The wireless link between your mouse and dongle might not be as useful as you think. A new hack shows that the links are often unencrypted and can be used to gain control of your computer.
Security researchers from Bastille Networks have found that non-Bluetooth wireless keyboards manufactured by Logitech, Dell and Lenovo don’t encrypt communication between the input device and the dongle plugged into a computer’s USB slot. That’s allowed them to create an attack — that they’re calling Mousejack — which injects commands into the dongle.
The team claims the attack can be carried out from up to 90m away from the victim’s computer given the right hardware. Once compromised, the hacked dongle allows the team to transmit malicious packets that generate keystrokes.
While that might not sound too useful, remember that one of those packets can hold an awful lot of keystrokes — the equivalent of 1000 words-per-minute of typing, according to the researchers. That’s enough to install a rootkit capable opening access to your whole computer in under 10 seconds, apparently — which means you might never know your wireless mouse dongle had been hacked. And once that’s done, it’s game over.
The team has been working with hardware manufacturers and Logitech is already updating some of its firmware. But it’s not all good news. Speaking to Threatpost, Chris Rouland from Bastille Networks explained that “[m]ore than half of the mice are not able to be updated and will not be patched. And likely won’t be replaced. There will be vulnerable devices everywhere.”
Image by S.Dashkevych/Shutterstock