14 DAY TRIAL // At the end of April, the FBI issued a public alert regarding KeySweeper, a piece of custom hardware created by security researcher Samy Kamkar as a proof-of-concept project, capable of stealing keystrokes from wireless Microsoft keyboards by intercepting nearby radio signals and decrypting the keyboard's protocol.
The device works on top of an Arduino board, which is small enough to fit inside the case of a USB charger. Since USB chargers have become commonplace with the proliferation of mobile devices such as smartphones and tablets, seeing one such device plugged into a wall socket and abandoned in an office is not out of the ordinary these days.
The FBI warns companies to limit the number of outlets available for device charging, to instruct employees to recognize whose chargers are currently plugged in, and not to leave any charger plugged into the wall if not used.
Additionally, companies were also instructed to limit the usage of wireless keyboards, either by switching to wired keyboards or to ones that use Bluetooth for communications. However, if companies use Bluetooth keyboards, the FBI also recommends using encryption, along with a strong PIN.
KeySweeper is not effective against all keyboards
KeySweeper cannot harvest keystrokes from Bluetooth keyboards, with Kamkar only designing it for RF-based wireless keyboards created and sold by Microsoft. Of course, with the documentation out there in the open, anyone can very easily adapt it to other platforms and manufacturers.
While it was doing damage control after Kamkar's announcement last year, Microsoft also said that keyboards that operate on the 2.4GHz frequency and manufactured after 2011 are also safe because thoy use Advanced Encryption Standard (AES) encryption for securing keystrokes between the keyboard and the computer.
Kamkar released the device in January 2015, but the FBI has only recently issued this alert, which means that it investigated at least one case where someone used a KeySweeper device to log keystrokes.
