TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

KeySweeper – Arduino-based passive wireless keyboard sniffer

462 点作者 mathetic超过 10 年前

15 条评论

bithush超过 10 年前
This is a beautifully done hack.<p>Using a legitimate USB charger. The GSM radio for 2G internet broadcast. The built in battery for short term unplugged continued sniffing. Trigger word SMS messages. Live streaming web portal.<p>That is very, very cool. This is the kind of stealth monitoring device people just would never think to check and could easily be replaced without the user being any the wiser.<p>This is a beautiful example of a real hack superbly executed. Bravo.<p>Edit: Just realised this is the guy (or team?) behind EverCookie.
评论 #8875643 未加载
pjonesdotca超过 10 年前
Looking at the list of projects also done (by going to root of url) is quite impressive. <a href="http://samy.pl/" rel="nofollow">http:&#x2F;&#x2F;samy.pl&#x2F;</a>
评论 #8874991 未加载
评论 #8874916 未加载
评论 #8878714 未加载
edwintorok超过 10 年前
Does this apply to all bluetooth keyboards?<p>Sounds like some public-key crypto could make it safe: embed some unique keys at manufacturing time and use some small crypto library (like tweetnacl) to communicate and have mutual authentication. For the paranoid there could be a way to update the keys so that not even the vendor can sniff the keystrokes. Isn&#x27;t there a RFC for something similar?
评论 #8875012 未加载
评论 #8875306 未加载
评论 #8875002 未加载
eyeareque超过 10 年前
Off topic, but this is a great talk that Samy gave at blackhat in 2010: How I met your girlfriend: <a href="https://www.youtube.com/watch?v=O5xRRF5GfQs" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=O5xRRF5GfQs</a>
lgeek超过 10 年前
The added electronics just rest against the adapter&#x27;s boards: <a href="http://samy.pl/keysweeper/testingsize.jpg" rel="nofollow">http:&#x2F;&#x2F;samy.pl&#x2F;keysweeper&#x2F;testingsize.jpg</a>. This looks quite unsafe because of reduced clearances. It has a chance of either exposing HV on the LV (USB power) side or shorting the various boards, potentially starting a fire.<p>It&#x27;s a pretty cool proof-of-concept, but I wouldn&#x27;t connect anything to the USB port. These issues could be solved for deployment by potting or by using a custom smaller PCB integrating the various boards.
评论 #8877229 未加载
stygiansonic超过 10 年前
I&#x27;m assuming it was intentional, but I love how the page is structured somewhat like a page from the NSA ANT catalog[0][1]. The device itself seems like it would fit right in to that list.<p>0. <a href="https://www.eff.org/files/2014/01/06/20131230-appelbaum-nsa_ant_catalog.pdf" rel="nofollow">https:&#x2F;&#x2F;www.eff.org&#x2F;files&#x2F;2014&#x2F;01&#x2F;06&#x2F;20131230-appelbaum-nsa_...</a><p>1. <a href="https://en.wikipedia.org/wiki/NSA_ANT_catalog" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;NSA_ANT_catalog</a>
alllways超过 10 年前
Are there any good resources for learning more about wireless communication? Its something I have been wanting to learn for a while but compared to resources for programming, resources for learning about wireless communication are scarce. I am especially referring to embedded wireless, I would love to know how the nRF24 works.
deeviant超过 10 年前
Finally. My irrational hate for wireless keyboards is vindicated!
MertsA超过 10 年前
So since the protocol contains basically no authentication other than the MAC address of the keyboard which the attacker can easily figure out, why isn&#x27;t there already a key injection portion of this exploit ala wireless USBdriveby? I can totally see this being extended to wireless keyboard and mouse combos which would give you a great way to know if the user was at the computer and when it would be safe to compromise it without someone noticing.
mrb超过 10 年前
