Logitech M185 and Other Mice are Vulnerable to Keystroke Injection

Discussion in 'HardForum Tech News' started by AlphaAtlas, Mar 18, 2019.

  1. AlphaAtlas

    AlphaAtlas [H]ard|Gawd Staff Member

    Messages:
    1,716
    Joined:
    Mar 3, 2018
    According to a recent post on David Sopas' security blog, the very popular, and very cheap, Logitech M185 is vulnerable to a keystroke injection attack. Using a recent version of the "Bettercap" hacking toolkit and a 2.4ghz USB dongle, the security researcher used the mouse to open a script which, in this particular case, simply opened a calculator instance on Windows. While it wasn't on the "affected mouse" list, the M185 is apparently part of a wide variety of mice that are affected by similar exploits. Thanks to cageymaru for the tip.

    Check out the demonstration here.


    Just a simple PoC where I took an Logitech M185 wireless mouse and hijacked it to launch my DuckyScript on the victims machine - in this case just popping up the Windows calculator.
     
  2. prime2515102

    prime2515102 [H]ard|Gawd

    Messages:
    1,510
    Joined:
    Mar 3, 2003
    I hate when I get strokes injected into my mouse! :mad:
     
  3. vegeta535

    vegeta535 2[H]4U

    Messages:
    2,794
    Joined:
    Jul 19, 2013
    Nothing is safe from hackers.
     
  4. Nenu

    Nenu [H]ardened

    Messages:
    18,585
    Joined:
    Apr 28, 2007
    You has the wrong video on the front page :p
     
  5. jardows

    jardows [H]ard|Gawd

    Messages:
    1,456
    Joined:
    Jun 10, 2015
    Just use a wired mouse?
     
    SvenBent and Armenius like this.
  6. pcgeekesq

    pcgeekesq [H]ard|Gawd

    Messages:
    1,439
    Joined:
    Apr 23, 2012
    I used to use wireless mice.
    I learned my lesson, tossed them in a drawer, and moved back to mice with tails.
     
  7. Bobert

    Bobert Limp Gawd

    Messages:
    196
    Joined:
    May 22, 2011
  8. seanreisk

    seanreisk Gawd

    Messages:
    804
    Joined:
    Aug 29, 2011
    Huh. My bank uses wireless mice and keyboards so they have more room at the teller windows.

    <strokey beard moment>

    I'm not very good at the whole 'Evil Genius' thing, though.


    P.S. "Ok, smart guy, you opened Windows Calculator on all the bank teller's computers. Now what?"
     
    SticKx911 likes this.
  9. Dead Parrot

    Dead Parrot 2[H]4U

    Messages:
    2,359
    Joined:
    Mar 4, 2013
    Security was much simpler when the only CPU in a computer was the actual CPU. Now almost everything in a computer has its own computer. Won't be long before that AA smart battery in your mouse will need firmware updates to avoid infecting the mouse. No way the average end user will be able to keep up.
     
    Baenwort likes this.
  10. That_Sound_Guy

    That_Sound_Guy 2[H]4U

    Messages:
    2,296
    Joined:
    Apr 29, 2002
    Wireless anything in a bank is a total and epic fail. "More room", yeah that wire is such a space taker...
     
    Armenius likes this.
  11. umeng2002

    umeng2002 Gawd

    Messages:
    924
    Joined:
    May 23, 2008
    I used a wireless mouse 10 years ago for some months... never again... only if I HAVE to for a laptop.
     
    Armenius likes this.
  12. Kardonxt

    Kardonxt 2[H]4U

    Messages:
    2,804
    Joined:
    Apr 13, 2009
    I have not been able to get into the all wireless mindset. To me the non inconvenience of having a cable connected to my keyboard and mouse is way better than replacing batteries or charging devices. Outside of conference room PCs, I really don't get our customers infatuation with them.
     
  13. Armenius

    Armenius I Drive Myself to the [H]ospital

    Messages:
    16,528
    Joined:
    Jan 28, 2014
    They obviously haven't accepted Velcro as their lord and savior.

    https://www.amazon.com/dp/B000LNSSVY
    upload_2019-3-18_16-24-22.png
     
  14. Bobert

    Bobert Limp Gawd

    Messages:
    196
    Joined:
    May 22, 2011
  15. Makaveli@BETA

    Makaveli@BETA 2[H]4U

    Messages:
    2,314
    Joined:
    Mar 24, 2004
    I still used a Wired G500 at home.

    However at work I use an MX master and its perfect there. I only charge it like once a month so to each his own.
     
