"New Tales of Wireless Input Devices - Matthias Deeg, Gerhard Klostermeier
summary
Researchers present concrete failures in 2.4 GHz input devices: seven of nine wireless presenters allow keystroke injection and most accept simple replay attacks, a Fujitsu AES keyboard also accepts unencrypted HID packets, and some devices expose pairing keys on external SPI flash. Attacks use SDRs, Ubertooth, nRF/Crazyradio hardware and Universal Radio Hacker; live demos show remote PowerShell execution via injected keystrokes and abusing Bluetooth trust (turning a paired headphone into a keyboard). Practical exploits require minutes and modest radio gear.
AI-written summary · about
chapters (26)
- 0:00Intro
- 1:12Short Introduction to Used Technology
- 1:58Previous Work of Other Researchers
- 3:15Overview of Our Research
- 4:40Test Methodology
- 7:48Hardware Analysis
- 12:02Firmware Analysis
- 12:27Radio-based Analysis
- 12:57Challenges
- 17:00Packet Format
- 19:35Attack Surface and Attack Scenarios
- 20:31Found Security Vulnerabilities
- 21:18Insufficient Protection of Code and Data
- 23:06Recap: Mouse Spoofing Attacks
- 23:43Replay Attacks
- 27:18Recap: Keystroke Injection Attacks
- 30:49Bluetooth Trust Relationships
- 31:34Connected Bluetooth Headphones
- 31:51Android Smart Lock
- 32:10Physical Access
- 33:05Extracting Cryptographic Key Material
- 33:39Exploiting the Trust Relationship
- 34:51Tested Operating Systems
- 43:25Some Anecdotes: CVSS Base Scores
- 44:29Conclusion
- 47:28Recommendation
related talks
59mWireless security testing with attack
55mAttacking Industrial Remote Controllers
37mHi, My Name Is Keyboard
25mSweynTooth: Unleashing Mayhem over Bluetooth Low Energy
30mCommSec D1 - Keynterceptor: Press Any Key to Continue
27mWIFI-Important Remote Attack Surface: Threat is Expanding
51mA Measured Response to a Grain of Rice
37mBringing Software Defined Radio to the Penetration Testing Community