The most frustrating thing when reading about keyboard vendors implementing such insecure protocols is knowing that the nRF24LE1 chip Microsoft uses has all it needs for security: <i>hardware accelerated support for AES</i>, as well as a <i>hardware random number generator</i> [1]. Some comments here suggest using public&#x2F;private crypto as a fix, but it would not even be necessary. During manufacturing they could simply generate a unique secret AES key for each keyboard&#x2F;dongle pair, store it in the 1536-byte non-volatile area of the chips, have the hardware RNG on the keyboard generate the IV when a wireless session begins, and use AES in CTR mode. Heck you could even afford to reserve a few bytes in each packet to store the counter in plaintext for automatic resynchronization when packets are lost, since the nRF24 radios support big enough packets (32 bytes). There are absolutely zero technical reasons not to implement security. It does <i>not</i> significantly increase power consumption. It does <i>not</i> bloat the code that much.<p>(I know all this because I have done a lot of work with the nRF24LE1. It is cheap: $4 for a fully assembled module on eBay [2]. It &quot;supports&quot; Bluetooth by bit-banging it [3]. And code for the builtin 8051 core can be compiled by the open source compiler sdcc. These are reasons why I selected this chip for my DIY home automation system.)<p>In fact the nRF24 radios are so popular that the vast majority of non-Bluetooth wireless keyboards use them. And I guarantee you that even though they use different protocols, they are almost certainly just as insecure as these Microsoft keyboards. The only reason vendors do not implement secure protocols is because customers do not know or care about security. The very few vendors who do such as [4] sell keyboards for hundreds of dollars... there is again zero reasons why it would cost that much given that it could be done with a standard nRF24LE1 :-(<p>[1] <a href="http://www.keil.com/dd/docs/datashts/nordic/nrf24le1_ds_v1_1.pdf" rel="nofollow">http:&#x2F;&#x2F;www.keil.com&#x2F;dd&#x2F;docs&#x2F;datashts&#x2F;nordic&#x2F;nrf24le1_ds_v1_1...</a><p>[2] The $1 chip Sammy is talking about is another variant: the nRF24L01 which is just the bare radio without the 8051 core<p>[3] <a href="http://dmitry.gr/index.php?r=05.Projects&amp;proj=11.%20Bluetooth%20LE%20fakery" rel="nofollow">http:&#x2F;&#x2F;dmitry.gr&#x2F;index.php?r=05.Projects&amp;proj=11.%20Bluetoot...</a><p>[4] <a href="http://matias.ca/securepro/pc/" rel="nofollow">http:&#x2F;&#x2F;matias.ca&#x2F;securepro&#x2F;pc&#x2F;</a> ($170!)<p>Edit #1: a colleague of mine opened up the Matias Secure Pro keyboard and confirmed it uses an nRF24LE1.<p>Edit #2: @cortesoft: The way I would support this &quot;one dongle many devices&quot; feature is by doing the key generation during pairing (sometimes done by pressing a small switch under the keyboard) instead of during manufacturing. The only window of attack would be if an active attacker was present during pairing and pretended to be the dongle. It would still be significantly more secure than current keyboard protocols.
评论 #8875906 未加载
评论 #8875943 未加载
DINKDINK超过 10 年前
As impressive as this hack was, I almost expected him to say that the LED was transmitting the keystroke data over LiFi ;)
roozbeh18超过 10 年前
Sammy mentioned, he would tell us how to prevent this but he never did. I am guessing since Microsft keyboard emits the CD at all time and is prone to this attack, for now I should stop using it.
评论 #8876150 未加载
gesman超过 10 年前
I glad i use my old, trusty IBM keyboard :)
评论 #8875085 未加载
spydum超过 10 年前
perhaps the team managing the centcom twitter account[1] should be checking their offices? :)<p>[1] <a href="http://therightscoop.com/breaking-centcom-twitter-youtube-accounts-hacked-by-isis-group/" rel="nofollow">http:&#x2F;&#x2F;therightscoop.com&#x2F;breaking-centcom-twitter-youtube-ac...</a>
curiously超过 10 年前
this is scary as hell! what about other wireless keyboards, especially the mac? I will switch to a mac keyboard if it&#x27;s safe.
评论 #8877262 未加载
评论 #8876972 未加载