Microsoft wireless keyboards crypto cracked Security researchers have cracked the rudimentary encryption used in a range of popular wireless keyboards. Bluetooth is increasingly becoming the de-facto standard for wireless communication in peripheral devices and is reckoned to be secure. But some manufacturers such as Logitech and Microsoft rely on 27 MHz radio …
Just had a browse of the MS Hardware website. In their defence, I can't, at first sight see any sign that the communication between keyboard and receiver is encrypted anyway.
It's likely the HID is XOR'd just to avoid namespace conflicts with the other wireless keyboard across the room. You are unlikely to have 256 keyboards in 10m range so that would be enough.
Now, what was that about the need for peer review of security protocols: both their design and their implementation? Although it doesn't guarantee perfection, it does at least weed out obvious crap.
But of course Microsoft (and others, probably) can't possibly need any of that. They are, after all, infallible and complet... [snirk]... completely sec... [chortle].... completely secure...[HAHAHAHA]. Nope, I really couldn't say that with a straight face.
Each bit doubles the time it tacks to crack the encryption. With only 8 it gets broken instantly. The only reason the demo is slow is because they are waiting for enough keys to be pressed.
Double that 120^2 times and suddenly it takes a super computer 10 years.
The scary thing is that I almost bought an MS wireless keyboard last week.
The scarier thing is everyone else is probably equally as bad at security :(
... in a e10 keyboard made in China? It would not surprise me if the "encryption" is really only intended to prevent the keyboard output from being picked up by every PC within range.
Wouldn't do to have the ElReg comments popping up in the middle of a bunch of PowerPoints being created in other cubes now would it. Or maybe it would...
I'm sorry - I don't believe that. With only 256 possibilities for an 'encryption' key, the method of encryption being 'XOR', and the data being encrypted being single keystrokes not including modifiers (giving us less than 100 data potentials), I think I could decrypt that by hand without too much difficulty. That is, pencil and paper. Of course, this assumes that something electronic is capturing the stream; I personally can't scribble as fast as I can type, and I'm at a complete loss for parsing an electron bitstream that's fed directly into my skin. But give me a printout of that stuff, and it's so cracked it's not funny.
Ok, I lied. I'll admit it. It's absolutely hilarious.
As a final note, I'll just mention that this makes me very happy I decided years ago to boycott Microsoft - otherwise, I might have one of those things.
(That previous poster was onto something...)
01001001 01110100 00100000 01101001 01110011 00100000 01110100 01101000 01101111 01110011 01100101 00100000 01110000 01100101 01110011 01101011 01111001 00100000 01100010 01101100 01100001 01100011 01101011 00100000 01100011 01101111 01110000 01110100 01100101 01110010 01110011 00100001
You mean people who use wireless keyboards actually expect them to be secure? And some researchers actually thought it was worth pointing out that they aren't?
What you seem to be getting is enough encryption to stop interference between systems, and to stop 'zero effort' snooping by just plugging in another receiver of the same type.
If that isn't enough, use a keyboard with a cable.
Ooooh That means I could control all the PCs (paired with a Picosoft KB) with me son's RC car's remote.
That's great! Now what if I get a remote from a RC plane?
No seriously I'm sure the guy had a hunch when his kiddo wouldn't stop jamming his typing with his 27.145 MHz remote.
I never thought 27MHz was secure. Used to have a wireless keyboard, but binned it when I started shopping online. I still use a cordless mouse, but the security risk there is small unless they can see your screen. If they can see that, they can see the pointer, so securing the mouse makes little difference.
A little obfuscation can confuse keyloggers; never use tab to move between fields, use the mouse, and use the mouse instead of enter to submit the logon.
If you are really paranoid, open a text window before you start, and use the mouse for all cursor movement. Instead of straight $username, <tab>, $password, <enter>, type a bit of $username, then move to the text window and type some random rubbish, then back to a bit more username and so on. Use the mouse to move to the password and repeat the process. Close the text window without saving it, then use the mouse to log on.
Sounds tedious and a little crazy, but it ought to work.
Figured that out after 2 litres of lager, so you be the judge 8-)
This post has been deleted by its author
I got a ms keyboard with bluetooth and before this one i had another ms desktop set but infra red and with that one i replaced the standard mouse with an identical mouse (same type and model) and i needed a different receiver for it... So I dunno about this... Might just be a bug in the "cheaper" versions
the 2 desktop sets, Optical Wireless Desktop 1000 & 2000, don't use BlueTooth... and having used both sets and a bluetooth set... and being the owner of various mobile fones and other bluetooth and 802.11 kit, i can tell you that if someone wanted to listen.. and was able to pick out just 1 particular keyboard signal stream out of all that mess... then... well.. that person is... something else. i have a hard time keeping each device from interfering with the other that i couldn't imagine that any signal getting out would be of much use. i don't know much about signal targeting and the abilities of equipment to filter out everything else except just 1 targeted range... but i can't see this as being practical at all unless theres nothing else in between the target and snooper.