  16. THRESHIN

    THRESHIN 2[H]4U

    Messages:
    2,925
    Joined:
    Sep 29, 2002
    They can stroke me all they want
     
  17. Sonicks

    Sonicks [H]ard|Gawd

    Messages:
    1,406
    Joined:
    Jul 24, 2005
    I felt the way you did but this past August I snagged a free wireless Logitech G305 at Quakecon (as well as the wired equivalent) and I have to say the battery thing is not a problem in the slightest. To date, I've only changed out the single AA battery in the mouse once and that's considering that I never bother turning the switch off and I use my computer for hours daily. Having the batteries on hand isn't a problem either since I already have a pack on hand for the power hungry Oculus Touch controllers. The mouse itself also has zero perceptible performance difference to me than the wired one.

    I've been converted to the wireless mouse future, keystroke injection be damned! Keyboards on the other hand...I don't really see a need to get those wireless on a desk situation since they never move.
     
    Baenwort likes this.
  18. Yaka

    Yaka Gawd

    Messages:
    613
    Joined:
    Jan 26, 2004
    is there a list somewhere of all the peripherals affected?
     
  19. zkostik

    zkostik Gawd

    Messages:
    954
    Joined:
    Sep 17, 2009
    Yeah, battery life hasn't been a problem for a while. I have a pair of Logitech MX Revolution mice (rechargeable wireless) and a more basic one with a single AA battery. Rechargeable easily last close to a month with pretty heavy regular use. The other mouse with AA battery lasts even longer, probably to the tune of a year of use. My only gripe with wireless mice is that they are heavy and I don't like that for gaming. You don't need to flip the switch unless you put in a bag to carry around, these things have insane power saving and go to sleep when not in use. It's nothing like the old days where you had a pair of AA batteries and barely last a couple of weeks. I pretty much only use my Eneloop batteries just for camera gear these days.
     
  20. Arcygenical

    Arcygenical Will Watercool for Crack

    Messages:
    24,691
    Joined:
    Jun 10, 2005
    Yeah I've had a mx revolution since 2007. Swapped out the battery last year. I charge it once every 40 days or so.
     
  21. SineDave

    SineDave Limp Gawd

    Messages:
    267
    Joined:
    Jun 9, 2004
    For gaming, you can take my wired mouse from my cold, dead hands. At work however the Logitech MX Master 2S is a superb piece of gear, and the wireless aspect is nice.

    I've got mine directly bluetooth paired to my laptop, so no risk here thankfully. On the grand scale, this seems like a pretty low risk vulnerability.
     
  22. Zarathustra[H]

    Zarathustra[H] Official Forum Curmudgeon

    Messages:
    27,649
    Joined:
    Oct 29, 2000
    Hmm. At home I used all wired stuff.

    At work I have some Logitech wireless keyboard/mouse combo thing they gave me with my setup. I brought in my own mechanical board because I hated the thing, but I still use the mouse. it says M310 on it. it's probably one of the affected ones.

    I wonder how difficult it would be to create a macro that hits the windows key, launches internet explorer, and points it towards an URL, downloads malware, and then closes everything before anyone notices.
     
  23. Zarathustra[H]

    Zarathustra[H] Official Forum Curmudgeon

    Messages:
    27,649
    Joined:
    Oct 29, 2000

    Couldn't agree more. I am much happier with wired gear.

    That said, I would be remiss if I didn't mention that modern wireless mice don't seem to need batteries very often. I haven't replaced the battery in the junk M310 they gave me at work since I started working here. I've worked here for 2 years.

    When I do finally have to replace it though, I'm sure it will be at the worst possible time, and I will have no spare batteries around :p
     
    Last edited: Mar 26, 2019
  24. Gottfried Leibnizzle

    Gottfried Leibnizzle Limp Gawd

    Messages:
    253
    Joined:
    Apr 29, 2015
    I use a M$ wireless mouse and keyboard combo that is banging on the 12 year old mark. It just keeps rocking and it still has the teflon feetses.

    The batteries on the mouse last forever, two months at least, even with daily use. I buy those big ass combo packs of cheap Agfa batteries so I never run out.

    I'll never be able to go back to a wired mouse. Keyboard, yeah maybe but honestly its just too nice not to have to worry about cabling.
     
  25. Zarathustra[H]

    Zarathustra[H] Official Forum Curmudgeon

    Messages:
    27,649
    Joined:
    Oct 29, 2000
    But why do cables cause you worry? Can someone explain this? I don't understand the dislike of them.
     
