Logitech Keystroke Injection Flaw Went Unaddressed for Months

guest · Dec 14, 2018

Logitech Keystroke Injection Flaw Went Unaddressed for Months
The flaw allows a remote attacker to gain full access over a machine
December 14, 2018
https://threatpost.com/logitech-keystroke-injection-flaw/139928/

Computer peripheral giant Logitech has finally issued a patched version of its Logitech Options desktop app, after being taken to task for a months-old security flaw. The bug could of allowed adversaries to launch keystroke injection attacks against Logitech keyboard owners that used the app.

Google Project Zero security researcher Tavis Ormandy found the bug in September and publicly disclosed the vulnerability this week. The Logitech Options app lets users customize the functions of their Logitech computer peripherals, including mice, keyboards and touchpads.

“The only ‘authentication’ is that you have to provide a [process ID] of a process owned by your user, but you get unlimited guesses so you can bruteforce it in microseconds,” he explained in a Project Zero bug report that went live this week.
[...] From there, a malicious actor could use a rogue website to send a range of commands to the Options app and change a user’s settings. [...] could send arbitrary keystrokes [...] and even take over a targeted machine.
Click to expand...

Project Zero bug report
That program helpfully adds itself to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (and therefore is always running), spawns multiple subprocesses and appears to be an electron app. It also opens a websocket server on port 10134 that any website can connect to, and has no origin checking at all. [...]
Click to expand...

Log in or Sign up

Logitech Keystroke Injection Flaw Went Unaddressed for Months

guest Guest

Log in or Sign up

Logitech Keystroke Injection Flaw Went Unaddressed for Months

guest Guest

Useful Searches