Earlier this year, Marc Newlin of Bastille Networks, a security company specializing in detecting and mitigating the threats affecting the internet of things (IoT), discovered KeySniffer.
KeySniffer is a set of security vulnerabilities affecting non-Bluetooth wireless keyboards. The wireless keyboards susceptible to KeySniffer use unencrypted radio communication protocols, enabling an attacker to eavesdrop on all the keystrokes typed by a victim from several hundred feet away using less than $100 of equipment.
This means an attacker can snatch personal and private data such as credit card numbers, usernames, passwords, security question answers and other sensitive or private information — all in clear text, according to technical details provided by KeySniffer.net.
Why my keyboard? How am I vulnerable?
Wireless keyboards work by transmitting radio frequency packets from the keyboard to a USB dongle plugged into a user’s computer. When you type on your wireless keyboard, information describing the specific keystrokes is sent wirelessly to the USB dongle. The USB dongle listens for radio frequency packets sent by the keyboard, and notifies the computer whenever you press, or release a key.
To prevent eavesdropping, high-end keyboards encrypt the keystroke data before it is transmitted wirelessly to the USB dongle (sometimes you do get what you pay for). The dongle knows the encryption key being used by the keyboard, so it is able to decrypt the data and see which key was pressed. Without prior knowledge of the encryption key, an attacker is unable to decrypt the data, and therefore unable to see what is being typed, according to KeySniffer.net.
What do I do about it?
First, go to your keyboard manufacturer’s technical support website and look for any response regarding the KeySniffer vulnerability. Remember, the transceivers used in wireless keyboards vulnerable to KeySniffer are inherently insecure due to a lack of encryption, and, for the most part, do not support firmware updates. Users of vulnerable keyboards should switch to Bluetooth or wired keyboards to protect themselves from keystroke sniffing and injection attacks.
Because the threat is always evolving, I use a rule of thumb for my personal computing technology – if I can’t remember when I bought it — I probably should replace it.
Visit the DON CIO website: www.doncio.navy.mil/ for more information about protecting your personal and DON electronic devices.