Researchers hack Microsoft wireless keyboards

By Tom Espiner, ZDNet UK
Thursday, December 06, 2007 11:03 AM

The protocol for securing some of Microsoft's wireless keyboards has been cracked, opening up the possibility of keystroke logging, according to Swiss security company Dreamlab Technologies. Researchers from the company have said they are also close to being able to use the hack to control affected computers remotely.

Microsoft's Wireless Optical Desktop 1000 and 2000 keyboards communicate by transmitting radio signals to the sound card in a user's computer. The data stream is encrypted using an exclusion-or (XOR) cipher, which is not strong enough to secure the communication, according to Dreamlab's senior security specialist, Max Moser.

"This is nothing like a crypto-algorithm," Moser told ZDNet.co.uk. "An exclusion-or binary is really a simple mathematical idea. You can crack the cipher by hand. You take two values, write both lines and look at the different digits. When either the top or the lower line is 1, you write 1. If both are 0, you write 0. For me, this is just obfuscation [rather than encryption]."

Dreamlab started their cracking efforts six months ago. They first identified the radio frequency used by the keyboards. They then used a piece of copper wire to intercept the signal, which is effective to a range of 10 meters, including through walls and floors. However, because the radio frequency is in the citizens' band--that is, it is used by CB radios--Moser said it would be possible to obtain radio equipment that could intercept the transmissions from up to 50 meters away. "Range is not a problem," said the security specialist.

But Moser said that, although he could log keystrokes, he had not yet been able to take control of a compromised computer remotely, because there were still some parts of the keyboards' protocol that were unknown to him. Because the protocol is proprietary to Microsoft, meaning the researchers do not have access to the source code, they decided to analyze the data on a binary level, rather than use reverse engineering.

"The real challenge was to understand the keyboard protocol," said Moser. "With 40 bytes per keystroke, it's difficult to understand which [byte] holds the data. From the binary stream, we built the data into meaningful sets and groups."

Moser then wrote a software tool which automatically sifted the data. Moser said he has not publicly released the tool because he does not want it to fall into the wrong hands. He added that he has informed Microsoft of his findings.

Each keyboard transmits its own identifier, so, if two or more keyboards are working in close proximity, the signals don't interfere with each other. While this means a user is unlikely to find themselves typing on a neighbor's computer, it also allows intercepted signals to be hacked because each unique identifier can be used as a key.

It takes between 30 and 50 intercepted keystrokes to break the protocol. As exclusion-or is used as a cipher mechanism, even if the user changes the key by reconnecting the keyboard, it is easy to crack the code, said Moser.

Moser said that, to mitigate this possible attack vector, companies could invest in wired or Bluetooth keyboards.

Microsoft's director of security response, Mark Miller, said the company was investigating Dreamlab's claims. He said Microsoft was unaware of any attacks exploiting the claimed vulnerability or any customer impact.

"We will take steps to determine how customers can protect themselves should we confirm the vulnerability," Miller added.