Re: Wireless keyboard security?

[intel96 <intel96 () bellsouth net>]

There was a presentation scheduled at Black Hat 2007 in Vegas on how to 
hack a wireless keyboard.  During the presentation the presenter was 
unable to provide any evidence that he could hack a wireless keyboard.   
He did provide evidence on how to hack a Kensington Model#33374 wireless 
remote, used to control Power Point presentation.

If someone, saw him hack a wireless keyboard during the presentation 
please let me know, because maybe I was running low on caffeine.......

Here is the presentation that was scheduled:

Other Wireless: New ways of being Pwned
Luis Miras, Lead Vulnerability Researcher, Intrusion Inc

There are many other wireless devices besides Wifi and Bluetooth. This 
talk examines the security of some of these devices, including wireless 
keyboards, mice, and presenters. Many of these devices are designed to 
be as cost effective as possible. These cost reductions directly impact 
their security. Examples of chip level sniffing will be shown as well as 
chip level injection attacks allowing an attacker to control the target 
system. The hardware used in these devices will be examined along with 
an attacker toolkit consisting of low cost hardware and software.

Luis Miras is the lead vulnerability researcher at Intrusion Inc. He has 
done work for leading consulting firms and recently has done work for 
Chumby. His interests include vulnerability research, binary analysis, 
and hardware/software reversing. In the past he has worked in digital 
design, and embedded programming. When he isn't head down in IDA or a 
circuit board, you will likely find him boarding down some sweet powder.




natronicus wrote:
> Additionally, there was a presentation at Defcon last year where the
> presenter demonstrated how to reverse engineer an example rf
> controlled wireless keyboard with $100 of equipment off of ebay.
>
> I just visited the defcon media archives but couldn't find his
> presentation.. maybe it was Blackhat 07 and not Defcon?  It was a
> small group of us in there; couldn't have been more than 20 people
> attending the talk.
>
> Anyway, since I can't find his presentation, his process was:
>
> - Monitor the rf frequencies and dump them into software to analyze
> - Figure out what is a 1 and what's a 0
> - Guess the packet structure (header + payload + footer)
> - Monitor payloads generated by using the device and generate a translation map
>
> He found that all of the rf wireless devices he tested used
> proprietary protocols with no encryption.  It was simple to deduce the
> protocol and command lists, making it possible to inject any command
> into the receiver and monitor all traffic.
>
> Bluetooth has its issues, but at least it's a known protocol that's
> very difficult to sniff.  Home grown protocols always make me twitchy.
>
> natron
>
> On Wed, Mar 26, 2008 at 10:51 AM, Sat Jagat Singh
> <flyingdervish () yahoo com> wrote:
>   
> > There's actually been quite a lot about these lately:
> >
> >  http://www.remote-exploit.org/advisories/27Mhz_Analyzing.pdf
> >
> > http://www.dreamlab.net/download/articles/27_Mhz_keyboard_insecurities.pdf
> >
> >  Bluetooth hacking has also been demonstrated at
> >  previous Blackhat conferences.
> >
> >
> >
> >  --- Eygene Ryabinkin <rea-sec () codelabs ru> wrote:
> >
> >  > Good day.
> >  >
> >  > Can anyone point me to the papers/articles/research
> >  > of the (in)security
> >  > of wireless keyboards?  Since many people want to
> >  > use them now,
> >  > there are some questions about their security --
> >  > button clicks are
> >  > transferred on the air and can be remotely
> >  > interceptable.
> >  >
> >  > Thanks!
> >  > --
> >  > Eygene
> >  >
> >  >
> >  ------------------------------------------------------------------------
> >  > This list is sponsored by: Cenzic
> >  >
> >  > Need to secure your web apps NOW?
> >  > Cenzic finds more, "real" vulnerabilities fast.
> >  > Click to try it, buy it or download a solution FREE
> >  > today!
> >  >
> >  > http://www.cenzic.com/downloads
> >  >
> >  ------------------------------------------------------------------------
> >  >
> >  >
> >
> >
> >
> >
> >       ____________________________________________________________________________________
> >  Looking for last minute shopping deals?
> >  Find them fast with Yahoo! Search.  http://tools.search.yahoo.com/newsearch/category.php?category=shopping
> >
> >
> >
> >  ------------------------------------------------------------------------
> >  This list is sponsored by: Cenzic
> >
> >  Need to secure your web apps NOW?
> >  Cenzic finds more, "real" vulnerabilities fast.
> >  Click to try it, buy it or download a solution FREE today!
> >
> >  http://www.cenzic.com/downloads
> >  ------------------------------------------------------------------------
> >
> >
> >     
>
> ------------------------------------------------------------------------
> This list is sponsored by: Cenzic
>
> Need to secure your web apps NOW?
> Cenzic finds more, "real" vulnerabilities fast.
> Click to try it, buy it or download a solution FREE today!
>
> http://www.cenzic.com/downloads
> ------------------------------------------------------------------------
>
>
>   


------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------