what you don't know can hurt you

Logitech M520 Y-R0012 Spoof Attack

Logitech M520 Y-R0012 Spoof Attack
Posted Sep 30, 2016
Authored by Matthias Deeg, Gerhard Klostermeier

The Logitech M520 Y-R0012 mouse suffers from insufficient verification of data authenticity allowing for a spoofing attack.

tags | advisory, spoof
MD5 | 24cbc381780c56dd465a278120f568d4

Logitech M520 Y-R0012 Spoof Attack

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID: SYSS-2016-060
Product: M520 (Mouse of Wireless Combo MK520)
Manufacturer: Logitech
Affected Version(s): Model Y-R0012
Tested Version(s): Model Y-R0012
Vulnerability Type: Insufficient Verification of Data Authenticity (CWE-345)
Mouse Spoofing Attack
Risk Level: Medium
Solution Status: Open
Manufacturer Notification: 2016-06-28
Solution Date: -
Public Disclosure: 2016-09-30
CVE Reference: Not yet assigned
Authors of Advisory: Matthias Deeg and Gerhard Klostermeier (SySS GmbH)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

Logitech Wireless Combo MK520 is a wireless desktop set consisting of a
mouse and a keyboard.

The manufacturer describes the product as follows (see [1]):

"A keyboard and mouse that puts convenience and control comfortably at
your fingertips"

Due to unencrypted and unauthenticated mouse data communication, the
wireless desktop set Logitech Wireless Combo MK520 is prone to mouse
spoofing attacks.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

The SySS GmbH found out that the mouse of the wireless desktop set
Logitech Wireless Combo MK520 is prone to spoofing attacks, as the mouse
data communication is unencrypted and unauthenticated.

An attacker can analyze the unencrypted mouse data packets of the 2.4
GHz radio communication sent by the mouse to the receiver (USB dongle)
in order to learn the used protocol. By knowing the used mouse data
protocol, it is possible to spoof mouse actions like mouse movements or
mouse clicks by sending forged data packets.

Thus, an attacker is able to remotely control the mouse pointer of a
target system that is operated with the wireless desktop set Logitech
Wireless Combo MK520. If the graphical user interface of the victim's
system is unlocked, an attacker can for example send a list of mouse
actions that start the virtual on-screen keyboard of the operating
system and execute arbitrary commands in the context of the currently
logged in user, for instance a download and execute attack vector.

As the attacker may not have an unobstructed view to the target system's
screen and may not know the used operating system, the screen resolution,
or the current mouse settings, this kind mouse spoofing attack is based
on heuristics. But concerning an unlocked and unattended system, an
attacker can simply try different attack vectors for different target
system configurations sequentially.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

The SySS GmbH could successfully perform mouse spoofing attacks against
a target system operated with the wireless desktop set Logitech Wireless
Combo MK520 using an in-house developed software tool in combination
with the USB radio dongle Crazyradio PA (see [2]).

A proof-of-concept mouse spoofing attack resulting in remote code
execution using the SySS software tool Radioactive Mouse is demonstrated
in a video (see [4]).

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

The SySS GmbH is not aware of a solution for this reported security
vulnerability.

For further information please contact the manufacturer.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2016-06-28: Vulnerability reported to manufacturer
2016-09-30: Public release of the security advisory

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product website for Logitech Wireless Combo MK520
http://www.logitech.com/en-us/product/wireless-combo-mk520
[2] Product website for Crazyradio PA
https://www.bitcraze.io/crazyradio-pa/
[3] SySS Security Advisory SYSS-2016-060
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2016-060.txt
[4] SySS Proof-of-Concept Mouse Spoofing Attack Video
https://www.youtube.com/watch?v=PkR8EODee44
[5] SySS Responsible Disclosure Policy
https://www.syss.de/en/responsible-disclosure-policy/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Matthias Deeg and Gerhard
Klostermeier of the SySS GmbH.

E-Mail: matthias.deeg (at) syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Matthias_Deeg.asc
Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB

E-Mail: gerhard.klostermeier (at) syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Gerhard_Klostermeier.asc
Key fingerprint = 8A9E 75CC D510 4FF6 8DB5 CC30 3802 3AAB 573E B2E7

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS Web
site.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en

-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJX7imSAAoJENmkv2o0rU2rDnUP/ApUOL4tQp46/PO1hsR/VNkq
UcelXWChNMahJ0R+VX1Dbxj+R785egB4L3hwlEvk8I1lVuTj2iKDsHplIlBK/hof
LydV7x1hSoW15XZE5asho1EZ0PcSw6KCICvHbCqfYxB/uQYJnCztZUOpbbeOBPlj
iymJgZD5LVvgPqO2eljCS1vWbIFsopO8ioP56cVLVqQUJl6GppW3zZF1A8QEe6mZ
hDVZYpix9c++6WuM96ePCU5jPcoynndUrkkLLpVb7Wb82qgWGaiRByB8AitFGNm/
DrH1QXasY1wHQPElhf8BPlzUCoe2KBAXuJeqmzbgwW8i+4cyU5rYEqBXjUfEJgHM
HzkCYKsnO7GKO9ReVXJOJ4qiw4yJhniuOcTIaOpVNI9zAmu6iIF2l++0f22uAIl2
Zef32Ti9jAxQkBt+jucXQTg0V3tlSFsTNf79CQb8ta/0ybQQ0mN9wXXIMEZbcRSj
oKj+k2OAvSOCl6RB0CkAdccT+yOxULM7ULOi7F0YJvfaGAH4+mOYdSUUFpXypc+G
jL+oCVth6qhgy0DVftIPPBZRwwotY2pngOEo01xDdvo5nMalPz7N0zy3NOOJIea1
Mz/PYxY5ojzcY6qO4WgJnkEoCnw43UOLwIApni1hKiOTflqhfTRjSazmn5Imn5ve
SB5H//zeiK+A6Upg6I6o
=6m2e
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

January 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    4 Files
  • 2
    Jan 2nd
    3 Files
  • 3
    Jan 3rd
    3 Files
  • 4
    Jan 4th
    33 Files
  • 5
    Jan 5th
    31 Files
  • 6
    Jan 6th
    21 Files
  • 7
    Jan 7th
    15 Files
  • 8
    Jan 8th
    19 Files
  • 9
    Jan 9th
    1 Files
  • 10
    Jan 10th
    1 Files
  • 11
    Jan 11th
    33 Files
  • 12
    Jan 12th
    19 Files
  • 13
    Jan 13th
    27 Files
  • 14
    Jan 14th
    8 Files
  • 15
    Jan 15th
    16 Files
  • 16
    Jan 16th
    1 Files
  • 17
    Jan 17th
    2 Files
  • 18
    Jan 18th
    20 Files
  • 19
    Jan 19th
    32 Files
  • 20
    Jan 20th
    15 Files
  • 21
    Jan 21st
    10 Files
  • 22
    Jan 22nd
    16 Files
  • 23
    Jan 23rd
    1 Files
  • 24
    Jan 24th
    1 Files
  • 25
    Jan 25th
    36 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close