On 2013-11-07 09:54, Nathan England wrote:
> what if someone were to intercept the keyboard I purchase and
> place a keylogger in the firmware? Is it possible to detect a
> keylogger built in the firmware of a keyboard? Do all keyboards
> have firmware?
This seems like a *really* high level of paranoia, but anyway: All
keyboards have at the very least a microcontroller that does debouncing,
translates keypresses into scancodes, and sends those scancodes down the
wires. USB keyboards have that stuff and chips that translate
keypresses into packets that conform to the HID specs.
Theoretically, a USB keyboard could be not just a HID device, but
another USB device (mass storage?) containing an executable. Some
devices have done similar things; there were some USB disks that
presented themselves as both a CD-ROM device containing Windows device
drivers and a mass storage device. There's a standard for this behavior
though, something like "Multi-LUN storage device", and I don't know if
there's a similar thing for HID.
> Could the USB cable itself be a keylogger?
> How would you go about detecting that?
The cable could have a small logging device in it. However, a logging
device would make the cable a *lot* more expensive than a regular cable.
Retrieving data from a logging device like that would probably require
someone to physically touch the cable or at least get very near it.
As for detecting something like this, it's really difficult to prove a
negative. I suppose you could take high-res X-ray photos of a known
good USB cable and a suspect one and compare them. This would not be
cheap. Or you could make it so there's only 1 USB device plugged in
(the suspect keyboard), run a USB snooper, and look for suspicious USB
packets. This would take a lot of time.
(Also, I've tried to do USB snooping on some things, and none of the
Windows USB snoopers I used seemed to work that well.)
--
Crow202 Blog:
http://crow202.org/wordpress
There is no Darkness in Eternity
But only Light too dim for us to see.
---------------------------------------------------
PLUG-discuss mailing list -
PLUG-discuss@lists.phxlinux.org
To subscribe, unsubscribe, or to change your mail settings:
http://lists.phxlinux.org/mailman/listinfo/plug-discuss
(text/plain)