On 2013-11-07 09:54, Nathan England wrote:

what if someone were to intercept the keyboard I purchase and

place a keylogger in the firmware?  Is it possible to detect a

keylogger built in the firmware of a keyboard? Do all keyboards
have firmware?

This seems like a *really* high level of paranoia, but anyway:  All keyboards have at the very least a microcontroller that does debouncing, translates keypresses into scancodes, and sends those scancodes down the wires.  USB keyboards have that stuff and chips that translate keypresses into packets that conform to the HID specs.

Theoretically, a USB keyboard could be not just a HID device, but another USB device (mass storage?) containing an executable.  Some devices have done similar things; there were some USB disks that presented themselves as both a CD-ROM device containing Windows device drivers and a mass storage device.  There's a standard for this behavior though, something like "Multi-LUN storage device", and I don't know if there's a similar thing for HID.

Could the USB cable itself be a keylogger?
How would you go about detecting that?

The cable could have a small logging device in it.  However, a logging device would make the cable a *lot* more expensive than a regular cable. Retrieving data from a logging device like that would probably require someone to physically touch the cable or at least get very near it.

As for detecting something like this, it's really difficult to prove a negative.  I suppose you could take high-res X-ray photos of a known good USB cable and a suspect one and compare them.  This would not be cheap.  Or you could make it so there's only 1 USB device plugged in (the suspect keyboard), run a USB snooper, and look for suspicious USB packets.  This would take a lot of time.

(Also, I've tried to do USB snooping on some things, and none of the Windows USB snoopers I used seemed to work that well.)

--
Crow202 Blog: http://crow202.org/wordpress
There is no Darkness in Eternity
But only Light too dim for us to see.

---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss@lists.phxlinux.org
To subscribe, unsubscribe, or to change your mail settings:
http://lists.phxlinux.org/mailman/listinfo/plug-discuss