscation of the wireless transmission is a simple XOR of the payload with a static key This sounds like fraud to me.
  - aliqot 4y ago
    > Fraud - the intentional use of deceit, a trick or some dishonest means to deprive another of his/her/its money, property or a legal right. You don't 'accidentally' mistake weak XOR obfuscation with AES, so this is fraud. However whether that results in any tangible legal action is debatable. I have strong doubts given the corporatocratic nature of the corporate judicial outcomes in USA. Are these sold online? Wire fraud is a common enhancement to a lot of criminal charges involving fraud taking place online or over phone.
stoplying1 4y ago
Answered my own question, so sharing it. I wanted to know if the Sculpt Ergo was vulnerable. (Seems not). (Also, this has been ~known since at least ~2016)> http://xahlee.info/kbd/Microsoft_wireless_keyboard_key_sniffer.html http://xahlee.info/kbd/Microsoft_wireless_keyboard_key_sniff...
Tsiklon 4y ago
I see that they discuss Logitech's protocol, does this cover "Bolt" devices? or is it only their "unifying receiver"?
- sphars 4y ago
  In their testing they tested the Logitech MK270, which is a mouse and keyboard combo. It uses the Unifying Reciver.
kccqzy 4y ago
So what are the choices for secure wireless keyboards? The only one I know of is the Apple Magic Keyboard with Lightning port, which uses Bluetooth (BLE rather than the classic one) and not some random home-baked protocol over 2.4GHz. It also sidesteps the vulnerable pairing step by asking you to plug in to pair.
danhor 4y ago
Unfortunately they only tested Logitechs unifying system, that's known to be broken (mentioned in the paper). That's one of the reasons Logitech is moving to Logi Bolt, which is supposed to be very similar to BLE (but with a separate receiver). I'd be really interested to know if it's also as secure as BLE.
- solarkraft 4y ago
  Do you know why, then, they went with their own, yet-another-new protocol, instead of just using BLE? One hint may be that on my Macbook my Logitech mouse appears to have a higher latency (feeling more "spongy") when connected via Bluetooth instead of via the dongle.
  - yakak 4y ago
    Their keyboards also support BLE with the actual host. Using their dongle has the advantage of working as well as a wired device on a system that isn't yet booted as you are paired to the dongle not the host, and the dongle then acts as standard USB devices. Putting a more complete Bluetooth host into their dongle would just change the edges of where it is incompatible with normal Bluetooth usage.
  - vonseel 4y ago
    The hardware is great, but I can't bring myself to buy anything that requires running Logitech's software. I've heard elsewhere Logitech devices are laggy on bluetooth. Why isn't this an issue for Apple and other manf? I've moved from mech keyboards with O-ringed MX blues to pretty much using the Apple magic keyboard and trackpad anytime I'm at the desk. Sometimes I still reach for the clicky-claky, but integrated Touch-ID is so useful I've taken a liking to using the Apple magic keyboard (with touch id) and grown accustomed to the feel.
    - vladvasiliu 4y ago
      > The hardware is great, but I can't bring myself to buy anything that requires running Logitech's software. This is why I like their G series mice, even though I'm not a gamer. You can configure them, and they'll remember the settings on their on-board memory. They're also supported by Piper on Linux, so you never have to touch the crappy Logitech software. I also have one of their trackballs, and it's a pain having to make sure the software runs so that the sensitivity is the correct one. It does Unifying and BT, and I've actually been impressed with how well the latter works. I don't feel any difference between that and the Unifying dongle, be it on a current-gen Linux PC or on an old MBP.
userbinator 4y ago
Is there really any compelling use-case for a wireless keyboard outside of those few scenarios where it needs to be very mobile?
- capableweb 4y ago
  Don't ask my why (because I certainly don't agree personally) but most people I know prefer wireless anything if they can, because they can't stand cables. But then I have a 32 channel mixer with cables everywhere in my office, so not the most unbiased cable-opinionator directly.
  - PaulDavisThe1st 4y ago
    48 channel mixer here, plus a 16x16 MIDI interface (totally filled). I have cables. And yet ... wireless keyboard and mouse ... because ... I dunno. Just seems right.
    - vonseel 4y ago
      When you have a bunch of tethered bulky musical gear around, a wireless keyboard is really nice since you can move it around easily, stick it beside something, on a side table, etc. I'd argue it's more useful in that case than when you have an empty, clean desk, actually.
- dsr_ 4y ago
  People like the way it looks. Me, I like a wireless mouse, but a wired keyboard.
- alar44 4y ago
  Managers think it looks nice.
  - kjs3 4y ago
    Regrettably, this is in fact the truth (unfortunate you've been downvoted). A couple of years back I got into a bit of a tussle for not approving wireless keyboards at bank branches. And even after paying a third party pen-test shop to demonstrate they weren't particularly secure, the branch management folks fought for them claiming "it looks nicer", "cords make things look outdated" and "other banks do it so why can't we". Those were the only arguments for them.
tedk-42 4y ago
I for one will not make a keyboard purchase based on how secure the underlying wireless mechanism is. Goes without saying though they should all be 100% secure so credit to the author for investigating this
pyuser583 4y ago
I don’t understand how wi-fi keyboard could possibly be a good idea
dwheeler 4y ago
I prefer wired everything, including keyboard, mouse, and headset. I simply don't have to worry about this.
- nikau 4y ago
  I can understand wireless mouse and headset, but for a keyboard just having a detachable usb is fine incase you want to move it for cleaning underneath or something.

