6 ms·

Probably not the most practical attack, but it is very possible to MITM the connection between the keyboard itself and the motherboard.

by wooosh 2y ago

izacus 2y ago
And then return me my laptop and steal it again?
- rwmj 2y ago
  Bluetooth keyloggers are a thing. The attacker would need to be nearby.
  - xattt 2y ago
    Not if there’s some sort of cell bridging device nearby as well.
    - HeatrayEnjoyer 2y ago
      Relays can be prevented with a round-trip timeout. Limit to 8ft/c, should be plenty for a keyboard. You can't outpace light.
  - izacus 2y ago
    I'd have to use bluetooth keyboard then, right?
- xzjis 2y ago
  You have to consider what kind of risk you are protecting yourself against. It's highly unlikely that you would be the target of such a highly sophisticated attack, but a hacker could get into a place where you left your computer without surveillance (such as your home or a hotel) for about 15 minutes, and install it inside your computer. If you think you could be the target of such an attack, you could maybe enable an alert in the settings of your UEFI if your computer has been opened (I know that my ThinkPad has that option), or the better option is to always keep your laptop with you.
  - izacus 2y ago
    I'm mostly asking because the original poster was painting a process that can be sniffed off the bus (that is - buy a stolen laptop off ebay, try to boot it, sniff the key off the bus) with a process that requires active targeting and multiple breakins to work as equivalent. It seems like these security discussions always devolve into rather funny moving of goalposts without actually considering how much work each exploit requires.
    - michaelt 2y ago
      The goalposts haven't moved in my mind, but I suppose I didn't make them clear in my first post. Basically the TPM provides a set of features that are really useful for corporate Windows deployments. No more forgotten passwords, because the self-unlocking disk encryption sends the user straight to the Windows login screen, and helpdesk can reset forgotten Windows passwords remotely. And for casual home Windows users, it lets them log in with a 4-digit PIN or with biometrics, so it's got usability benefits for them too. If every OS now needs Microsoft's signature of approval, or a really fiddly setup process? Well they were running Windows anyway, so no problem. These usability/support benefits rely on self-unlocking disk encryption, which is vulnerable to sniffing if someone gets a stolen laptop on ebay. For the kind of technically sophisticated, security enthusiast users who comment on blog posts about TPMs? We're more than happy to key in a strong unique password at every boot, and if we forget the password and lose access to everything on that disk that's just the system working as it's supposed to. For us, the benefits of TPMs and measured boot for personal use are a lot more obscure. You'll sometimes hear people claim it protects against 'evil maid attacks' where an attacker repeatedly gets physical access to your laptop. The truth is it provides no such protection.
      - Foxboron 2y ago
        > For us, the benefits of TPMs and measured boot for personal use are a lot more obscure. You'll sometimes hear people claim it protects against 'evil maid attacks' where an attacker repeatedly gets physical access to your laptop. The truth is it provides no such protection. TPMs give you fine and adequate protections in many scenarios, even physical ones. They also provide you with better protection for private key material. I'll even give you an example: https://github.com/Foxboron.keys https://github.com/Foxboron.keys The last key is a TPM key from my `ssh-tpm-agent` project: https://github.com/Foxboron/ssh-tpm-agent https://github.com/Foxboron/ssh-tpm-agent Here is the private key: https://paste.xinu.at/9fc2YJQuUCbg1Sa/ https://paste.xinu.at/9fc2YJQuUCbg1Sa/ I don't remember if the key has a PIN (it was for a presentation/demonstration), but if it has it's like 4 digits long.
- michaelt 2y ago
  A high grade hardware implant doesn't just capture your password, it'll also replay your password along with a curl | sudo bash at 4am
Foxboron 2y ago
Glitter nailpolish on your machine seams/screws and tamper detection. Keyboard sniffing is not as trivial as people make it out to be.

Probably not the most practical attack, but it is very possible to MITM the connection between the keyboard itself and the motherboard.

by wooosh 2y ago

Probably not the most practical attack, but it is very possible to MITM the connection between the keyboard itself and the motherboard.

izacus 2y ago

And then return me my laptop and steal it again?

rwmj 2y ago
Bluetooth keyloggers are a thing. The attacker would need to be nearby.
- xattt 2y ago
  Not if there’s some sort of cell bridging device nearby as well.
  - HeatrayEnjoyer 2y ago
    Relays can be prevented with a round-trip timeout. Limit to 8ft/c, should be plenty for a keyboard. You can't outpace light.
- izacus 2y ago
  I'd have to use bluetooth keyboard then, right?
xzjis 2y ago
You have to consider what kind of risk you are protecting yourself against. It's highly unlikely that you would be the target of such a highly sophisticated attack, but a hacker could get into a place where you left your computer without surveillance (such as your home or a hotel) for about 15 minutes, and install it inside your computer. If you think you could be the target of such an attack, you could maybe enable an alert in the settings of your UEFI if your computer has been opened (I know that my ThinkPad has that option), or the better option is to always keep your laptop with you.
- izacus 2y ago
  I'm mostly asking because the original poster was painting a process that can be sniffed off the bus (that is - buy a stolen laptop off ebay, try to boot it, sniff the key off the bus) with a process that requires active targeting and multiple breakins to work as equivalent. It seems like these security discussions always devolve into rather funny moving of goalposts without actually considering how much work each exploit requires.
  - michaelt 2y ago
    The goalposts haven't moved in my mind, but I suppose I didn't make them clear in my first post. Basically the TPM provides a set of features that are really useful for corporate Windows deployments. No more forgotten passwords, because the self-unlocking disk encryption sends the user straight to the Windows login screen, and helpdesk can reset forgotten Windows passwords remotely. And for casual home Windows users, it lets them log in with a 4-digit PIN or with biometrics, so it's got usability benefits for them too. If every OS now needs Microsoft's signature of approval, or a really fiddly setup process? Well they were running Windows anyway, so no problem. These usability/support benefits rely on self-unlocking disk encryption, which is vulnerable to sniffing if someone gets a stolen laptop on ebay. For the kind of technically sophisticated, security enthusiast users who comment on blog posts about TPMs? We're more than happy to key in a strong unique password at every boot, and if we forget the password and lose access to everything on that disk that's just the system working as it's supposed to. For us, the benefits of TPMs and measured boot for personal use are a lot more obscure. You'll sometimes hear people claim it protects against 'evil maid attacks' where an attacker repeatedly gets physical access to your laptop. The truth is it provides no such protection.
    - Foxboron 2y ago
      > For us, the benefits of TPMs and measured boot for personal use are a lot more obscure. You'll sometimes hear people claim it protects against 'evil maid attacks' where an attacker repeatedly gets physical access to your laptop. The truth is it provides no such protection. TPMs give you fine and adequate protections in many scenarios, even physical ones. They also provide you with better protection for private key material. I'll even give you an example: https://github.com/Foxboron.keys https://github.com/Foxboron.keys The last key is a TPM key from my `ssh-tpm-agent` project: https://github.com/Foxboron/ssh-tpm-agent https://github.com/Foxboron/ssh-tpm-agent Here is the private key: https://paste.xinu.at/9fc2YJQuUCbg1Sa/ https://paste.xinu.at/9fc2YJQuUCbg1Sa/ I don't remember if the key has a PIN (it was for a presentation/demonstration), but if it has it's like 4 digits long.
michaelt 2y ago
A high grade hardware implant doesn't just capture your password, it'll also replay your password along with a curl | sudo bash at 4am

Foxboron 2y ago

Glitter nailpolish on your machine seams/screws and tamper detection. Keyboard sniffing is not as trivial as people make it out to be.