The stealthy Arduino-based device, dubbed “KeySweeper“, works like a generic USB mobile charger, but he has the capability to sniffs, decrypts and send back keystrokes from a Microsoft wireless keyboar in the vicinity. KeySweeper can send captured data back to the operator over the Internet or using an optional GSM chip.

“KeySweeper is a stealthy Ardunio-based device camouflaged as a wall charger that wirelessly sniffs, decrypts, logs and reports-back all keystrokes from any Microsoft wireless keyboard in the vicinity,” explained Kamkar.

Kamkar has also detailed the steps to build the KeySweeper USB wall charger explaining that it is easy and cheap to assemble the spying device, the unit cost ranges from $10 to $80 depending on functions included. The instructions on how to build the device are available online on GitHub.

The KeySweeper also includes a web-based tool for live keystroke monitoring, it could be used by an attacker to send back SMS alerts triggered by specific typed keystrokes, like usernames or URLs. While the device is logging the keystrokes he is able to continue working, it will continue to sniff data also after it is unplugged because of its rechargeable built-in battery. KeySweeper is able to store the sniffed keystrokes both online and locally on the device.

“Even if we do not know the MAC address, we can decrypt the keystroke. Using a few-dollar Arduino and a US$1 Nordic RF chip we can decrypt these packets and see any keystroke of any keyboard in the vicinity that’s using the Microsoft wireless keyboard protocol and it doesn’t matter what OS is used.”

Kamkar explained to have discovered several vulnerabilities that could be exploited to decrypt data transmitted by Microsoft wireless keyboards, the researcher hasn’t tested the Aduino-based KeySweeper on every Microsoft wireless keyboard, but he is confident that almost every Microsoft device is vulnerable.

“We are aware of reports about a ‘KeySweeper’ device and are investigating,” is the comment of Microsoft spokesperson to VentureBeat.

The hardware necessary to build the devices is reported below:

• $3 – $30: An Arduino or Teensy microcontroller can be used.
• $1: nRF24L01+ 2.4GHz RF Chip which communicates using GFSK over 2.4GHz.
• $6: AC USB Charger for converting AC power to 5v DC.
• $2 (Optional): An optional SPI Serial Flash chip can be used to store keystrokes on.
• $45 (Optional): Adafruit has created a board called the FONA which allows you to use a 2G SIM card to send/receive SMS, phone calls, and use the Internet directly from the device.
• $3 (Optional if using FONA): The FONA requires a mini-SIM card (not a micro-SIM).
• $5 (Optional, only if using FONA): The FONA provides on-board LiPo/LiOn battery recharging, and while KeySweeper is connected to AC power, the battery will be kept charged, but is required nonetheless.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs –  KeySweeper, hacking)