Every information provided is based on the tested devices.
ensure that other sets, sold elsewhere, may be vulnerable
Logitech Cordless Desktop, sold in Germany.
Keyboard: M/N: Y-RC14
P/N: 867097-0102 125283-401A
Working at 27.145 MHz
in combination with several others from Logitech, sold in
devices transfer data (mouse-movements, keystrokes) wireless
Modulation is very likely AM, mutliplexing is done by kind
The syncronisation between the wireless devices and the receiver
initiated by pressing a connect-button first on the receiver
and then on
the wireless devices to
find a matching and undistorted transmit-code. The cordless
to cycle through a fixed set of codes every time you press
the receiver seems to lock in on the first code he receives
Any pair of transmitter <-> receiver sold doesn't seem
to be hard-coded
to match each other. They simply seem to run out of the fab
customer connects them the first time he is using the set,
the manual. This leaves the cruical backdoor to connect whatever
you have to whatever receiver you have.
The receiver waits for 30 minutes after initialising a connect
devices to sync to them, even if there has been an undistorted
of at least one sync-code.
An attacker is able to sniff the connect-sequence of a victim's
from far and to lock-in to the code of the victim's devices
or to take
control of a victim's device.
It is possible to gain access to cordless devices. The keystrokes
sniffed in plain, unscrambled text.
It is possible for the victim AND the attacker to read the
without the victim to notice the attack, since it's a (mostly,
below) non-intrusive 'trojanizing', to say so ;-).
To sniff a connection of wireless devices, you need a receiver
same manufacturer, same model.
By slight modifications it is possible, to extend the range
receiver to about 30m (using an external antenna). This range
further extended by using a preamplifier and directional antennas.
It is neccessary to 'remotely' initiate a reconnection of
devices by the victim himself.
This can be done by jamming the signals with any ordinary
CB-transceiver, tuned to an appropriate frequency as provided
logitech. This is also a way for a brute-force DoS. After
the wireless link, the victim wants to re-establish the (as
broken connection between the keyboard and the receiver (this
only intrusive action to be noticed by the victim. In most
innocent victim just thinks 'uh, another interference, lets
reconnect...'). The reconnection he will
achieve by 'connecting' the devices, as described in the manual.
The attacker now also has to initiate a connection-sequence
pressing the 'connect'-button on his modified receiver. Since
receivers wait for 30 minutes for a connect-sequence after
button, it is very likely to phase-in to the victims keyboard.
attacker fails, well, he hits the PTT on his transceiver again.
If a successful connection has been established, the attacker
able to read the victim's keystrokes in plain unscrambled
on a morning, he most likely will receive logins, passwords
informations. There's no need to be a genius to interpret
The receiver of the attacker stores the code, so there ist
the possibility to come back some time later and to look what's
(unless there has been a new connection-procedure done on
We intend strongly NOT TO USE these devices in security-relevant
locations. In case cordless devices are absolutely neccessary,
stronlgy intend to use either infrared devices or to wait
manufacturers to supply you 'hardened' devices.
informed. no reaction yet.
about this exploit , especially the modification to the
receiver to extend the range can be found at our homepage
This Advisory is Copyright (c) 2001 Daten-Treuhand.de and
You may distribute it unmodified. You may not modify it and
it or distribute parts of it without the author's written
In no event shall the author be liable for any damages whatsoever
arising out of or in connection with the use of this information.
Any use of this information is at the user's own risk and
informational purposes only.
All trademarks are properties of their respective holders
and are fully