Flaws in wireless keyboards let hackers snoop on everything you type

[Brink]

Your wireless keyboard is giving up your secrets -- literally.

With an antenna and wireless dongle worth a few bucks, and a few lines of Python code, a hacker can passively and covertly record everything you type on your wireless keyboard from hundreds of feet away. Usernames, passwords, credit card data, your manuscript or company's balance sheet -- whatever you're working on at the time.

It's an attack that can't be easily prevented, and one that almost nobody thought of -- except the security researchers who found it.

Security firm Bastille calls it "KeySniffer," a set of vulnerabilities in common, low-cost wireless keyboards that can allow a hacker to eavesdrop from a distance.

Here's how it works: a number of wireless keyboards use proprietary and largely unsecured and untested radio protocols to connect to a computer -- unlike Bluetooth, a known wireless standard that's been tried and tested over the years. These keyboards are always transmitting, making it easy to find and listen in from afar with the right equipment. But because these keystrokes aren't encrypted, a hacker can read anything on a person's display, and directly type on a victim's computer.

The attack is so easy to carry out that almost anyone can do it -- from petty thieves to state-actors...

Read more: Flaws in wireless keyboards let hackers snoop on everything you type | ZDNet

 

[Layback Bear]

Yaaa I'm safe. Two wired keyboards.

 

[Borg 386]

You think that's bad? You can't even screw in a light bulb anymore without worrying about security.

The security firm said in an advisory that one of the worst flaws could allow an attacker to "take control of a product" in order to launch attacks against a browser by allowing the injection of persistent JavaScript and web-based HTML code into the web management interface.

That could lead to browser-based attacks against a user.

Another severe weakness in the smart home device allows an attacker to identify the wireless network's password.

Serious security flaws found in Osram smart bulbs | ZDNet

 

[Anak]

I wonder how many tens, hundreds of thousands of those osram units are out there, and how does the consumer get an upgrade, even if osram does update the units, isn't it irresponsible to continue to sell the units that don't have the Zigbee update?

Their not cheap either, my local Lowes has the wifi unit at $32.49, a bulb at $29.98 and complete units from $45 to $60, then factor in what an attacker could gain: Comparison page

 

[Dallas 7]

Yaaa I'm safe. Two wired keyboards.

Same here. Well, one wired and one laptop.

 

[strollin]

I've never understood why people use the cheap wireless keyboards/mice instead of Bluetooth. This is just one more reason to use Bluetooth instead.

 

[Layback Bear]

Wow strollin.

You are still using a IBM Model M, great keyboards.
Wish I had one. I'm going to check with my dealer in town and see if he still has one laying around I could buy as a backup. Many years ago he sold IBM business equipment. I might get lucky.

I must have a half dozen keyboard tucked away that I have tried through the years and another half dozen I trashed because they were less value that the box them came in.
I finally got a Das Pro before I found one I really liked. Now I have two of them.

 

[ThrashZone]

Hi,
I believe even blue tooth devices have security flaws.

 

[groze]

Dose ZDNET mean the Microsoft outlook program or Microsoft web based outlook email? I use the Microsoft web based email program accessed thru both firefox & Thunderbird. That is our main emails. ZDNET forgot one thing, some apps you can't use unless your a signed in with a Microsoft account. Before someone says this. You can sign into apps using a Microsoft account without having to change your computer to a Microsoft account. I am glad I didn't keep windows 10. I said I was going to test windows 10 anniversary edition. I did. It blinked as well. So, I will be getting rid of all windows 10 iso images. It figures, I didn't have the issue until way after the November release. Just for info this was a clean install & it did activate under digital entitlement.

 

[STU9000]

I've never understood why people use the cheap wireless keyboards/mice instead of Bluetooth. This is just one more reason to use Bluetooth instead.

Because they're cheap.

I guess it's time to type in passwords on my main keyboard from now on.

 

[BlueGuy]

Naw, I only use wireless with the HTPC, as a remote wasn't included with one brand of tuner I use, everything else is old-fashioned PS2 connected.

 

[GEWB]

Original IBM Model M was great. This can work:

Category

Regards,
GEWB

 

[michael diemer]

I'm wondering if this would affect Linux systems as well. Logitech has a fix, but it's only for Windows. Anyone know?

 

[groze]

I'm wondering if this would affect Linux systems as well. Logitech has a fix, but it's only for Windows. Anyone know?

I don't know. I would say maybe. I would assume the sudo/root password prompt would be enough protection.

This site gives a little more detail.

wired (Link)

 

[HammerHead]

Bypass

Stu ---- Several pass word apps store passwords and enter them skipping the keyboard entry. That might help this situation.