Incident: Wireless Keyboard Vulnerabilities Exploited by Keysniffer Attack.

Published Date: 2016-02-23

Postmortem Analysis
Timeline 1. The software failure incident mentioned in Article 45984 happened in 2016 (Published on 2016-07-26). 2. The software failure incident mentioned in Article 40375 happened in 2016 (Published on 2016-02-23). 3. The software failure incident mentioned in Article 46031 happened in 2016 (Published on 2016-07-26).
System 1. Wireless keyboards from various manufacturers such as HP, Toshiba, General Electric, Kensington, Radio Shack, Anker, EagleTec, and Insignia [45984, 40375, 46031] 2. Wireless mouse dongles from Logitech, Dell, Microsoft, HP, Amazon, Gigabyte, and Lenovo [40375, 40773] 3. USB dongles using Nordic Semiconductor chips [40375, 40773]
Responsible Organization 1. Security researchers at Bastille were responsible for identifying and demonstrating the software failure incidents related to wireless keyboard vulnerabilities, including attacks known as Keysniffer and Mousejacking [45984, 40375, 40773, 46031].
Impacted Organization 1. Users of wireless keyboards and mice from various manufacturers such as HP, Toshiba, Radio Shack, Kensington, Insignia, General Electric, Anker, and EagleTec were impacted by the software failure incident [45984, 40375, 46031]. 2. Companies manufacturing vulnerable wireless keyboards and mice, including Logitech, Dell, Microsoft, HP, Amazon, Gigabyte, Lenovo, and Jasco, were also impacted by the software failure incident [40375, 40773, 46031].
Software Causes 1. Lack of encryption in wireless keyboard transmissions, leaving them vulnerable to keystroke injection and eavesdropping [45984, 40375, 46031] 2. Failure to properly authenticate communicating devices, allowing rogue devices to inject unencrypted keystrokes [40375] 3. Use of proprietary radio protocols without proper encryption implementation in wireless devices [40375] 4. Vulnerability of wireless dongles to accept keystrokes from unauthorized devices [40375] 5. Lack of firmware updates or patch mechanisms in affected wireless devices [45984, 40375, 46031]
Non-software Causes 1. Lack of encryption in wireless keyboard transmissions [45984, 40375, 46031] 2. Use of generic alternative transceiver chips without proper encryption [45984] 3. Failure to properly authenticate communicating devices [40375] 4. Vulnerability in the firmware of wireless devices using Nordic Semiconductor chips [40375] 5. Lack of encryption in wireless mouse traffic [40375] 6. Vulnerability in wireless USB dongles used to connect mice and keyboards [40773] 7. Proprietary radio protocols not properly studied or secured [40773] 8. Lack of firmware updates for some vulnerable devices [40773]
Impacts 1. The software failure incident allowed hackers to inject keystrokes onto victims' machines from a distance, potentially compromising sensitive information like passwords and security questions [45984, 46031]. 2. The vulnerability affected wireless keyboards and mice from various manufacturers, leaving millions of devices susceptible to attacks [40375, 40773, 46031]. 3. The incident highlighted the lack of encryption in the affected devices, making it easy for hackers to intercept and read keystrokes without any authentication [40375, 40773, 46031]. 4. Manufacturers faced challenges in addressing the vulnerabilities as some devices couldn't be easily patched, leading to recommendations for users to switch to wired keyboards or Bluetooth-enabled devices for better security [40375, 40773]. 5. The incident raised concerns about the security of wireless peripherals and the need for better encryption and authentication protocols to prevent similar attacks in the future [40375, 40773, 46031].
Preventions 1. Implementing encryption in wireless keyboard communications could have prevented the software failure incident. The vulnerability in the wireless keyboards was due to the lack of encryption in transmitting keystrokes, making it easy for hackers to intercept and read the data [40375, 46031]. 2. Using standardized and extensively security-tested protocols like Bluetooth for wireless connections could have enhanced security and prevented the vulnerability. Devices using generic radio protocols were found to be more vulnerable due to lack of encryption and security testing [45984]. 3. Regular security audits and testing of wireless peripherals by the manufacturers could have identified and fixed the vulnerabilities before they were exploited by hackers. Proper authentication mechanisms and encryption should be implemented to secure wireless communications [40375, 46031].
