Advisory ID: SYSS-2017-010 Product: Wireless Mouse (part of Wireless Desktop Set ERK-321A, which is shipped together with HP Elite Slice) Manufacturer: HP Affected Version(s): MORFGIUO Tested Version(s): MORFGIUO Vulnerability Type: Insufficient Verification of Data Authenticity (CWE-345) Mouse Spoofing Attack Risk Level: Medium Solution Status: Open Manufacturer Notification: 2017-03-02 Solution Date: - Public Disclosure: 2017-05-08 CVE Reference: Not yet assigned Authors of Advisory: Micha Borrmann and Matthias Deeg (SySS GmbH) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: HP ERK-321A is a wireless desktop set consisting of a mouse and a keyboard. Due to unencrypted and unauthenticated mouse data communication, the wireless desktop set HP ERK-321A is prone to mouse spoofing attacks. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: SySS GmbH found out that the mouse (model MORFGIUO) of the wireless desktop set HP ERK-321A is prone to spoofing attacks, as the mouse data communication is unencrypted and unauthenticated. An attacker can analyze the unencrypted mouse data packets of the 2.4 GHz radio communication sent by the mouse to the receiver (USB dongle) in order to learn the used protocol. By knowing the used mouse data protocol, it is possible to spoof mouse actions like mouse movements or mouse clicks by sending forged data packets. Thus, an attacker is able to remotely control the mouse pointer of a target system that is operated with the wireless desktop set HP ERK-321A. If the graphical user interface of the victim's system is unlocked, an attacker can for example send a list of mouse actions that start the virtual on-screen keyboard of the operating system and execute arbitrary commands in the context of the currently logged in user, for instance a download and execute attack vector. As the attacker may not have an unobstructed view to the target system's screen and may not know the used operating system, the screen resolution, or the current mouse settings, this kind mouse spoofing attack is based on heuristics. But concerning an unlocked and unattended system, an attacker can simply try different attack vectors for different target system configurations sequentially. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): The SySS GmbH could successfully perform mouse spoofing attacks against a target system operated with the wireless desktop set HP ERK-321A using an in-house developed software tool in combination with the USB radio dongle Logitech Unifying receiver (model C-U0007) and the RFStorm nRF24LU1+ Research Firmware developed by Bastille [1]. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: The SySS GmbH is not aware of a solution for this reported security vulnerability. For further information please contact the manufacturer. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2017-02-21: Detection of the vulnerability 2017-03-02: Vulnerability reported to manufacturer 2017-05-08: Public release of the security advisory ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] RFStorm nRF24LU1+ Research Firmware https://github.com/BastilleResearch/nrf-research-firmware [2] SySS Security Advisory SYSS-2017-010 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2017-010.txt [3] SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Micha Borrmann and Matthias Deeg of SySS GmbH. E-Mail: micha.borrmann (at) syss.de Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Micha_Borrmann.asc Key Fingerprint: F2E7 C6A5 9950 84ED 7AD6 0DD4 EDBE 26E7 14EA 5876 E-Mail: matthias.deeg (at) syss.de Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Matthias_Deeg.asc Key fingerprint: D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS Web site. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 3.0 URL: http://creativecommons.org/licenses/by/3.0/deed.en