-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID: SYSS-2016-032
Product: CHERRY B.UNLIMITED AES
Manufacturer: Cherry GmbH
Affected Version(s): JD-0400EU-2/01
Tested Version(s): JD-0400EU-2/01
Vulnerability Type: Insufficient Protection of Code (Firmware) and 
                    Data (Cryptographic Key)
Risk Level: Medium
Solution Status: Open
Manufacturer Notification: 2016-04-22
Solution Date: -
Public Disclosure: 2016-07-29
CVE Reference: Not yet assigned
Authors of Advisory: Gerhard Klostermeier and Matthias Deeg (SySS GmbH)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

CHERRY B.UNLIMITED AES is a wireless desktop set consisting of a
mouse and a keyboard.

The manufacturer describes the product as follows (see [1]):

"CHERRY B. UNLIMITED AES combines secure data transmission and an
advanced energy supply in a design which has been thought through to the
very last detail. For high professional requirements and security both
at home and in the workplace."

Some of the key benefits of CHERRY B.UNLIMITED AES are (see [2]):

* Data transmission using 128-bit encryption, complying to Advanced 
  Encryption Standard (AES)
* USB cable charging function for both keyboard & mouse - even when in
  use
* High-quality, pre-charged NiMH batteries from GP with a very low
  self-discharge
* Almost interference-free wireless 2.4 GHz technology (range of up to
  10 metres)
* 3-button mouse: infrared sensor and adjustable resolution
  (1,000/2,000 dpi) with ergonomic side panels
* Multi-station capability operation of several wireless products in
  one room
* Easy to install, requiring no technical knowledge
* Mini USB receiver
* Keyboard awarded the "Blauer Engel" environmental seal

Due to the insufficient protection of the flash memory of the keyboard
and of the USB dongle, an attacker with physical access has read and
write access to the firmware and the used cryptographic key.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

The SySS GmbH found out that the embedded flash memory of the wireless
keyboard CHERRY B.UNLIMITED AES and of the corresponding USB dongle can
be read and written via the SPI interface of the used transceivers with
an embedded microcontroller nRF24LE1 (keyboard) and nRF24LU1+ (USB 
dongle) as the flash memory is not protected by the offered read back
protection feature (RDISMB - Read DISable Main Block).

Thus, an attacker with physical access to the keyboard or the USB dongle
can simply read and write the SPI-addressable code and data flash
memory.

By writing a custom-made firmware to the code flash memory, an attacker
can also gain access to all contents of the extended endurance flash
memory of the CHERRY B.UNLIMITED AES keyboard that is not directly
accessible via the SPI interface and where the AES cryptographic key
is stored.

Concerning the USB dongle, all data flash memory is accessible via
the SPI interface. Thus, no custom-made firmware is required to extract
the AES cryptographic key from the USB dongle.

By having read and write access to the code and data flash memory, an
attacker can either extract the cryptographic key, for instance to
perform further attacks against the wireless communication, or modify
the firmware or the cryptographic key.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

The SySS GmbH could successfully read the contents of the code and data
flash memory of the CHERRY B.UNLIMITED AES keyboard and of the USB
dongle using the hardware tool Bus Pirate [3] in combination with the
software tool nrfprog [4].

For accessing the AES cryptographic key stored in the extended endurance
flash memory, the SySS GmbH developed a small firmware for copying
the contents of this memory area to the SPI-addressable flash memory
from were it could simply be dumped via the SPI interface.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

According to information from the manufacturer Cherry GmbH, the reported
security issue will currently not be fixed in affected products.

The written statement in German from Cherry GmbH regarding this and other
reported security issues is:

"Nach Prufung der von Ihnen festgestellten 'Sicherheitsschwachstellen'
haben wir uns dazu entschlossen, die AES Verschlusselung bis auf weiters
nicht weiter mit den Produkt zu promoten. Derzeit arbeiten wir an einem
Nachfolgeprodukt. Wie bisher, empfehlen wir Kunden mit hohen
Sicherheitsanfordungen ein kabelgebundenes Produkt zu verwenden.
Je nach Anforderung, auch mit CC-Zertifizierung."

