Hijack wireless mice, keyboards, with $15 of kit and 15 lines of code

This is a 'mindset' thing...

It's hard to see how the guy in that video missed all that activity on his machine. Important guy, important call.

But it never occurred to me that my 15 quid wireless mouse would be crypto safe. People should shift to assuming danger, rather than assuming safety.

Hardly new

This isn't a new threat.

What's clever here is the way they've used the mouse commands as a way in, & also that manufacturers have aimed for cheaper models' compatability so allowing defeat of the more expensive systems.

It's like not encrypting your backups because of the overhead!

Useful attack vector

A bit similar to the rubber ducky, but more incognito. All you need to do is launch a browser and straight to a watering hole of your choice. Que exploit and you're off and have a compromised machine :)

There is a reason for...

Not using Wireless KB's and Mice.

Other than the having to replace batteries just when you need to use the thing urgently.

Besides, I have yet to find a wireless KB that can stand up to the hammering I give them. I've had a couple of old DELL KB's (USB) that are build like the IBM's ones of old. Had them 7+ years and cost me £5 each at a computer fair. Still going strong.

Nothing new:

http://www.remote-exploit.org/articles/keykeriki_v2_0__8211_2_4ghz/index.html

that's about 6 years old...

I'm not familiar with the specific mouse dongle implementations mentioned, but let me tell you attacking a NRF24L without prior knowledge is no walk in the park. First off, you have to know the exact frequency used or you'll receive nothing. That may sound trivial to sniff with a spectrum analyzer but it's actually anything but - these days often some sort of frequency hopping is in play which will need WAY more than $15 worth of (and some pretty badass) equipment to identify appropriately. To illustrate, the utterly Byzantine hopping schemes used in some quadcopter remotes using that same RF chip were characterized NOT by listening to the spectrum, but by directly sniffing the frequency change commands on the SPI bus between the RF chip and the host MCU. And that's just the first step...

Second, you have to configure your NRF24L with the exact same address your "victim" uses or you'll receive nothing. Worst case that is a 5-byte long address brute-forcing of which is, erm, not really feasible. Best case it's still a 3-byte address to be guessed. That's still sixteen million addresses! The mentioned attack gets somewhat around this by setting an illegal (but apparently working) value that reduces the address length to 2 bytes, then further reducing that by setting the address equal to the RF preamble bit pattern, hoping to trick the chip into accepting the preamble as a valid address and delivering you the actual address as the "data" following it. Not a guaranteed result by any means, especially considering you now have no actual preamble to rely on to get your chip locked into transmissions.

So yeah - is it a vulnerability? Yup. Should it be encrypted? Absolutely. What the NRF24L does is NOT security on its own. But the attack itself requires either a lot more hardware than mentioned or a lot of specific know-how and patience - if the packet transmission rate is quite modest, you might be sitting there "sniffing" for quite a while...

also nothing new from here

I remember the trick of putting the (large at the time) logitech usb receiver on any electric line and getting the keypresses of anyone in the same building (circa 2001) using the same tech...

If it's wireless, it's not a mouse, it is a HAMSTER

or in some cases a guinea pig.......