148 points by Breadmaker 4y ago

Seems wireless keyboard vulnerabilities can also be problems accidentally... Just a couple years ago, I was finalizing and testing some factory stations we'd built (incorporating industrial NUCs) before they'd be flown to Asia for installation in a production line. Someone had ordered a name-brand wireless keyboard with USB dongle, and I'd said we probably don't want wireless keyboards nor their dongles in the factory, but I figured it was OK to use briefly for testing, since it's what we had handy. Was getting phantom key events, which initially was alarming, because I'd had to get creative with some device drivers and the Linux input system. But then it also happened during BIOS/UEFI setup. There was one other person in the shared tech/lab space at this time, so I go over and ask if they happen to be doing anything with RF... It turns out they were also using the same brand of wireless keyboard, which seemed to intermittently be barging-in or interfering with mine, in such a way to generate valid USB input device events. When I brought it up with colleagues, we were all baffled, since presumably the name-brand would like to sell fleets of wireless keyboards to entire open-plan office building floors at a time, and would design it to work well for that use case. But it did indeed seem that activity on one keyboard was triggering events out the USB dongle on another. (I won't mention the brand, since I didn't investigate rigorously, and write it up. We were crazy-busy, launching our startup's MVP. Fortunately, without the wireless keyboards, the stations were rock-solid for the entire year-plus deployment, against all odds.)

hericium 4y ago

PDF: https://kth.diva-portal.org/smash/get/diva2:1701492/FULLTEXT01.pdf https://kth.diva-portal.org/smash/get/diva2:1701492/FULLTEXT...

mtreis86 4y ago

I am disappointed that QMK isn't included in the analysis.

dfc 4y ago
It's a review of wireless keyboard communication protocols. I do not follow QMK development that closely. Have they implemented their own wireless protocol?
Okkef 4y ago
QMK is not wireless. There is ZMK, but that's bluetooth and should be safe.

pushedx 4y ago

kth is a great name for a university that teaches data science

capableweb 4y ago
Seems it's a bit older than the concept of "data science" (founded 1827, 195 years ago) and also just happens to also teach data science.

saulrh 4y ago

And this is why the Google security folks don't let employees use wireless keyboards unless they're bluetooth, and above a certain bluetooth protocol version at that. Not that this analysis at any time conducted attacks on the bluetooth protocols - every single one of these keyboards had a secondary 2.4GHz dongle and just happily transmitted everything over that. I'd have liked to know whether they're trying to transmit to that dongle all the time or whether it turns off when the bluetooth connects!

