haha @ apple

[Theblacksheep]

Just to reverse the trend of last weeks little fun at Microsofts expence, heres an exploit to insert keyloggers into apple keyboards. You've gotta get Apple hardware!!

 

SemiAccurate :: News for the Everygeek

 

http://www.blackhat.com/presentations/bh-usa-09/CHEN/BHUSA09-Chen-RevAppleFirm-PAPER.pdf

[SYNACK]

This is so Apple, they bundle everything with their computers, viruses with iPods, keyloggers with keyboards. What next :D

[kmount]

This is scary stuff, very scary.

[Theblacksheep]

This is scary stuff, very scary.

 

Fear is multiplied by the amount of Macs you have and multiplied again by the integration with your network services.

[Batman]

While the method is impressive, is it ever going to be easier for the hacker than using a traditional keylogger program?

 

I'm slightly sceptical!

[Theblacksheep]

While the method is impressive, is it ever going to be easier for the hacker than using a traditional keylogger program?

 

Traditional keylogger requires physical access. Depends if that is easier or not.

[mac_shinobi]

All USB keyboards are vulnerable. The blame here rests on the USB Device Firmware Update Specification [usb.org], which specifies how firmware updates are supposed to work. Hint: there's no security. The only reason this makes news at all is because it has the word "Apple" in the title.

Spec compliant, secure: choose one. USB was designed for single user computers without security in mind. The only way to solve this (partially) with existing hardware would be to block access to hardware devices from applications running as non-root users, which is fundamentally contrary to the desire to get device drivers out of the kernel for stability. Short of that, this can only be solved by putting a more powerful CPU in the keyboard controller so that it can do a signature check on its own firmware.

[kmount]

All USB keyboards are vulnerable. The blame here rests on the USB Device Firmware Update Specification [usb.org], which specifies how firmware updates are supposed to work. Hint: there's no security. The only reason this makes news at all is because it has the word "Apple" in the title.

Spec compliant, secure: choose one. USB was designed for single user computers without security in mind. The only way to solve this (partially) with existing hardware would be to block access to hardware devices from applications running as non-root users, which is fundamentally contrary to the desire to get device drivers out of the kernel for stability. Short of that, this can only be solved by putting a more powerful CPU in the keyboard controller so that it can do a signature check on its own firmware.

 

A link to this post in its original context - Slashdot Comments | Apple Keyboard Firmware Hack Demonstrated

 

Should prove interesting in the next few days how this unfolds beyond Apple if such devices are as susceptible.

[ZeroHour]

All USB keyboards are vulnerable. The blame here rests on the USB Device Firmware Update Specification [usb.org], which specifies how firmware updates are supposed to work. Hint: there's no security. The only reason this makes news at all is because it has the word "Apple" in the title.

Spec compliant, secure: choose one. USB was designed for single user computers without security in mind. The only way to solve this (partially) with existing hardware would be to block access to hardware devices from applications running as non-root users, which is fundamentally contrary to the desire to get device drivers out of the kernel for stability. Short of that, this can only be solved by putting a more powerful CPU in the keyboard controller so that it can do a signature check on its own firmware.

 

The guy benieth that says most dont have upgradable firmware. The fact nearly all apple os users will have on of these makes it easier to target then random luck of finding a windows keyboard that lets it be exploited.

[Batman]

Traditional keylogger requires physical access. Depends if that is easier or not.

 

Nonsense... there must be trojans which can do that, surely?!

[Tallwood_6]

Cant quite see how the firmware can be remotely compromised without some kind of user interaction, especially if the HIDFirmwareUpdaterTool has to run and know info is given on how a remote attacker might get access to the logged info remotely.

[mac_shinobi]

Video on YouTube funnily enough they were using windows and notepad

 

[ame=http://www.youtube.com/watch?v=_81lHJQpc_Y]YouTube - Apple keyboard with evil firmware can root any computer[/ame]

 

What would you do if it was a logitech keyboard? Run for the hills?

 

Also it's only 5 characters so not sure if that could be increased ?

Edited August 2, 2009 by mac_shinobi

[SYNACK]

Cant quite see how the firmware can be remotely compromised without some kind of user interaction, especially if the HIDFirmwareUpdaterTool has to run and know info is given on how a remote attacker might get access to the logged info remotely.

 

The only reason they needed to demonstrait it this was is because of leagal concerns. If they had compromised it any other way they would have been breaking DMCA laws and apple would have had them eaten by their pet lawyers. This is the same company who sues people for finding bugs in their software and sues clients who get too talkative about product faults.

Apple tries to silence owner of exploding iPod with gagging order

Apple attempted to silence a father and daughter with a gagging order after the child’s iPod music player exploded and the family sought a refund from the company.

The Times has learnt that the company would offer the family a full refund only if they were willing to sign a settlement form. The proposed agreement left them open to legal action if they ever disclosed the terms of the settlement.

The case echoes previous circumstances in which Apple attempted to hush up incidents when its devices overheated.

 

This exploit can be performed in a much easier way by just transparently uploading a new firmware into the keyboard. This would have required them to crack the encryption directly, not difficult but illegal under US law so they chose this method to display it. Actual criminals are not concerned with this though and can do it in more devious ways.

 

Given the onboard memory capacity of the keyboard 1KB there is the possibility to store up to 1000 characters in the keyboards memory without having to offload any of it to the system.

 

Other systems like laptops of almost all brands offer built reprogrammable keyboards, just update the BIOS on an old hp to see this in action. The difference is that this reprogramming is done directly by the BIOS and brings up a message alerting the user. As it is not a USB system this exploit should not be possible. There are also so many differing versions that targeting it would be non-trivial.

 

Apple's closed environment allows for targeted attacks to be more sucessful as you are talking about tens of devices not thousands.

 

If this flaw was shown to affect logitec devices there would still be concern and publicity but it is easier to swap out an external logitec KB while the issue is fixed than an integrated laptop keyboard. As yet this flaw has not been seen to be exploited in the wild but there is still the possibility, especially with the code avalible. On a positive note Apple usually does patch these things once they have been rubbed in their faces.

Edited August 3, 2009 by SYNACK

[Theblacksheep]

Apple's closed environment allows for targeted attacks to be more sucessful as you are talking about tens of devices not thousands.

 

If this flaw was shown to affect logitec devices there would still be concern and publicity but it is easier to swap out an external logitec KB while the issue is fixed than an integrated laptop keyboard. As yet this flaw has not been seen to be exploited in the wild but there is still the possibility, especially with the code avalible. On a positive note Apple usually does patch these things once they have been rubbed in their faces.

 

Rubbed in their faces to Apple means the front page of the BBC news site, not some kid at hacker conference! I mean, look at the denial, it must be deafening at Apple!

 

 

 

Still, instead of paying £50 for a new vulnrable imac keyboard from Apple, I bet you can get some cheap ones on ebay at the moment!

[mac_shinobi]

Still, instead of paying £50 for a new vulnrable imac keyboard from Apple, I bet you can get some cheap ones on ebay at the moment!

 

You mean to say Logitech and other brands of keyboards are cheap and crud ?

 

Am sure logitech top of the line equipment can't be less then £50

 

I had the MX5000 desktop set ( keyboard and mouse ) for my P4 desktop machine and that was £80 something and is still great but just not compatable with my mac because of the encryption and logitech didnt make drivers / software for it

[Theblacksheep]

You mean to say Logitech and other brands of keyboards are cheap and crud ?

 

No i'm just a £5 keyboard man... it does the job.

[mac_shinobi]

No i'm just a £5 keyboard man... it does the job.

 

Tried that with the usb mouse and after about 4 months it broke