Fixes 1. Manufacturers can release firmware updates for affected devices to patch the vulnerabilities. For example, Logitech has developed a firmware update for its affected devices [40375]. 2. Users can switch to more secure alternatives such as Bluetooth keyboards and mice, which have undergone extensive security testing [40375]. 3. Users can switch to wired peripherals as a safer alternative to wireless devices [45984]. 4. Manufacturers can implement encryption and authentication properly in their wireless devices to prevent unauthorized access [40375]. 5. Manufacturers can discontinue the sale of vulnerable products and offer replacements with improved security features [40773]. 6. Manufacturers can work with security researchers to address security issues and improve the security of their products [46031].
References 1. Security researchers at Bastille [45984, 40375, 40773, 46031] 2. Logitech [40375, 40773] 3. Dell [40773] 4. Microsoft [40375, 40773] 5. HP [45984, 46031] 6. Toshiba [45984, 46031] 7. General Electric [45984, 46031] 8. Amazon [40375, 40773] 9. Gigabyte [40375, 40773] 10. Lenovo [40375, 40773] 11. Kensington [45984, 46031] 12. Radio Shack [45984] 13. Anker [45984, 46031] 14. EagleTec [45984, 46031] 15. Insignia [45984, 46031] 16. Jasco [45984, 46031]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) In the articles, it is mentioned that Microsoft wireless keyboards were previously vulnerable to a keyboard-sniffing tool called KeyKeriki in 2009 and an Arduino-based tool called KeySweeper in the past year [45984]. This indicates that similar incidents have happened before with Microsoft's wireless keyboards. (b) The articles highlight that the recent software failure incidents involving wireless keyboards and mice affected devices from various manufacturers such as Logitech, Dell, Microsoft, HP, Amazon, Gigabyte, Lenovo, HP, Toshiba, General Electric, Kensington, Radio Shack, Anker, and EagleTec [40375, 40773, 46031]. This shows that the issue of vulnerabilities in wireless peripherals has occurred across multiple organizations and their products.
Phase (Design/Operation) design, operation (a) In the articles, the software failure incidents related to the design phase can be seen in the vulnerabilities found in wireless keyboards and mice due to lack of encryption in the radio protocols used by the devices. Security researchers at Bastille discovered vulnerabilities in wireless peripherals from various manufacturers like HP, Toshiba, Radio Shack, Kensington, Insignia, General Electric, Anker, and EagleTec. These vulnerabilities allowed hackers to inject keystrokes onto a victim's machine from a distance and even read keystrokes silently. The lack of encryption in the radio protocols used by these devices left them susceptible to attacks, highlighting a design flaw in the security of these wireless peripherals [45984, 40375, 46031]. (b) The software failure incidents related to the operation phase can be observed in the exploitation of vulnerabilities in wireless keyboards and mice through attacks like "mousejacking." Hackers were able to inject mouse movements or keystrokes into target devices from a nearby antenna, even when the devices were designed to encrypt and authenticate their communications with a paired computer. This operation-related failure was due to the fact that many wireless mouse traffic wasn't encrypted, making it easier for hackers to spoof devices and take control of PCs. The misuse or operation of these vulnerable wireless peripherals allowed for unauthorized access and potential compromise of the targeted systems [40375, 40773].
Boundary (Internal/External) outside_system (a) The software failure incident described in the articles is primarily within_system. The incidents of "Mousejacking" and "Keysniffer" detailed in the articles are caused by vulnerabilities in the wireless keyboards and mice themselves, specifically related to the lack of encryption in the communication protocols used by these devices. The vulnerabilities allow hackers to inject keystrokes or read keystrokes from a distance using radio signals, without the need for physical access to the target device [40375, 40773, 46031]. (b) Additionally, the incidents involve the use of inexpensive radio dongles and antennas to exploit these vulnerabilities, indicating that the attacks originate from external factors such as the availability of easily accessible hardware tools that can be used to compromise the security of the wireless peripherals [40375, 40773].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - In the articles, the software failure incidents related to wireless keyboard vulnerabilities, known as Keysniffer and Mousejacking, were primarily caused by the lack of encryption in the wireless keyboards and mouse dongles. These vulnerabilities allowed hackers to intercept keystrokes and inject malicious commands onto computers from a distance using radio signals without human participation [45984, 40375, 46031]. (b) The software failure incident occurring due to human actions: - The vulnerabilities in wireless keyboards and mouse dongles were exacerbated by human actions such as manufacturers not implementing proper encryption and authentication protocols in the firmware of the devices. This lack of attention to security measures by the manufacturers led to the exploitation of the devices by hackers through techniques like Keysniffer and Mousejacking [40375, 40773, 46031].
