Pierluigi Paganini
November 07, 2017
A wrong keyboard could represent an entry point for any organization. One of the most popular Keyboards in the gaming industry, 104-key Mantistek GK2 Mechanical Gaming Keyboard seems to include a built-in Keylogger.
A number of gamers discovered that the keyboard, that costs around €49.66, allegedly includes a component that silently records everything the user type on the keyboard and sends them to a server maintained by the Alibaba Group.
“GK2 owner here. everytime you open the “MANTISTEK Cloud Driver” it sends information to 47.90.52.88 which is tied to Alibaba.com LLC. when you open the page in browser it shows login page with moonrunes that translate to “Cloud mouse platform background management system”. reported an anonymous owner.
Data collected by the MantisTek keyboard software sends the collected data to the following destinations:
At the time, it is not clear if the cloud service is owned by Alibaba or is used by one of its customers who paid for the service.
Opening the IP address in in the web browser it is displayed a Chinese login page, which translates to “Cloud mouse platform background management system” that is maintained by Shenzhen Cytec Technology Co., Ltd.
According to Tom’s Hardware, MantisTek keyboards utilize ‘Cloud Driver’ software, the software doesn’t send key presses to the server as initially thought but only the number of times a key was pressed.
“An earlier version of the article stated that the keyboard’s software was sending key presses. However, in a closer look, it seems that the Cloud Driver software doesn’t send the key presses to the Alibaba server but only how many times each key has been pressed.” reported Tom’s Hardware.
Tom’s Hardware provided instructions to stop MantisTek keyboards from sending data to the server, it suggested to check the MantisTek Cloud Driver software is not running in the background, and block the CMS.exe executable in your firewall, users can do it by adding a new firewall rule for the MantisTek Cloud Driver in the “Windows Defender Firewall With Advanced Security.”
“The first way to stop the keyboard from sending your key presses to the Alibaba server is to ensure the MantisTek Cloud Driver software isn’t running in the background.” suggested Tom’s Hardware.
“The second method to stop the data collection is to block the CMS.exe executable in your firewall. You could do this by adding a new firewall rule for the MantisTek Cloud Driver in the “Windows Defender Firewall With Advanced Security.”
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – Mantistek GK2, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