01001110 01100001 01101000 00101100 00100000 01101110 01101111 00100000 01100010 01101100 01100001 01100011 01101011 00100000 01100011 01101111 01110000 01110100 01100101 01110010 01110011 00101110 00100000 01001010 01110101 01110011 01110100 00100000 01100010 01101001 01101100 01101100 00100000 01100111 01100001 01110100 01100101 01110011 00101100 00100000 01110011 01110100 01100101 01110110 01100101 00100000 01101010 01101111 01100010 01110011 00100000 01100001 01101110 01100100 00100000 01101000 01101001 01110011 00100000 01101001 01110000 01101000 01101111 01101110 01100101 00100000 01110011 01101001 01110100 01110100 01101001 01101110 01100111 00100000 01110101 01101110 01100100 01100101 01110010 00100000 01111001 01101111 01110101 01110010 00100000 01100100 01100101 01110011 01101011 00100000 00111010 00101001
Finally got to put that first year uni coursework into practice :)
01100010 01101001 01101100 01101100 00100000 01100111 01100001 01110100 01100101 01110011 00101100 00100000 01110011 01110100 01100101 01110110 01100101 00100000 01101010 01101111 01100010 01110011 00100000 00101110 00101110 00101110 00100000 01110011 01101001 01110100 01110100 01101001 01101110 01100111 00100000 01110101 01101110 01100100 01100101 01110010 00100000 01111001 01101111 01110101 01110010 00100000 01100100 01100101 01110011 01101011 00100000 00101110 00101110 00101110 00100000 01101111 01101111 01101000 00101100 00100000 01100101 01110010 01110010 00101110 00100000 00100000 01001001 00100111 01101100 01101100 00100000 01100111 01100101 01110100 00100000 01101101 01100101 00100000 01100011 01101111 01100001 01110100 00100000 00111011 00101101 00101001
apologies
00110101 00110011 00100000 00110110 00111000 00100000 00110110 01100110 00100000 00110111 00110101 00100000 00110110 01100011 00100000 00110110 00110100 00100000 00110010 00110111 00100000 00110111 00110110 00100000 00110110 00110101 00100000 00110010 00110000 00100000 00110111 00110101 00100000 00110111 00110011 00100000 00110110 00110101 00100000 00110110 00110100 00100000 00110010 00110000 00100000 00110101 00110010 00100000 00110100 00110101 00100000 00110100 00110001 00100000 00110100 01100011 00100000 00110010 00110000 00100000 00110111 00110011 00100000 00110110 00110101 00100000 00110110 00110011 00100000 00110111 00110101 00100000 00110111 00110010 00100000 00110110 00111001 00100000 00110111 00110100 00100000 00110111 00111001 00100000 00110010 01100101 00100000 00110010 00110000 00100000 00110011 01100001 00100000 00110010 00111001 00100000 00100001
So there. :P
The only lesson in this article and the commentary is that ANY wireless transmission (including IR) is not secure. It is, however, convenient.
Let's look at this realistically. You have a wireless transmission that has a range of 10 meters. So anyone that is trying to eavesdrop on it has to be close enough to get clear reception of the signal. OK, if there's someone lurking behind your living room couch, chase them out! Second, the reception needs to be done while something "useful" is being typed - like your bank logon password. Since this doesn't happen all the time, the eavesdropper probably needs to either relay or record the keystroke data in order to post-process it for interesting bits.
The effort to do this is fairly large: unless you have a specific, high-value target in mind, it's much, MUCH cheaper to just buy the data from a black-market data broker.
On the other hand, a reasonably high-value target would be a bank branch or similar location that uses wireless keyboards. Or Larry Ellison's house.
And finally: if you can get within 10 meters of your "target", you can probably get a data logger dongle directly onto their keyboard connection ANYWAY.
Everything in life has a risk associated with it. For the average home user, this one is right up there with being killed by terrorists using a two-part liquid explosive device on an airplane. Go warp yourselves up with tinfoil-lined bubble wrap again.
(BTW, it's a good article, John. I didn't know that 27MHz keyboards used a key to limit cross-talk with other similar devices, and it just MIGHT be useful to warn those high-value targets.)
The LeetKey extension for firefox lets you encode and decode binary on the fly. It also does AES encrypt and decrypt. There's an idea! The keyboard only sends groups of 100 characters, encrypted with AES, which the driver then decodes. All we need to do is remember what we've typed 100 characters ahead. Simple. Not much good for games though...
"The only lesson in this article and the commentary is that ANY wireless transmission (including IR) is not secure. It is, however, convenient."
The big difference between IR and 27MHz is that I can block IR using walls and windows (glass isn't transparent to IR, btw). Those radio emissions, on the other hand, can be snooped by the guy next door or the other bloke in a car out in the street who has a massive aerial in his boot (10m range, be damned).
Brett Brennan writes: "Let's look at this realistically. You have a wireless transmission that has a range of 10 meters. So anyone that is trying to eavesdrop on it has to be close enough to get clear reception of the signal."
Just because your wireless keyboard wont work further away than 10 meters doesn't mean that someone with more sensitive equipment can't pick up the signal substantially further away, in surrounding buildings or out in the street.
To those who are supposing this is to prevent keyboard conflicts, you are exactly right!
Probably 10 years ago or so, a story popped up about someone with one of the RF keyboards of the time, well, their computer started going crazy, they'd have random stuff typed into office, etc. It turned out, yes, they were picking up their neighbors keyboard. At this point, the RF keyboard vendors realized, hey! If the product actually becomes popular, they'll have neighbors interfering quite often. So they put on this synchronizing between the base and keyboard, using 8-bit code. It's just to avoid interference.
Rather than worrying about people getting your data over radio (which bluetooth worries about), I think they thought about this more the way the old portable phone makers did. With the analog portable phones, the phone and base would sync. But, this would just pick out the clearest channel, and set a code so your neighbor's phone base doesn't ring your phone. Your call was still in the clear, it was simply meant to avoid your phone and your neighbor's phone interfering as much as possible.
However, this certainly does bring to light the fact that keyboards really shouldn't use something so weak anymore; if people are going to pull credentials off wifi, they certainly could get them off keyboard streams. (usernames, passwords, etc.)
All this talk of encryption is insignificant. my MS wireless KB (brought cos i'm a student and it was going CHEAP) has such a poor range that if someone wanted to eavesdrop they's have to be actually INSIDE the plastic body of the Keyboard. (oh, yes, the mousewheel broke after a month too.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
