Analyzing Mouse and Keyboard Exploits

Bastille Research, a security firm specializing in “identifying airborne threats” and facilitating appropriate proactive responses to those threats, disclosed a number of USB mouse and keyboard vulnerabilities this year. These vulnerabilities affect wireless, non-Bluetooth mice and keyboards, and connect to those devices’ host computers via small pieces of hardware called USB dongles or radio transceivers. Transceivers/USB dongles are capable of compromising computers that are up to 100 meters away and allow cybercriminals to make keystrokes or transmit scripted commands completely undetected

One such vulnerability known as MouseJack injects keystrokes into targeted computers, which the computers then pass on into their operating systems as if the computers’ actual users had typed them themselves. Another vulnerability known as KeySniffer uses unencrypted radio communication to allow cybercriminals to eavesdrop and record all keystrokes made by computer users from up to several hundred feet away.

To better understand these exploits, Dunbar Security Solutions (DSS) Information Security Engineer Elliot Pfarr performed a proof of concept at the DSS headquarters.

The full proof of concept white paper is available here.