  26. Darunion

    Darunion 2[H]4U

    Messages:
    3,724
    Joined:
    Oct 6, 2010
    It's the new trendy hate thing.

    I like wires because my mouse doesn't run out of battery mid game as well as I prefer a lighter weight mouse, especially since I am using one basically all day long (work + gaming).
     
  27. SvenBent

    SvenBent 2[H]4U

    Messages:
    2,741
    Joined:
    Sep 13, 2008
    brought my own mouse for work because they had me on a wireless kb/mosue set ( they where able to find me a wired keyboard)
     
  28. Zarathustra[H]

    Zarathustra[H] Official Forum Curmudgeon

    Messages:
    27,649
    Joined:
    Oct 29, 2000
    Yeah, you may not need to change batteries on these things very often, but when you finally do, it's always at an inopportune moment, and spare batteries are never to be found, so you have to go to the store, or order from Amazon, and rob the TV remotes of their batteries in the meantime :p

    I prefer wired everything.

    Whenever there is a choice between wired or wireless, I always go with the wired solution.

    Keyboards, Mice, Ethernet, charging, audio connectivity, headsets, you name it. Always wired.

    The wired version of whatever it is, is inevitably higher quality, higher performing, more reliable and without all the annoyances when it comes to charging or replacing batteries.

    The only exception would be my phone because, well, a wired cellphone wouldn't be very useful :p
     
    Darunion likes this.
  29. Darunion

    Darunion 2[H]4U

    Messages:
    3,724
    Joined:
    Oct 6, 2010
    I can get behind that. I tend to wire everything myself. Only things on wireless network at the house is a couple appletvs and the cell phones. I do use bluetooth headphones at work, but they have a 3.5mm port to plug into my mp3 player.

    Well run wires/cables never a problem. And you don't have to worry about interference, binding/pairing, man-in-the-middle sniffing, and often lower prices.

    Though, I also still do not have wired connections to my quad copters :p
     
    Zarathustra[H] likes this.
  30. Gottfried Leibnizzle

    Gottfried Leibnizzle Limp Gawd

    Messages:
    253
    Joined:
    Apr 29, 2015
    Maybe its an aesthetics thing. My batteries last long enough for when they run out for it to not be a constant annoyance.

    My equipment at work is wired and it doesnt get in the way that I even notice it, so theres that.

    I also have batteries on hand all the time so its a question of personal habit maybe?

    So its a fair question. The pros outweigh the cons for me personally so given the choice with my own stuff... yeah wireless mouse all the way. Keyboard is neither here nor there but it is useful when watching a youtube or such on your PC while on the couch.
     
  31. StoleMyOwnCar

    StoleMyOwnCar 2[H]4U

    Messages:
    2,138
    Joined:
    Sep 30, 2013
    I can tell you that I don't like wires simply because I hate any form of pull or resistance when I'm using the mouse. Lighter, braided cables have fixed this to an extent and I can deal with it, but it's just hassle to adjust the area so that the cord is completely "frictionless" (ie not there). Like I can only do so much and there are only so many type of movements that I can account for.

    This wasn't some kind of trendy or hipster thing, I've legitimately always disliked cords and the way they tended to get caught on things, like they inevitably will.

    It's just a personal thing. Most mice are so efficient these days that batteries will last probably well over a month, and I just keep a bank of rechargeable batteries and charger sitting on my desk in case they need to be replaced (these aren't just for the mouse mind you, I have everything on rechargeable batteries; it's an investment).

    But I am using a wired G600 mouse right now, mainly because my G602's wheel and some other stuff occasionally feel like not working. Nothing against wireless mice in general, just the fact that apparently everyone sucks at making them.
     
  32. awawa

    awawa n00b

    Messages:
    33
    Joined:
    Jan 24, 2019
    Wireless mouse = laptops.

    If it's a desktop, I wire the hell out of everything. Including network of course, it annoys me to no end when I see a desktop connected wirelessly to the network. :S

    The only reason why I like wireless mouses with laptops is that I can leave the dongle always connected without worrying about it sticking out and/or the cable getting tangled somewhere. And it makes for a faster get-up-and-go, which is what I need from laptops anyway.
     
    Zarathustra[H] likes this.
  33. Zarathustra[H]

    Zarathustra[H] Official Forum Curmudgeon

    Messages:
    27,649
    Joined:
    Oct 29, 2000
    Couldn't agree more. The fact that many motherboards come with WiFi on board now drives me absolutely batty.