Logitech M185 and Other Mice are Vulnerable to Keystroke Injection

AlphaAtlas

AlphaAtlas

[H]ard|Gawd
Joined
Mar 3, 2018
Messages
1,713
According to a recent post on David Sopas' security blog, the very popular, and very cheap, Logitech M185 is vulnerable to a keystroke injection attack. Using a recent version of the "Bettercap" hacking toolkit and a 2.4ghz USB dongle, the security researcher used the mouse to open a script which, in this particular case, simply opened a calculator instance on Windows. While it wasn't on the "affected mouse" list, the M185 is apparently part of a wide variety of mice that are affected by similar exploits. Thanks to cageymaru for the tip.

Check out the demonstration here.

Just a simple PoC where I took an Logitech M185 wireless mouse and hijacked it to launch my DuckyScript on the victims machine - in this case just popping up the Windows calculator.
 
I used to use wireless mice.
I learned my lesson, tossed them in a drawer, and moved back to mice with tails.
 
Huh. My bank uses wireless mice and keyboards so they have more room at the teller windows.

<strokey beard moment>

I'm not very good at the whole 'Evil Genius' thing, though.


P.S. "Ok, smart guy, you opened Windows Calculator on all the bank teller's computers. Now what?"
 
Security was much simpler when the only CPU in a computer was the actual CPU. Now almost everything in a computer has its own computer. Won't be long before that AA smart battery in your mouse will need firmware updates to avoid infecting the mouse. No way the average end user will be able to keep up.
 
I used a wireless mouse 10 years ago for some months... never again... only if I HAVE to for a laptop.
 
I have not been able to get into the all wireless mindset. To me the non inconvenience of having a cable connected to my keyboard and mouse is way better than replacing batteries or charging devices. Outside of conference room PCs, I really don't get our customers infatuation with them.
 
Kardonxt said:
I have not been able to get into the all wireless mindset. To me the non inconvenience of having a cable connected to my keyboard and mouse is way better than replacing batteries or charging devices. Outside of conference room PCs, I really don't get our customers infatuation with them.
Click to expand...
They obviously haven't accepted Velcro as their lord and savior.

https://www.amazon.com/dp/B000LNSSVY
upload_2019-3-18_16-24-22.png
 
As an Amazon Associate, HardForum may earn from qualifying purchases.
umeng2002 said:
I used a wireless mouse 10 years ago for some months... never again... only if I HAVE to for a laptop.
Click to expand...

I still used a Wired G500 at home.

However at work I use an MX master and its perfect there. I only charge it like once a month so to each his own.
 
Kardonxt said:
I have not been able to get into the all wireless mindset. To me the non inconvenience of having a cable connected to my keyboard and mouse is way better than replacing batteries or charging devices. Outside of conference room PCs, I really don't get our customers infatuation with them.
Click to expand...

I felt the way you did but this past August I snagged a free wireless Logitech G305 at Quakecon (as well as the wired equivalent) and I have to say the battery thing is not a problem in the slightest. To date, I've only changed out the single AA battery in the mouse once and that's considering that I never bother turning the switch off and I use my computer for hours daily. Having the batteries on hand isn't a problem either since I already have a pack on hand for the power hungry Oculus Touch controllers. The mouse itself also has zero perceptible performance difference to me than the wired one.

I've been converted to the wireless mouse future, keystroke injection be damned! Keyboards on the other hand...I don't really see a need to get those wireless on a desk situation since they never move.
 
Sonicks said:
I felt the way you did but this past August I snagged a free wireless Logitech G305 at Quakecon (as well as the wired equivalent) and I have to say the battery thing is not a problem in the slightest. To date, I've only changed out the single AA battery in the mouse once and that's considering that I never bother turning the switch off and I use my computer for hours daily. Having the batteries on hand isn't a problem either since I already have a pack on hand for the power hungry Oculus Touch controllers. The mouse itself also has zero perceptible performance difference to me than the wired one.

I've been converted to the wireless mouse future, keystroke injection be damned! Keyboards on the other hand...I don't really see a need to get those wireless on a desk situation since they never move.
Click to expand...

Yeah, battery life hasn't been a problem for a while. I have a pair of Logitech MX Revolution mice (rechargeable wireless) and a more basic one with a single AA battery. Rechargeable easily last close to a month with pretty heavy regular use. The other mouse with AA battery lasts even longer, probably to the tune of a year of use. My only gripe with wireless mice is that they are heavy and I don't like that for gaming. You don't need to flip the switch unless you put in a bag to carry around, these things have insane power saving and go to sleep when not in use. It's nothing like the old days where you had a pair of AA batteries and barely last a couple of weeks. I pretty much only use my Eneloop batteries just for camera gear these days.
 
Yeah I've had a mx revolution since 2007. Swapped out the battery last year. I charge it once every 40 days or so.
 
For gaming, you can take my wired mouse from my cold, dead hands. At work however the Logitech MX Master 2S is a superb piece of gear, and the wireless aspect is nice.

I've got mine directly bluetooth paired to my laptop, so no risk here thankfully. On the grand scale, this seems like a pretty low risk vulnerability.
 
Hmm. At home I used all wired stuff.

At work I have some Logitech wireless keyboard/mouse combo thing they gave me with my setup. I brought in my own mechanical board because I hated the thing, but I still use the mouse. it says M310 on it. it's probably one of the affected ones.

I wonder how difficult it would be to create a macro that hits the windows key, launches internet explorer, and points it towards an URL, downloads malware, and then closes everything before anyone notices.
 
