Fujitsu wireless keyboard model vulnerable to keystroke injection attacks

guest · Mar 15, 2019

Fujitsu wireless keyboard model vulnerable to keystroke injection attacks
There are slim chances that Fujitsu will release a patch
March 15, 2019
https://www.zdnet.com/article/fujit...el-vulnerable-to-keystroke-injection-attacks/

Fujitsu LX wireless keyboards are susceptible to keystroke injections, SySS GmbH, a German pen-testing firm revealed today.
The attacks allow a threat actor to beam wireless radio signals to the keyboard's receiver (USB dongle) and inject rogue keyboard presses on a user's computer.
BUG CAUSED BY DEVELOPER BLUNDER
In a report published today, SySS GmbH security researcher Matthias Deeg said the vulnerability is not caused by the keyboard and its USB receiver using weak cryptography. In fact, the two components work via a properly secured communications channel.

Instead, the flaw resides with the USB receiver alone, which besides accepting the keyboard's encrypted communications also accepts unencrypted data packets [...]
Furthermore [...] a threat actor can "remotely attack computer systems with an active screen lock," and plant malware on seemingly secure systems.
Click to expand...

"I do not recommend using this vulnerable keyboard in an environment with higher security demands," Deeg told us. "And I would advise not using it in exposed places where external attackers may come easily in the 2.4 GHz radio communication range of the wireless keyboard."
Click to expand...

guest · Oct 24, 2019

Fujitsu Wireless Keyboard Plagued By Unpatched Flaws
October 23, 2019
https://threatpost.com/fujitsu-wireless-keyboard-unpatched-flaws/149477/

Two high-severity flaws, discovered in a popular Fujitsu wireless keyboard set, could allow attackers from a short distance away to “eavesdrop” on passwords entered into the keyboards, or even fully takeover a victim’s system.
Making matters worse, the impacted Fujitsu wireless keyboard LX390 reached end-of-life in May 2019 – meaning that a patch is not available and affected users are instead urged to replace their keyboards entirely.

“Fujitsu has released two new wireless keyboard sets named LX410 and LX960 that are not affected by the described security issue,” said Matthias Deeg, researcher with Germany-based SySS, in an advisory sent to Threatpost on Wednesday. “SySS recommends replacing LX390 wireless keyboard sets used in environments with higher security demands, for instance with one of the newer successor models LX410 or LX960.”
However, because the data isn’t encrypted, it can still be accessed and analyzed by an attacker who is up to 150 feet away (the typical reach of devices using 2.4 GHz radio frequency).

In another PoC attack, researchers were able to launch keystroke injections (CVE-2019-18200), [...]
Both flaws were reported to the manufacturer in April 2019. Fujitsu did not immediately respond to a request for comment from Threatpost.
Click to expand...

Log in or Sign up

Fujitsu wireless keyboard model vulnerable to keystroke injection attacks

guest Guest

guest Guest

Log in or Sign up

Fujitsu wireless keyboard model vulnerable to keystroke injection attacks

guest Guest

guest Guest

Useful Searches