-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2016-033 Product: Microsoft Wireless Desktop 2000 Manufacturer: Microsoft Affected Version(s): Ver. A Tested Version(s): Ver. A Vulnerability Type: Insufficient Protection of Code (Firmware) and Data (Cryptographic Key) Risk Level: Medium Solution Status: Open Manufacturer Notification: 2016-04-22 Solution Date: - Public Disclosure: 2016-10-05 CVE Reference: Not yet assigned Authors of Advisory: Gerhard Klostermeier and Matthias Deeg (SySS GmbH) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: Microsoft Wireless Desktop 2000 is a wireless desktop set consisting of a mouse and a keyboard. The manufacturer describes the product as follows (see [1]): "This keyboard features Advanced Encryption Standard (AES) technology, which is designed to help protect your information by encrypting your keystrokes. Each keyboard is permanently paired with its receiver at the factory - no key information is ever shared over the air." Due to the insufficient protection of the flash memory of the keyboard and of the USB dongle, an attacker with physical access has read and write access to the firmware and the used cryptographic key. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: The SySS GmbH found out that the embedded flash memory of the wireless keyboard Microsoft Wireless Desktop 2000 and of the corresponding USB dongle can be read and written via the SPI interface of the used transceivers with an embedded microcontroller nRF24LE1H (keyboard) and nRF24LU1+ (USB dongle) as the flash memory is not protected by the offered read back protection feature (RDISMB - Read DISable Main Block). Thus, an attacker with physical access to the keyboard or the USB dongle can simply read and write the SPI-addressable code and data flash memory. Due to the use of nRF24 transceiver versions with one-time programmable memory, write access is limited in such a way that a set 1 bit can be changed to a 0 bit but not vice versa. The AES cryptographic key used by the Microsoft Wireless Desktop 2000 keyboard and the corresponding USB dongle is for both devices accessible via the SPI interface. By having read and write access to the code and data flash memory, an attacker can either extract the cryptographic key, for instance to perform further attacks against the wireless communication, or modify the firmware or the cryptographic key in a limited way due to the used one-time programmable memory. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): The SySS GmbH could successfully read the contents of the code and data flash memory of the Microsoft Wireless Desktop 2000 keyboard and of the USB dongle using the hardware tool Bus Pirate [3] in combination with the software tool nrfprog [4]. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: The SySS GmbH is not aware of a solution for this reported security vulnerability. For further information please contact the manufacturer. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2016-04-22: Vulnerability reported to manufacturer 2016-04-23: Manufacturer acknowledges e-mail with SySS security advisory 2016-06-06: E-mail to manufacturer according current status 2016-06-27: Another e-mail to manufacturer according current status 2016-06-27: E-mail from manufacturer requesting further information 2016-06-28: Provided further information and PoC software tool 2016-07-07: E-mail from manufacturer with further information and question about intended disclosure 2016-07-08: E-mail to manufacturer concerning the planned responsible disclosure 2016-08-04: E-mail from manufacturer concerning limitations of actual attacks 2016-10-05: Public release of the security advisory ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] Product website for Microsoft Wireless Desktop 2000 https://www.microsoft.com/accessories/en-us/products/keyboards/wireless-desktop-2000/m7j-00001 [2] Website of Bus Pirate hardware tool http://dangerousprototypes.com/docs/Bus_Pirate [3] nrfprog Github repository https://github.com/nekromant/nrfprog [4] SySS Security Advisory SYSS-2016-033 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2016-033.txt [5] SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Gerhard Klostermeier and Matthias Deeg of the SySS GmbH. E-Mail: gerhard.klostermeier (at) syss.de Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Gerhard_Klostermeier.asc Key fingerprint = 8A9E 75CC D510 4FF6 8DB5 CC30 3802 3AAB 573E B2E7 E-Mail: matthias.deeg (at) syss.de Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Matthias_Deeg.asc Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS Web site. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 3.0 URL: http://creativecommons.org/licenses/by/3.0/deed.en -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJX9L4DAAoJENmkv2o0rU2ro7UQAK0SPFAvpZCbLvHtdsYv6CzA WcoNBEWKj1/KP6tPKyQto5ADOlJOqNLTk0QkuCq01iwe3mjUWsKVbHWeFo+OupgZ 1brNQ9Tilik4S6HGLySQMK/488h6SrpCgUIs0gqrLOJq/twCrW9UD0vmS0nwMpg5 NghwdwMzUNtniVANk3zHdCnI1jIvgkZKnJM91a/Ief98UPnvL04I0Z4geC/E+kqT Ud71z1ll+NLjluJ+6dLrrYXXU8kUx6gpNA8mlFQBkOtf+SB4YudCJE/VYGnrB3+I enIA4aQkKyaXrXXFBTG4BTNGYKCpTSmTA+6E+K9JEwZyvLa0YNxZTveVPI+fW4kM do5uv4a82LmQg7Mbk8waYQoVQ/dtlY5dVEx3j9FKLi2YU/0Z+TCWtrmaTM4HzrEm 1lzp8BTGTQSr3wa7uJULqlwJ1STwx6Gm1QSZuZkw84JeQt8aKsXLkL0HUiDeDaAf uu8TU371A5O5SzvJjwZg5gFs0fnY/AdHVO+Q1beMv31co6qDJvqmVwQwNjZSc9Ax HgQiIQieEpNgxKTqtg3DjadvPDeTVw6PIYZ/nbPjyUd4Ok01SqdhmTbtd6JDeoj5 LTB611S1ay7lU/WHxft0OUc0yLl4/7/jn2yOU0pzMp2fqjGOXzzPll6EivuVG/kp 40OjZ+7DP20oPlqzaZga =sFjE -----END PGP SIGNATURE-----