Kardonxt said:
I have not been able to get into the all wireless mindset. To me the non inconvenience of having a cable connected to my keyboard and mouse is way better than replacing batteries or charging devices. Outside of conference room PCs, I really don't get our customers infatuation with them.
Click to expand...


Couldn't agree more. I am much happier with wired gear.

That said, I would be remiss if I didn't mention that modern wireless mice don't seem to need batteries very often. I haven't replaced the battery in the junk M310 they gave me at work since I started working here. I've worked here for 2 years.

When I do finally have to replace it though, I'm sure it will be at the worst possible time, and I will have no spare batteries around :p
 
Last edited:
I use a M$ wireless mouse and keyboard combo that is banging on the 12 year old mark. It just keeps rocking and it still has the teflon feetses.

The batteries on the mouse last forever, two months at least, even with daily use. I buy those big ass combo packs of cheap Agfa batteries so I never run out.

I'll never be able to go back to a wired mouse. Keyboard, yeah maybe but honestly its just too nice not to have to worry about cabling.
 
Zarathustra[H] said:
But why do cables cause you worry? Can someone explain this? I don't understand the dislike of them.
Click to expand...

It's the new trendy hate thing.

I like wires because my mouse doesn't run out of battery mid game as well as I prefer a lighter weight mouse, especially since I am using one basically all day long (work + gaming).
 
brought my own mouse for work because they had me on a wireless kb/mosue set ( they where able to find me a wired keyboard)
 
Darunion said:
It's the new trendy hate thing.

I like wires because my mouse doesn't run out of battery mid game as well as I prefer a lighter weight mouse, especially since I am using one basically all day long (work + gaming).
Click to expand...

Yeah, you may not need to change batteries on these things very often, but when you finally do, it's always at an inopportune moment, and spare batteries are never to be found, so you have to go to the store, or order from Amazon, and rob the TV remotes of their batteries in the meantime :p

I prefer wired everything.

Whenever there is a choice between wired or wireless, I always go with the wired solution.

Keyboards, Mice, Ethernet, charging, audio connectivity, headsets, you name it. Always wired.

The wired version of whatever it is, is inevitably higher quality, higher performing, more reliable and without all the annoyances when it comes to charging or replacing batteries.

The only exception would be my phone because, well, a wired cellphone wouldn't be very useful :p
 
Zarathustra[H] said:
Yeah, you may not need to change batteries on these things very often, but when you finally do, it's always at an inopportune moment, and spare batteries are never to be found, so you have to go to the store, or order from Amazon, and rob the TV remotes of their batteries in the meantime :p

I prefer wired everything.

Whenever there is a choice between wired or wireless, I always go with the wired solution.

Keyboards, Mice, Ethernet, charging, audio connectivity, headsets, you name it. Always wired.

The wired version of whatever it is, is inevitably higher quality, higher performing, more reliable and without all the annoyances when it comes to charging or replacing batteries.

The only exception would be my phone because, well, a wired cellphone wouldn't be very useful :p
Click to expand...

I can get behind that. I tend to wire everything myself. Only things on wireless network at the house is a couple appletvs and the cell phones. I do use bluetooth headphones at work, but they have a 3.5mm port to plug into my mp3 player.

Well run wires/cables never a problem. And you don't have to worry about interference, binding/pairing, man-in-the-middle sniffing, and often lower prices.

Though, I also still do not have wired connections to my quad copters :p
 
Zarathustra[H] said:
But why do cables cause you worry? Can someone explain this? I don't understand the dislike of them.
Click to expand...

Maybe its an aesthetics thing. My batteries last long enough for when they run out for it to not be a constant annoyance.

My equipment at work is wired and it doesnt get in the way that I even notice it, so theres that.

I also have batteries on hand all the time so its a question of personal habit maybe?

So its a fair question. The pros outweigh the cons for me personally so given the choice with my own stuff... yeah wireless mouse all the way. Keyboard is neither here nor there but it is useful when watching a youtube or such on your PC while on the couch.
 
Zarathustra[H] said:
But why do cables cause you worry? Can someone explain this? I don't understand the dislike of them.
Click to expand...

I can tell you that I don't like wires simply because I hate any form of pull or resistance when I'm using the mouse. Lighter, braided cables have fixed this to an extent and I can deal with it, but it's just hassle to adjust the area so that the cord is completely "frictionless" (ie not there). Like I can only do so much and there are only so many type of movements that I can account for.

This wasn't some kind of trendy or hipster thing, I've legitimately always disliked cords and the way they tended to get caught on things, like they inevitably will.

It's just a personal thing. Most mice are so efficient these days that batteries will last probably well over a month, and I just keep a bank of rechargeable batteries and charger sitting on my desk in case they need to be replaced (these aren't just for the mouse mind you, I have everything on rechargeable batteries; it's an investment).

But I am using a wired G600 mouse right now, mainly because my G602's wheel and some other stuff occasionally feel like not working. Nothing against wireless mice in general, just the fact that apparently everyone sucks at making them.
 
Wireless mouse = laptops.

If it's a desktop, I wire the hell out of everything. Including network of course, it annoys me to no end when I see a desktop connected wirelessly to the network. :S

The only reason why I like wireless mouses with laptops is that I can leave the dongle always connected without worrying about it sticking out and/or the cable getting tangled somewhere. And it makes for a faster get-up-and-go, which is what I need from laptops anyway.
 
awawa said:
If it's a desktop, I wire the hell out of everything. Including network of course, it annoys me to no end when I see a desktop connected wirelessly to the network. :S
Click to expand...

Couldn't agree more. The fact that many motherboards come with WiFi on board now drives me absolutely batty.
 
You must log in or register to reply here.
Back
Top