Glaswegian

Security vendor Symantec is so concerned about the potential misuse of a new wireless keyboard sniffer it has put out a warning about the technology.

‘Keykeriki' - a play on words derived from the Italian onomatopoeia for the sound made by a cockerel -is the work of the Remote-Exploit.org , a semi-commercial group that has been working on the open source project for nearly two years.

The group claims the hardware and software combination can intercept the keystrokes from all Microsoft wireless keyboards using 27Mhz wireless radio transmission frequency by analysing electromagnetic patterns, and said it was working on doing the same for rival Logitech keyboards very soon.

What this means is that pressing keystrokes entered on a wireless keyboard could be ‘sniffed' from a distance up to around 10 metres, in theory giving criminals access to data such passwords and user names. Although the project has been in the open for some time, Symantec has only recently become concerned enough to now recommend that users in security-conscious environments return to using wired keyboards.

The apparently simple answer to the hack is encryption, but that ignores the fact that Bluetooth and radio-based keyboards already use encryption, albeit in a weak form - the sniffer is intercepting tiny electro-magnetic fluctuations as the keys are pressed, not as they are transmitted.

The principle has been understood for some time, as research released by a team at the Ecole Polytechnique Fédérale de Lausanne in Switzerland demonstrated last October.

The answer is either to introduce enough signal noise around the keyboard, use a wired keyboard (although this might also not be secure) or build in virtual keyboards for use when entering secure data. There is no sign that Windows 7 will come with such a utility, but perhaps it should.


http://www.techworld.com/security/ne...&NewsID=117217