teruakohatu 4y ago
Is there a public list of Google approved keyboards?

solarkraft 4y ago

I got a Rapoo keyboard for free. Since I consider it a no-name brand I'm not at all surprised that it turns out to be insecure (perfectly matches my expectations), I'm rather surprised that the author even audited them and that they even attempted to secure the communication a little bit. So my intuition that generic "2.4GHz" communication is insecure has mostly been proven right. Now what about Bluetooth keyboards? Can they be considered secure?

hoppla 4y ago
From my understanding, Bluetooth is vulnerable in the pairing process, but secure after that.

adamfarhadi 4y ago

I didn’t expect to see a masters thesis from KTH on HN. I actually took a course with Roberto, one of the supervisors of this thesis, while I studied there. Small world.

buildbot 4y ago
KTH is pretty well known internationally!

wongarsu 4y ago

Summary of the results (page 137): Protocol Sniffing Injection Plexgear Yes Yes Rapoo Yes Yes Logitech No Yes Corsair Yes Yes iiglo Yes Yes Exibel Yes Yes Razer No No Choice quotes from Chapter 6 (Discussion): The results show that 9 out of 10 keyboards have at least some form of vulnerability. Out of all the keyboards, 8 of them were shown to contain new previously unknown vulnerabilities that could grant an attacker full control of the computer of the keyboard. The severity of these vulnerabilities in combination with how prevalent they are show that the usage of wireless keyboards should in no way be used in any situation where security, privacy, or integrity is of any concern whatsoever. [...] Out of all the keyboards, only one of them actually promised any form of encryption as part of the marketing of the keyboard and this is the Corsair K63 Wireless. The keyboard is marketed with 128-bit AES encryption but as the results of the penetration test show, this is not the case. The keyboard’s only obfuscation of the wireless transmission is a simple XOR of the payload with a static key that can potentially be reverse engineered automatically with some very simple calculations. [...] Razer BlackWidow V3 Pro was the only keyboard not shown to contain any vulnerability. As a result of this, it is deemed the most secure of the targeted keyboards but it could still be vulnerable to some unidentified vulnerability that requires more time and resources compared to the rest of the keyboards

ClumsyPilot 4y ago
> The keyboard is marketed with 128-bit AES encryption but as the results of the penetration test show, this is not the case. The keyboard’s only obfuscation of the wireless transmission is a simple XOR of the payload with a static key This sounds like fraud to me.
- aliqot 4y ago
  > Fraud - the intentional use of deceit, a trick or some dishonest means to deprive another of his/her/its money, property or a legal right. You don't 'accidentally' mistake weak XOR obfuscation with AES, so this is fraud. However whether that results in any tangible legal action is debatable. I have strong doubts given the corporatocratic nature of the corporate judicial outcomes in USA. Are these sold online? Wire fraud is a common enhancement to a lot of criminal charges involving fraud taking place online or over phone.

stoplying1 4y ago

Answered my own question, so sharing it. I wanted to know if the Sculpt Ergo was vulnerable. (Seems not). (Also, this has been ~known since at least ~2016)> http://xahlee.info/kbd/Microsoft_wireless_keyboard_key_sniffer.html http://xahlee.info/kbd/Microsoft_wireless_keyboard_key_sniff...

