The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers). An example of a network attack is an attacker causing a denial of service by sending a specially crafted TCP packet across a wide area network (e.g., CVE-2004-0230).
Attack Complexity
Low
AC
The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Privileges Required
Low
PR
The attacker requires privileges that provide basic capabilities that are typically limited to settings and resources owned by a single low-privileged user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.
Scope
Unchanged
S
An exploited vulnerability can only affect resources managed by the same security authority. In the case of a vulnerability in a virtualized environment, an exploited vulnerability in one guest instance would not affect neighboring guest instances.
Confidentiality
High
C
There is total information disclosure, resulting in all data on the system being revealed to the attacker, or there is a possibility of the attacker gaining control over confidential data.
Integrity
High
I
There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the attacker being able to modify any file on the target system.
Availability
High
A
There is a total shutdown of the affected resource. The attacker can deny access to the system or data, potentially causing significant loss to the organization.
Perixx Computer PERIDUO-710W Keystroke InjectionAdvisory ID: SYSS-2016-047
Product: PERIDUO-710W
Manufacturer: Perixx Computer GmbH
Affected Version(s): Part No. KG-1027
Tested Version(s): Part No. KG-1027
Vulnerability Type: Cryptographic Issues (CWE-310)
Keystroke Injection Vulnerability
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2016-05-27
Solution Date: -
Public Disclosure: 2016-07-29
CVE Reference: Not yet assigned
Authors of Advisory: Matthias Deeg and Gerhard Klostermeier (SySS GmbH)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Overview:
PERIDUO-710W is a wireless desktop set consisting of a mouse and a
keyboard.
The manufacturer describes the product as follows (see [1]):
"PERIDUO can create flexible, convenient and wireless working
environment with its design. PERIDUO offers a reliable 2.4GHz high
frequency penetration, low interference, and omni-directional signal
transmissions with 10Meters meters [sic] receiving distance."
Due to an insecure implementation of the encrypted data communication,
the wireless keyboard PERIDUO-710W is prone to keystroke injection
attacks.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerability Details:
The SySS GmbH found out that the wireless keyboard PERIDUO-710W is prone
to keystroke injection attacks.
An attacker can sniff the AES-encrypted data packets of the 2.4 GHz
radio communication sent by the keyboard to the transceiver (USB dongle)
and identify key release data packets by means of time correlation.
For example, the last sent data packet before a longer time period
without any data communication usually is a key release packet.
The plaintext of such key release data packets and the AES encryption
using counter mode is known to an attacker by a previously performed
analysis of an attacker-owned device (see [3], SySS security advisory
SYSS-2016-045).
Due to the insecure implementation of the AES-encrypted data
communication, an attacker can modify a previously sniffed encrypted
key release data packet and transmit it to the PERIDUO-710W USB dongle in
order to inject arbitrary keystrokes.
Thus, despite AES-encrypted data communication, an attacker is able to
send arbitrary keystrokes to a victim's computer system. In this way, an
attacker can remotely take control over the victim's computer that is
operated with an affected PERIDUO-710W wireless keyboard.
In combination with the replay attack described in the SySS security
advisory SYSS-2016-046 (see [4]), a keystroke injection attack allows to
remotely attack computer systems with an active screen lock, for example
in order to install malware when the target system is unattended.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Proof of Concept (PoC):
The SySS GmbH could successfully perform keystroke injection attacks
against the wireless keyboard PERIDUO-710W using an in-house developed
software tool in combination with the USB radio dongle Crazyradio PA
(see [5]).
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Solution:
The SySS GmbH is not aware of a solution for this reported security
vulnerability.
For further information please contact the manufacturer.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Disclosure Timeline:
2016-05-27: Vulnerability reported to manufacturer
2016-06-06: Vulnerability reported to manufacturer again
2016-07-29: Public release of the security advisory
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
References:
[1] User manual for Perixx PERIDUO-710W
http://perixx.com/en/service/Perixx_Manual/DUO/PERIDUO-710_manual.pdf
[2] Product website for Perixx PERIDUO-710W
http://perixx.com/en/products/perixx-pro-11.html
[3] SySS Security Advisory SYSS-2016-045
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2016-045.txt
[4] SySS Security Advisory SYSS-2016-046
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2016-046.txt
[5] Product website for Crazyradio PA
https://www.bitcraze.io/crazyradio-pa/
[6] SySS Security Advisory SYSS-2016-047
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2016-047.txt
[7] SySS Responsible Disclosure Policy
https://www.syss.de/en/responsible-disclosure-policy/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Credits:
This security vulnerability was found by Matthias Deeg and Gerhard
Klostermeier of the SySS GmbH.
E-Mail: matthias.deeg (at) syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Matthias_Deeg.asc
Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB
E-Mail: gerhard.klostermeier (at) syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Gerhard_Klostermeier.asc
Key fingerprint = 8A9E 75CC D510 4FF6 8DB5 CC30 3802 3AAB 573E B2E7
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Disclaimer:
The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS Web
site.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Copyright:
Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en
This information is provided for TESTING and LEGAL RESEARCH purposes only. All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum