It was a presentation at Blackhat USA 2007 given by Luis Miras.

https://www.blackhat.com/presentations/bh-usa-07/Miras/Presentation/bh-u
sa-07-miras.pdf
https://www.blackhat.com/presentations/bh-usa-07/Miras/Whitepaper/bh-usa
-07-miras-WP.pdf

Larry

-----Original Message-----
From: listbounce (at) securityfocus (dot) com [email concealed] [mailto:listbounce (at) securityfocus (dot) com [email concealed]] On Behalf Of natronicus
Sent: Monday, March 31, 2008 9:00 AM
To: Sat Jagat Singh
Cc: pen-test (at) securityfocus (dot) com [email concealed]
Subject: Re: Wireless keyboard security?

Additionally, there was a presentation at Defcon last year where the presenter demonstrated how to reverse engineer an example rf controlled wireless keyboard with $100 of equipment off of ebay.

I just visited the defcon media archives but couldn't find his presentation.. maybe it was Blackhat 07 and not Defcon? It was a small group of us in there; couldn't have been more than 20 people attending the talk.

Anyway, since I can't find his presentation, his process was:

- Monitor the rf frequencies and dump them into software to analyze
- Figure out what is a 1 and what's a 0
- Guess the packet structure (header + payload + footer)
- Monitor payloads generated by using the device and generate a translation map

He found that all of the rf wireless devices he tested used proprietary protocols with no encryption. It was simple to deduce the protocol and command lists, making it possible to inject any command into the receiver and monitor all traffic.

Bluetooth has its issues, but at least it's a known protocol that's very difficult to sniff. Home grown protocols always make me twitchy.

natron

On Wed, Mar 26, 2008 at 10:51 AM, Sat Jagat Singh <flyingdervish (at) yahoo (dot) com [email concealed]> wrote:
> There's actually been quite a lot about these lately:
>
> http://www.remote-exploit.org/advisories/27Mhz_Analyzing.pdf
>
> http://www.dreamlab.net/download/articles/27_Mhz_keyboard_insecurities
> .pdf
>
> Bluetooth hacking has also been demonstrated at previous Blackhat
> conferences.
>
>
>
> --- Eygene Ryabinkin <rea-sec (at) codelabs (dot) ru [email concealed]> wrote:
>
> > Good day.
> >
> > Can anyone point me to the papers/articles/research > of the
> (in)security > of wireless keyboards? Since many people want to >
> use them now, > there are some questions about their security -- >
> button clicks are > transferred on the air and can be remotely >
> interceptable.
> >
> > Thanks!
> > --
> > Eygene
> >
> >
>
> ----------------------------------------------------------------------
> --
> > This list is sponsored by: Cenzic
> >
> > Need to secure your web apps NOW?
> > Cenzic finds more, "real" vulnerabilities fast.
> > Click to try it, buy it or download a solution FREE > today!
> >
> > http://www.cenzic.com/downloads
> >
>
> ----------------------------------------------------------------------
> --
> >
> >
>
>
>
>
>
> ______________________________________________________________________
> ______________ Looking for last minute shopping deals?
> Find them fast with Yahoo! Search.
> http://tools.search.yahoo.com/newsearch/category.php?category=shopping
>
>
>
>
> ----------------------------------------------------------------------
> --
> This list is sponsored by: Cenzic
>
> Need to secure your web apps NOW?
> Cenzic finds more, "real" vulnerabilities fast.
> Click to try it, buy it or download a solution FREE today!
>
> http://www.cenzic.com/downloads
>
> ----------------------------------------------------------------------
> --
>
>

------------------------------------------------------------------------

This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------

------------------------------------------------------------------------

This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------

[ reply ]