Re: Wireless Keyboard Security

[Alvin Oga <alvin.sec () Virtual Linux-Sec net>]

hi ya jared

On Tue, Mar 22, 2005 at 04:13:16PM -0700, Badger, Jared wrote:
> My job involves reviewing computer security at a bank, and I was very
> surprised to see that nearly all of the computers at one of my branches are
> using these wireless mouse/keyboard combos. It seems like this could be a
> potentially serious security risk,

yup .. big problem

> 1. How possible/easy/difficult is it to eavesdrop and capture keystrokes
> from a wireless keyboard using passive means only? What equipment/expertise
> does this require? (I am thinking it would probably take at least a spectrum
> analyzer, receiver, a laptop, and some custom software) What about taking
> the keyboard apart and reverse engineering it? 

if it is using wep... you're dead ..

if it is using plain ole infared to transmit over IR ( infared, red light ),
you're probably dead, since the keystrokes are not probably not encrypted 
while in transit

you just need a pda with a line of sight to the target pc
        - or laser from outside the building .. laser will pick up the
        1's and 0'z of the infared transmissions between kb and pc

> 2. How easy/difficult would it be to take control of a computer without
> having physical access to the keyboard at the console? What

should be easy if one had a line of sight to the keyboard/mouse

> equipment/expertise would this require? (Probably at least the same as
> above, plus a transmitter) 

you, as the evesdropper, only want to receive... and not transmit

> There are many docs, including photos and lab tests, on the associated
> pages. For example, FCC docs show that this particular keyboard transmits on
> a frequency of 27.095 - 27.195 MHz. From the internal photos, it doesn't
> seem there are enough electronics to perform advanced encryption. 

bingo ... you're dead 

> Certainly somebody knows how to do this. Has anybody tried? Been successful?

it'd be a fun ( easy ) audit/pen-test to perform .. just takes time
to get the customized laser or pda with "sniffing(recording) tools"

========

all wireless transmissions should be considered sniffed/sniffable
and therefore, you should encrypt everything transmitted wirelessly
and for that matter, over wired communications too, everything is
transmistted encrypted or consider it open for anybody to see


c ya
alvin