The English translation of this statement is:

"We have examined the 'security flaws' you reported to us. As a result,
we decided, until further notice, to no longer refer to AES encryption
in order to promote the affected product. At the moment, we are
currently working on a successor product. As we already did in the past,
we recommend to our customers having particularly high security demands
using wired products which, depending on the requirements, should be 
CC certified."

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2016-04-22: Vulnerability reported to manufacturer
2016-05-24: Response from manufacturer with information about
            the reported security issue and rescheduling of the
            publication date in agreement with the manufacturer
2016-07-04: Received written statement from manufacturer concerning the
            reported security issue
2016-07-29: Public release of the security advisory

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Data sheet for CHERRY B.UNLIMITED AES
    http://cherry.de/PDF/EN_CHERRY_B_UNLIMITED_AES.pdf
[2] Product website for CHERRY B.UNLIMITED AES
    http://cherry.de/cid/wireless_keyboards_CHERRY_B_UNLIMITED_AES.htm?rdeLocaleAttr=en&WT.mc_id=
[3] Website of Bus Pirate hardware tool
    http://dangerousprototypes.com/docs/Bus_Pirate
[4] nrfprog Github repository
    https://github.com/nekromant/nrfprog
[5] SySS Security Advisory SYSS-2016-032
    https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2016-032.txt
[6] SySS Responsible Disclosure Policy
    https://www.syss.de/en/responsible-disclosure-policy/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Gerhard Klostermeier and
Matthias Deeg of the SySS GmbH.

E-Mail: gerhard.klostermeier (at) syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Gerhard_Klostermeier.asc
Key fingerprint = 8A9E 75CC D510 4FF6 8DB5 CC30 3802 3AAB 573E B2E7

E-Mail: matthias.deeg (at) syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Matthias_Deeg.asc
Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is" 
and without warranty of any kind. Details of this security advisory may 
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS Web 
site.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCgAGBQJXmxoGAAoJENmkv2o0rU2r8AkQAIZmeRn3i7P5XwBPDJxB4iLC
gSR8dAY/MVztzAQ6PkZAjIbEPdS5yuXoCoPs1w/3UIRlPY/2X3whobyh9HuXpBbG
C56nr6sa+tyGdTJfCAIVIDDkkMXPC0cI38aA0g6S3wii6JZe4HERwN0Kkw8MXsl8
XsBFK+LiIeHqAhtzor4MjzSWorEuVVYYk6LrDPXc3XWB0izdYwn3PJXoXtJzL7vS
+xsoR4uhfXhsPkwILcYdrEaOBHYOezrBqEE3vsRcmXNhUKmY+6+UMfezYX2Oo9Eh
yeFjmMQ2AaEroMQIdIgCNF9BNdW0WwuAXX3Zl32EkFDlCP1tRS7oaAvwUWt2gZf/
oKu0Du9VZgDCCCqHn4fQV1SKm9nvFQa06BatYBrYoF90ZLeaoBfQ5i0QzhSGcFn2
SZQ08in9A4yYCwgTr4IfJ3iC+th56FIbWidAqdBxWW5De5kUiLViHLxGdQRc0qHQ
eSvpze8katJzHm3GMf+xLRBWY8hJuv5jCf2N3M0UBIKrnmVbdP2+RrNjPITg0tco
qXejiyahHlDJeAiy1LaiyDJiqH6Yv5Ttf0zfDAScjPdbl0eNBT1jmWgBvog/oOyz
y3xpEWt1cmCScOrHs2gvThWIJ3clwwpV4Vi+CyvS4UFc+2qP7zS7hbY26Smwfkdy
w1WUGdWFuJS0FqIrH40F
=rWBu
-----END PGP SIGNATURE-----