Eavesdropping on a wireless keyboard (2013)
windytan.com
windytan.com
Turns out this is not so far-fetched after all:
"If you have an audio recording of somebody typing on an ordinary computer keyboard for fifteen minutes or so, you can figure out everything they typed."
https://freedom-to-tinker.com/blog/felten/acoustic-snooping-...
The first part of their presentation uses a novel method to pick up PS/2 keystrokes from a system's ground connection. This presentation was what lead me to design the PS/2 tap[2] to sniff keystrokes with my sound card.
[1] https://www.youtube.com/watch?v=9zq9DQAbWmU [2] https://github.com/dominicgs/PS2_tap
Choosing a keyboard because the box says "128 bit encryption" doesn't help if the manufacturer bakes in the same key on every device. Or a predictable key. Or really, any static session key even if it varies by device serial number or something like that. And a marketing or advertising guy doesn't know this, they just see a checkbox they can stick on the artwork. "Just get that 128 bit stuff in there so we aren't lying" is the most likely scenario for something like a keyboard, where competition is tough and margins are wafer thin.
Personally I'd use copper if I was at all worried, because the likelihood of some random firmware engineer getting a security protocol right is pretty slim.
If my main priority was security, then I would never even think about wireless (network, keyboard, etc.).
If a keyboard radiates it is likely to be either from the unshielded, unbalanced matrix wires going to the keyswitches, or leakage from the controller going onto the outside of the shield. (I think the latter could be reduced by using (more/bigger) decoupling capacitors, i.e. shorting out the RF.)
Coiling a wire does not generally make it a more effective antenna; it may or may not make it less effective depending on the circumstances. (The reason some antennas are coiled is to get the same length of conductor into a smaller space.)
But yeah, another post from windytan that's left me amazed. If you're uninitiated, this is the same woman that figured out how to read from bus timetable display radio signals [1].
I'll stick to my USB wired keyboard for now, though, until encrypted wireless keyboards come down from £70-100.
[1]: http://www.windytan.com/2013/11/decoding-radio-controlled-bu...
Also, Bluetooth LE provides no eavesdropping protection. If an attacker can capture the pairing frames, they may be able to determine the "long-term key". Here's the NIST guidance paper on Bluetooth security: http://www.nist.gov/customcf/get_pdf.cfm?pub_id=911133
The attack surface can be minimized if the keyboard manufacturer implements crypto properly, requires encryption at the protocol level, uses a long and complex PIN, etc. The manufacturer with the best reputation right now is Microsoft. They got burned pretty hard when their propriety wireless encryption was hacked back in 2007, and it looks like their bluetooth keyboards are doing everything right.
Is anything known about the security of Apple's current bluetooth keyboard?
There's a practical attack for that, and it's quick. It also uses Ubertooth[1].
For all Bluetooth keyboards that I've seen in the past ~5 years the pairing process uses one of the "Secure Simple Pairing" modes. none of these have been broken, although "Just Works" is probably vulnerable. The keyboard that I've see use the "enter a 6 digit number" mode, which is not susceptible to man in the middle attacks that have been used against Bluetooth keyboards before[2].
Disclosure: I work on the Ubertooth and related projects.
[1] https://www.usenix.org/conference/woot13/workshop-program/pr...
We just have to establish the secure channel and securely authenticate peers to each other. The medium over which this is made is mostly irrelevant.