Microsoft's Wireless Keyboard: A Threat to Your Security

In this era of technology and innovation, several new gadgets are being developed to provide comfort and ease to the people around the world. But, there are some dark sides to a new technology and similar is the case with Microsoft wireless keyboards.

Consider a scenario, where a sneaky eavesdropper would like to find out his/her neighbors' conversation who has just installed a new Microsoft wireless keyboard. The eavesdropper is aware of his/her neighbors' email address and only needs to know the password. Luckily, the eavesdropper is aware of the radio frequencies and knows how to crack it. She/he sets up the antenna and interferes with the wireless frequency. A moment later, he/she decodes every data being sent from the wireless keyboard and finally get access to his/her neighbors' email account.

Microsoft's wireless keyboards work on a 27 MHz frequency band in order to communicate with the base station and Dreamlab technologies have found a way to sniff the data traffic being sent through it. In a demonstration, they showed how easy it was to crack the encryption used in Microsoft's wireless products. After a deep analysis, they found out that the encryption algorithm used in Microsoft wireless keyboard was very poor and keys like Alt and Shift were sent out as plain text without any encryption. The encryption on normal keys involved a simple XOR mechanism where the keys contained a random 1 byte value determined during the initial sync with the receiver. So, if you are able to detect the handshake protocol, you can easily decrypt the keystrokes as there are only 256 possible encryption keys available. Using a dictionary or a brute force attack, you can check all the possible combinations just after receiving 20-30 keystrokes.

With this technique in mind and knowledge of radio frequency, it is very easy for a developer to build a wireless keyboard logger for Microsoft's wireless keyboards that could pick up every keystroke sent from the device.

Keyboards or devices that use Bluetooth are not susceptible to such attacks. Microsoft's wireless keyboard series 1000, 2000, 3000 and 4000, suffer from this poor encryption technique and are vulnerable to attack.

Before purchasing a new Microsoft wireless keyboard, review about it on the Internet and make sure the model you are purchasing does not suffer from the poor encryption algorithm implemented in the earlier series of the product.

Source:
"27 Mhz Keyboards Insecurity" DreamLab