what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

CHERRY B.UNLIMITED AES JD-0400EU-2/01 Keystroke Injection

CHERRY B.UNLIMITED AES JD-0400EU-2/01 Keystroke Injection
Posted Jul 29, 2016
Authored by Matthias Deeg, Gerhard Klostermeier | Site syss.de

CHERRY B.UNLIMITED AES version JD-0400EU-2/01 suffers from cryptographic issues and keystroke injection vulnerabilities.

tags | advisory, vulnerability
SHA-256 | 8d783cf17d0aeb744bc415fcc3f5209b17a3b0f1fec084fd4a66af59968c352f

CHERRY B.UNLIMITED AES JD-0400EU-2/01 Keystroke Injection

Change Mirror Download
Hash: SHA512

Advisory ID: SYSS-2016-038
Manufacturer: Cherry GmbH
Affected Version(s): JD-0400EU-2/01
Tested Version(s): JD-0400EU-2/01
Vulnerability Type: Cryptographic Issues (CWE-310)
Keystroke Injection Vulnerability
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2016-05-04
Solution Date: -
Public Disclosure: 2016-07-29
CVE Reference: Not yet assigned
Authors of Advisory: Matthias Deeg and Gerhard Klostermeier (SySS GmbH)



CHERRY B.UNLIMITED AES is a wireless desktop set consisting of a
mouse and a keyboard.

The manufacturer describes the product as follows (see [1]):

"CHERRY B. UNLIMITED AES combines secure data transmission and an
advanced energy supply in a design which has been thought through to the
very last detail. For high professional requirements and security both
at home and in the workplace."

Some of the key benefits of CHERRY B.UNLIMITED AES are (see [2]):

* Data transmission using 128-bit encryption, complying to Advanced
Encryption Standard (AES)
* USB cable charging function for both keyboard & mouse - even when in
* High-quality, pre-charged NiMH batteries from GP with a very low
* Almost interference-free wireless 2.4 GHz technology (range of up to
10 metres)
* 3-button mouse: infrared sensor and adjustable resolution
(1,000/2,000 dpi) with ergonomic side panels
* Multi-station capability operation of several wireless products in
one room
* Easy to install, requiring no technical knowledge
* Mini USB receiver
* Keyboard awarded the "Blauer Engel" environmental seal

Due to an insecure implementation of the encrypted data communication,
the wireless keyboard CHERRY B.UNLIMITED AES is prone to keystroke
injection attacks.


Vulnerability Details:

The SySS GmbH found out that the wireless keyboard CHERRY B.UNLIMITED
AES is prone to keystroke injection attacks.

An attacker can sniff the AES-encrypted data packets of the 2.4 GHz
radio communication sent by the keyboard to the receiver (USB dongle)
and identify key release data packets by means of time correlation.
For example, the last sent data packet before a longer time period
without any data communication usually is a key release packet.

The plaintext of such key release data packets and the AES encryption
using counter mode is known to an attacker by a previously performed
analysis of an attacker-owned device (see SySS security advisory

Due to the insecure implementation of the AES-encrypted data
communication, an attacker can modify a previously sniffed encrypted
key release data packet and transmit it to the CHERRY B.UNLIMITED AES
USB dongle in order to inject arbitrary keystrokes of his choice.

Thus, despite AES-encrypted data communication, an attacker is able to
send arbitrary keystrokes to a victim's computer system. In this way, an
attacker can remotely take control over the victim's computer that is
operated with an affected CHERRY B.UNLIMITED AES wireless keyboard.

In combination with the replay attack described in the SySS security
advisory SYSS-2016-031 (see [3]), a keystroke injection attack allows to
remotely attack computer systems with an active screen lock, for example
in order to install malware when the target system is unattended.


Proof of Concept (PoC):

The SySS GmbH could successfully perform keystroke injection attacks
against the wireless keyboard CHERRY B.UNLIMITED AES using an in-house
developed software tool in combination with the USB radio dongle
Crazyradio PA (see [4]).



According to information from the manufacturer Cherry GmbH, the reported
security issue will currently not be fixed in affected products.

The written statement in German from Cherry GmbH regarding this and other
reported security issues is:

"Nach Prufung der von Ihnen festgestellten 'Sicherheitsschwachstellen'
haben wir uns dazu entschlossen, die AES Verschlusselung bis auf weiters
nicht weiter mit den Produkt zu promoten. Derzeit arbeiten wir an einem
Nachfolgeprodukt. Wie bisher, empfehlen wir Kunden mit hohen
Sicherheitsanfordungen ein kabelgebundenes Produkt zu verwenden.
Je nach Anforderung, auch mit CC-Zertifizierung."

The English translation of this statement is:

"We have examined the 'security flaws' you reported to us. As a result,
we decided, until further notice, to no longer refer to AES encryption
in order to promote the affected product. At the moment, we are
currently working on a successor product. As we already did in the past,
we recommend to our customers having particularly high security demands
using wired products which, depending on the requirements, should be
CC certified."


Disclosure Timeline:

2016-05-04: Vulnerability reported to manufacturer
2016-05-24: Response from manufacturer with information about
the reported security issue and rescheduling of the
publication date in agreement with the manufacturer
2016-07-04: Received written statement from manufacturer concerning the
reported security issue
2016-07-29: Public release of the security advisory



[1] Data sheet for CHERRY B.UNLIMITED AES
[2] Product website for CHERRY B.UNLIMITED AES
[3] SySS Security Advisory SYSS-2016-031
[4] Product website for Crazyradio PA
[5] SySS Security Advisory SYSS-2016-038
[6] SySS Responsible Disclosure Policy



This security vulnerability was found by Matthias Deeg and Gerhard
Klostermeier of the SySS GmbH.

E-Mail: matthias.deeg (at) syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Matthias_Deeg.asc
Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB

E-Mail: gerhard.klostermeier (at) syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Gerhard_Klostermeier.asc
Key fingerprint = 8A9E 75CC D510 4FF6 8DB5 CC30 3802 3AAB 573E B2E7



The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS Web



Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en

Version: GnuPG v2

Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    6 Files
  • 17
    Jul 17th
    34 Files
  • 18
    Jul 18th
    6 Files
  • 19
    Jul 19th
    34 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    19 Files
  • 23
    Jul 23rd
    17 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Security Services
Hosting By