Dimension (Hardware/Software) hardware, software (a) The software failure incident occurring due to hardware: - The articles discuss software failure incidents that are related to hardware vulnerabilities in wireless keyboards and mice dongles. These vulnerabilities allow hackers to inject keystrokes onto a victim's machine from a distance, compromising the security of the devices [45984, 40375, 40773, 46031]. (b) The software failure incident occurring due to software: - The software failure incidents discussed in the articles are primarily due to vulnerabilities in the software/firmware of wireless devices, specifically the failure to properly implement encryption and authentication protocols in the firmware of wireless dongles used for keyboards and mice [45984, 40375, 40773, 46031].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident described in the articles is malicious in nature. Security researchers at Bastille discovered vulnerabilities in wireless keyboards and mice that allowed hackers to inject keystrokes onto victims' machines from a distance, read keystrokes, and silently record typing [45984]. The attack, known as Keysniffer, exploited the lack of encryption in the devices' communication protocols, allowing hackers to intercept keystrokes without authorization [45984]. Additionally, the attack affected keyboards from various well-known manufacturers such as HP, Toshiba, General Electric, Kensington, and others [45984]. The incident involved reverse engineering the devices and exploiting their lack of security measures to compromise users' privacy and potentially gain unauthorized access to their systems. (b) The software failure incident is non-malicious in nature. The vulnerability in wireless keyboards and mice, known as "Mousejacking," was discovered by security researchers at Bastille [40375]. This vulnerability allowed an attacker to inject mouse movements or keystrokes into a target device from a nearby antenna, even if the device was designed to encrypt and authenticate its communications with a paired computer [40375]. The incident highlighted flaws in the firmware of wireless devices using chips from Nordic Semiconductor, which required vendors to implement encryption themselves, leading to vulnerabilities in the communication between computers and peripheral devices [40375]. The attack exploited a collection of distinct problems in the firmware of affected devices, rather than being a deliberate act of malicious intent.
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident: - The software failure incidents described in the articles were primarily due to poor decisions made by manufacturers of wireless keyboards and mice. These devices were found to have vulnerabilities that allowed hackers to inject keystrokes or read keystrokes from a distance without encryption, leading to potential security breaches [45984, 40375, 40773, 46031]. (b) The intent of the software failure incident: - The software failure incidents were not a result of accidental decisions or unintended mistakes but rather a result of deliberate choices made by manufacturers to use insecure radio protocols and lack encryption in their wireless peripherals, making them vulnerable to attacks [45984, 40375, 40773, 46031].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident occurring due to development incompetence: - The articles discuss software failure incidents related to wireless keyboard vulnerabilities, where millions of wireless keyboards from various manufacturers were found to transmit keystrokes without encryption, leaving them vulnerable to attacks [45984, 40375, 46031]. - The vulnerabilities were attributed to the lack of encryption in the keyboards' transmissions, indicating a lack of professional competence in designing secure communication protocols for the devices [45984, 40375, 46031]. (b) The software failure incident occurring due to accidental factors: - The articles describe how the vulnerabilities in wireless keyboards were not intentional but rather a result of how the wireless mouse traffic wasn't always encrypted, leading to the acceptance of unencrypted keystrokes from rogue devices [40375]. - The vulnerabilities were not due to a deliberate decision to leave the devices unsecured but rather an accidental oversight in implementing encryption and authentication in the firmware of the wireless devices [40375].
Duration temporary The software failure incident described in the articles can be categorized as a temporary failure. The vulnerability in wireless keyboards and mice, known as "Mousejacking" and "Keysniffer," was due to specific circumstances related to the lack of encryption and authentication in the wireless communication protocols used by various manufacturers [Article 45984, Article 40375, Article 40773, Article 46031]. The vulnerability allowed hackers to inject keystrokes or read keystrokes from wireless keyboards and mice, potentially compromising the security of the affected devices. Manufacturers like Logitech, Dell, Lenovo, and Microsoft acknowledged the vulnerability and took steps to address it, such as developing firmware updates or offering replacements for affected devices [Article 40375, Article 40773].
