Are Wireless Keyboard Inherently Insecure?

Question

We all know about hardware keyloggers, but it seems to me that the concept of filtering keystrokes at the physical level gets even easier when people use wireless keyboards. To my knowledge, a wireless keyboard more or less just encodes ASCII characters, and then beams them to the little USB dongle via ~2.4GHz RF.

Isn't it technically possible to intercept these transmissions if you got close enough to someone [say, the next cubicle over?] with something like this and have essentiallty a wireless keylogger? Are these keyboard transmissions encrypted in any way? Is there any way to defend against this if they aren't?

Answer 1

Are wireless keyboards inherently insecure? No... And yes.

Most of the brand name vendors of wireless peripherals such as Logitech and Microsoft encrypt the wireless signals of their devices. This does add a layer of security. However, it is not foolproof. Just recently, the encryption of Microsoft's wireless keyboard had been hacked.

However, does this mean wired keyboards are any more secure? They aren't broadcasting their keystrokes over the air... or are they? What happens when you press a key? It makes a sound - vibrations in the air. There have been numerous articles about the ability to eavesdrop on a keyboard by the sound the keys make.

Both of these methods of cracking security do require the attacker to be fairly close to the computer he is trying to compromise. This is as close to being physically there as you can be without being right at the computer. It is always assumed that, if a hacker has physical access to a machine, they can get full control.

In my opinion, it is far easier to just use a keylogger, physical or software, than to try to intercept and decrypt wireless signals. I would trust a wireless keyboard in most situations, except for high security needs.

Answer 2

It is not just wireless keyboards that are insecure. Take a look at these people. They managed to intercept keystrokes from a standard wired (and wireless) keyboards from 60 feet away. With a normal keyboard and an interested attacker you are not gonna be safe.

They also have a whitepaper found here or here

Answer 3

I was once called to a security incident in which case a user thought their computer had been compromised.

Long story short, the user had two low-end 2.4Ghz Microsoft keyboards that he had paired to the same reciever and a co-worker had come by on lunch and borrowed his extra keyboard. I still don't know how to this day (and haven't thought a lot/researched much since but I suspected multi-pairing or RF channel overlap), but when the co-worker paired this keyboard to his dongle and he typed on the keyboard, it also typed characters on the other guy's screen.

Needless to say it was quite hilarious once we figured it all out. It's also (unfortunately) one of my better IT stories.

Essentially, yes physical attacks are possible and devastating. I mimic the above answerer's reference to the recent discovery of a flaw in Microsoft's implementation of encryption, but let's not forget that lots of security breaches utilize tools and features that are known and recognized by the tool manufacturer and are simply used maliciously as opposed to how a standard target demographic user may use them.