Tsiklon 4y ago

I see that they discuss Logitech's protocol, does this cover "Bolt" devices? or is it only their "unifying receiver"?

sphars 4y ago
In their testing they tested the Logitech MK270, which is a mouse and keyboard combo. It uses the Unifying Reciver.

kccqzy 4y ago

So what are the choices for secure wireless keyboards? The only one I know of is the Apple Magic Keyboard with Lightning port, which uses Bluetooth (BLE rather than the classic one) and not some random home-baked protocol over 2.4GHz. It also sidesteps the vulnerable pairing step by asking you to plug in to pair.

danhor 4y ago

Unfortunately they only tested Logitechs unifying system, that's known to be broken (mentioned in the paper). That's one of the reasons Logitech is moving to Logi Bolt, which is supposed to be very similar to BLE (but with a separate receiver). I'd be really interested to know if it's also as secure as BLE.

solarkraft 4y ago
Do you know why, then, they went with their own, yet-another-new protocol, instead of just using BLE? One hint may be that on my Macbook my Logitech mouse appears to have a higher latency (feeling more "spongy") when connected via Bluetooth instead of via the dongle.
- yakak 4y ago
  Their keyboards also support BLE with the actual host. Using their dongle has the advantage of working as well as a wired device on a system that isn't yet booted as you are paired to the dongle not the host, and the dongle then acts as standard USB devices. Putting a more complete Bluetooth host into their dongle would just change the edges of where it is incompatible with normal Bluetooth usage.
- vonseel 4y ago
  The hardware is great, but I can't bring myself to buy anything that requires running Logitech's software. I've heard elsewhere Logitech devices are laggy on bluetooth. Why isn't this an issue for Apple and other manf? I've moved from mech keyboards with O-ringed MX blues to pretty much using the Apple magic keyboard and trackpad anytime I'm at the desk. Sometimes I still reach for the clicky-claky, but integrated Touch-ID is so useful I've taken a liking to using the Apple magic keyboard (with touch id) and grown accustomed to the feel.
  - vladvasiliu 4y ago
    > The hardware is great, but I can't bring myself to buy anything that requires running Logitech's software. This is why I like their G series mice, even though I'm not a gamer. You can configure them, and they'll remember the settings on their on-board memory. They're also supported by Piper on Linux, so you never have to touch the crappy Logitech software. I also have one of their trackballs, and it's a pain having to make sure the software runs so that the sensitivity is the correct one. It does Unifying and BT, and I've actually been impressed with how well the latter works. I don't feel any difference between that and the Unifying dongle, be it on a current-gen Linux PC or on an old MBP.

userbinator 4y ago

Is there really any compelling use-case for a wireless keyboard outside of those few scenarios where it needs to be very mobile?

capableweb 4y ago
Don't ask my why (because I certainly don't agree personally) but most people I know prefer wireless anything if they can, because they can't stand cables. But then I have a 32 channel mixer with cables everywhere in my office, so not the most unbiased cable-opinionator directly.
- PaulDavisThe1st 4y ago
  48 channel mixer here, plus a 16x16 MIDI interface (totally filled). I have cables. And yet ... wireless keyboard and mouse ... because ... I dunno. Just seems right.
  - vonseel 4y ago
    When you have a bunch of tethered bulky musical gear around, a wireless keyboard is really nice since you can move it around easily, stick it beside something, on a side table, etc. I'd argue it's more useful in that case than when you have an empty, clean desk, actually.
dsr_ 4y ago
People like the way it looks. Me, I like a wireless mouse, but a wired keyboard.
alar44 4y ago
Managers think it looks nice.
- kjs3 4y ago
  Regrettably, this is in fact the truth (unfortunate you've been downvoted). A couple of years back I got into a bit of a tussle for not approving wireless keyboards at bank branches. And even after paying a third party pen-test shop to demonstrate they weren't particularly secure, the branch management folks fought for them claiming "it looks nicer", "cords make things look outdated" and "other banks do it so why can't we". Those were the only arguments for them.

tedk-42 4y ago

I for one will not make a keyboard purchase based on how secure the underlying wireless mechanism is. Goes without saying though they should all be 100% secure so credit to the author for investigating this

pyuser583 4y ago

I don’t understand how wi-fi keyboard could possibly be a good idea

dwheeler 4y ago

I prefer wired everything, including keyboard, mouse, and headset. I simply don't have to worry about this.

nikau 4y ago
I can understand wireless mouse and headset, but for a keyboard just having a detachable usb is fine incase you want to move it for cleaning underneath or something.