[su_heading size=”18″ margin=”40″]KeySniffer: Security researchers have identified a vulnerability that affects wireless keyboards and allows attackers to monitor everything you type. Most worryingly? The vulnerability is technically unpatchable.[/su_heading]
Attackers can monitor keystrokes from wireless keyboards as they are transmitted to nearby computers, intercept sensitive data, and even inject malicious commands into the keystroke data stream.
According to security firm Bastile, the vulnerability, also known as Keysniffer, affects wireless keyboards from well-known vendors, including Anker, EagleTec, General Electric, Hewlett-Packard, Insignia, Kensington, Radio Shack, and Toshiba.
Bastile is the same company that earlier this year discovered the MouseJack, which allowed an attacker to map malicious mice/keyboards to USB dongles used by various wireless mouse and keyboard vendors.
The KeySniffer vulnerability is essentially an evolution of MouseJack, but instead of matching rogue devices, KeySniffer allows an attacker to eavesdrop on data exchanged between a user's wireless keyboard and USB dongle. Wireless mice are not affected by the vulnerability, and attackers can also inject malicious keystrokes into the data stream between vulnerable wireless keyboards and dongles.
[su_note note_color=”#d7dfe0″ radius=”7″]All data exchanged between vulnerable keyboards and connected USB dongles is in plain text, allowing attackers to track everything victims type. Attackers can even see credit card details in clear text when users make online payments or their passwords when logging into online accounts.[/su_note]
To carry out the attack, all attackers need is a specially created device that they plug into their computer's USB port, which is essentially a modified antenna. The entire device costs no more than $100 and allows attackers to carry out attacks from dozens of meters away.
Most worryingly, this particular security flaw is technically unfixable:
“The transceivers used in wireless keyboards vulnerable to KeySniffer are inherently insecure due to their lack of encryption, and they do not support firmware upgrades,” Bastile explains.
Therefore, the company recommends that users of vulnerable keyboards switch to Bluetooth or wired keyboards in order to be effectively protected from this type of attack.