Behaviour crash, other (a) crash: - Article 45984 reports a software failure incident related to a crash where hackers were able to inject keystrokes onto machines from a distance using wireless keyboard vulnerabilities. - Article 40375 discusses a similar incident where wireless keyboards and mice were vulnerable to an exploit called "mousejacking," allowing intruders to type malicious commands on PCs remotely. (b) omission: - Article 46031 mentions a software failure incident where wireless keyboards from various manufacturers were sending out each character typed over an unencrypted connection, making them vulnerable to interception by hackers. (c) timing: - No specific information related to a timing failure was provided in the articles. (d) value: - No specific information related to a value failure was provided in the articles. (e) byzantine: - No specific information related to a byzantine failure was provided in the articles. (f) other: - The software failure incidents described in the articles can be categorized as security vulnerabilities rather than traditional software failures. These vulnerabilities allowed unauthorized access and control over systems through wireless peripherals, leading to potential security breaches.

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, non-human, theoretical_consequence, other (a) death: People lost their lives due to the software failure - There is no mention of any deaths caused by the software failure incidents reported in the articles [45984, 40375, 40773, 46031]. (b) harm: People were physically harmed due to the software failure - There is no mention of physical harm to individuals due to the software failure incidents reported in the articles [45984, 40375, 40773, 46031]. (c) basic: People's access to food or shelter was impacted because of the software failure - There is no mention of people's access to food or shelter being impacted by the software failure incidents reported in the articles [45984, 40375, 40773, 46031]. (d) property: People's material goods, money, or data was impacted due to the software failure - The software failure incidents in the articles resulted in the vulnerability of wireless keyboards and mice, potentially leading to the compromise of sensitive information such as passwords and security questions [45984, 40375, 40773, 46031]. (e) delay: People had to postpone an activity due to the software failure - There is no mention of people having to postpone activities due to the software failure incidents reported in the articles [45984, 40375, 40773, 46031]. (f) non-human: Non-human entities were impacted due to the software failure - The software failure incidents primarily affected wireless keyboards and mice, highlighting vulnerabilities in these devices [45984, 40375, 40773, 46031]. (g) no_consequence: There were no real observed consequences of the software failure - The software failure incidents reported in the articles had real observed consequences related to the compromise of data and security due to vulnerabilities in wireless keyboards and mice [45984, 40375, 40773, 46031]. (h) theoretical_consequence: There were potential consequences discussed of the software failure that did not occur - The articles discuss potential consequences such as the ability for hackers to intercept keystrokes, read sensitive information, and potentially take control of computers due to the vulnerabilities in wireless keyboards and mice [45984, 40375, 40773, 46031]. (i) other: Was there consequence(s) of the software failure not described in the (a to h) options? What is the other consequence(s)? - The primary consequence of the software failure incidents reported in the articles was the compromise of data security and privacy due to vulnerabilities in wireless keyboards and mice, potentially leading to unauthorized access to sensitive information [45984, 40375, 40773, 46031].
Domain information, manufacturing, finance, government (a) The failed system was related to the information industry, specifically affecting wireless keyboards and mice used for computer input. The vulnerability in these devices allowed hackers to inject keystrokes onto machines from a distance, potentially compromising sensitive information like passwords and security questions [45984, 40375, 46031]. (b) The transportation industry was not directly impacted by the software failure incident reported in the articles. (c) The natural resources industry was not directly impacted by the software failure incident reported in the articles. (d) The sales industry was not directly impacted by the software failure incident reported in the articles. (e) The construction industry was not directly impacted by the software failure incident reported in the articles. (f) The manufacturing industry was indirectly impacted as the vulnerability affected wireless keyboards and mice used in various manufacturing environments [40375, 40773]. (g) The utilities industry was not directly impacted by the software failure incident reported in the articles. (h) The finance industry was indirectly impacted as the security of financial transactions could be compromised if affected keyboards were used in financial institutions [40375]. (i) The knowledge industry, encompassing education and research, was not directly impacted by the software failure incident reported in the articles. (j) The health industry was not directly impacted by the software failure incident reported in the articles. (k) The entertainment industry was not directly impacted by the software failure incident reported in the articles. (l) The government industry was indirectly impacted as government agencies could be vulnerable to attacks if using the affected wireless keyboards and mice [40375]. (m) The software failure incident was not directly related to any other specific industry mentioned in the articles.

Sources

Back to List