I aways wondered if the communication channel between my wireless keyboard and the usb receiver-antena is secure. I never bother to reseach this. Today I figured out the practical way. I turned on my pc at work and I tried to type the first letter of my password. Nothing hapened. Then I started spamming that letter. Still nothing, until the person next to me said “my keyboard is typing all by itself”. It turns out she has a wireless mouse with a seemigly identical receiver-antena usb.

The moral of the story. If it was so easy to almost leak my password unintentionally due to this flaw of wireless keyboard communication, imagine wad a bad actor can do intentionally. Why try to brute force, social engineer e.t.c. when your password can be stollen in transit from your keyboard to your pc.

  • Kissaki@feddit.deEnglish
    731·
    1 year ago

    Bluetooth data transmission is encrypted. Initialization typically happens only through the press of a physical button.

    I assume you’re using wireless devices of the same manufacturer, that uses an alternative that is not Bluetooth, and has automatic pairing without a safeguard.

    This is not about wireless primarily. Use a decent product and standard and you don’t have that issue.

    • ReversalHatchery@beehaw.org
      16·
      1 year ago

      Bluetooth isn’t guaranteed to be safe either. It can be safe, with the proper configuration (which depends on the manufacturer, you usually can’t change it), but it can also be very vulnerable

      • Kissaki@feddit.deEnglish
        1·
        1 year ago

        How so? You mean which encryption is being used? The Bluetooth demanded minimum is not enough?

        • ReversalHatchery@beehaw.org
          4·
          1 year ago

          Earlier this year i was reading the bluetooth specification (of course not all of it, certain parts only, it’s quite long) and I remember that there are pairing modes which can’t guarantee that the connection is secure, because the method does not make sure that the connection cannot be eavesdropped by an attacker to obtain the keys that’ll be used.
          Of course better devices will already be paired in the factory… but that’s not all of them, and how do you even verify that it has been paired in the factory, or it just randomly pairs with whatever it finds in pairing mode? Or how do you verify that they correctly verify the incoming packets?
          But for the user-pairable ones, the security of the connection depends a lot on what pairing mode will you use, there’s a huge difference if you just press a button and done, or when you can somehow input codes on both devices.

          And it’s not even just about whether you trust your devices to follow the bluetooth specifications correctly. Bluetooth had many different security mechanisms over the years, for the different bluetooth versions, many of which don’t protect against certain types of attacks and situations, or which are just plainly insecure.
          But they still exist and they are still used by some (or more) manufacturers who just don’t care.
          Also keep in mind that for compatibility many Bluetooth devices also support communication with older versioned devices.

          This stackoverflow post tries to summarize a part of the evolution of bluetooth security. Hopefully with it the above will make sense

          But then bluetooth vulnerabilities are also not unkown, both software and hardware based.

  • RovingFox@infosec.pub
    5·
    1 year ago

    All my passwords are random characters and I just copy/paste out of bitwarden. Can’t leak that with a wireless keyboard.

  • Phanatik@kbin.social
    5·
    1 year ago

    My Wireless keyboard is a Keychron. It doesn’t have a dedicated adapter, it’ll connect to any device with Bluetooth capabilities. From what I’ve seen of how it works, is that it can store up to 3 device signatures to automatically connect to (you can choose which of the three is active). What I assume it’s storing is the MAC address which I thought is unique to the device.

  • Destide@feddit.ukEnglish
    51·
    1 year ago

    Don’t use cheap ones with white label components. Sender and receiver having a shared key would resolve this.

  • 𝒍𝒆𝒎𝒂𝒏𝒏@lemmy.one
    3·
    1 year ago

    Used to work in an office where dell’s wireless peripherals would every once in a while randomly enter pairing mode and connect to someone else’s machine… often to the humor of those nearby. Their tech was based on Logitech’s older Unifying stuff but I have no idea what they were thinking when adding auto pairing to it.

    For wireless peripherals do research beforehand if this is something you’re worried about. Personally I stick with newer logitech stuff, which encrypt the connection and don’t start auto-pairing when peripherals are switched on

  • akulium@feddit.de
    3·
    1 year ago

    It is also problematic that you can send keypresses to the other person, especially since she was only using the receiver for a mouse.

  • Zellith@kbin.social
    31·
    1 year ago

    I don’t use wireless because batteries suck to deal with. I learned that in my teens with a wireless headset, wireless mouse and wireless keyboard!

    • mishimaenjoyer@kbin.social
      5·
      1 year ago

      modern (bt) devices usually have a built in battery that can be recharged via cable (or use the cable to connect the device to it’s computer), so that issue is off the table, at least for better devices.

    • vrojak@kbin.social
      51·
      1 year ago

      I don’t know how old you are, but I used to think the same thing in my teens, however nowadays wireless nice last pretty long on a single charge. Mine lasts about 3 months, and in endurance mode like half a year.

  • Doll_Tow_Jet-ski@kbin.social
    2·
    1 year ago

    Shit my current computer only works with wireless keyboard…Although I guess I could get a regular one and use one of the USB ports. Good to know, thanks.

        • Successful_Try543@feddit.de
          1·
          1 year ago

          According to Wikipedia, wireless USB should be secure too: “The goal of the specification was to preserve the functional model of USB, based on intelligent hosts and behaviorally simple devices, while allowing it to operate in a wireless environment and keeping security on a par with the levels offered by traditional wired systems.”