exploit the possibilities

Fujitsu LX901 GK900 Keystroke Injection

Fujitsu LX901 GK900 Keystroke Injection
Posted Mar 15, 2019
Authored by Matthias Deeg

SySS GmbH found out that the wireless desktop set Fujitsu LX901 is vulnerable to keystroke injection attacks by sending unencrypted data packets with the correct packet format to the receiver (USB dongle).

tags | advisory
MD5 | be5d36b96d4f2705e625f64190c28a98

Fujitsu LX901 GK900 Keystroke Injection

Change Mirror Download
Hash: SHA512

Advisory ID: SYSS-2018-033
Product: Wireless Keyboard Set LX901
Manufacturer: Fujitsu
Affected Version(s): Model No. GK900
Tested Version(s): Model No. GK900
Vulnerability Type: Cryptographic Issues (CWE-310)
Keystroke Injection Vulnerability
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2018-10-19
Solution Date: -
Public Disclosure: 2019-03-15
CVE Reference: Not yet assigned
Author of Advisory: Matthias Deeg (SySS GmbH)



Fujitsu Wireless Keyboard Set LX901 is a wireless desktop set consisting
of a mouse and a keyboard.

The manufacturer describes the product as follows (see [1]):

"The Wireless Keyboard LX901 is a top of the line desktop solution
for lifestyle orientated customers, who want only the best for their
desk. This superb keyboard set offers ambitious users more functions,
security and better features than a conventional interface device. It
even includes 2.4 GHz technology and 128 AES encryption for security."

Due to an insecure implementation of the data communication, the
wireless keyboard LX901 is prone to keystroke injection attacks.


Vulnerability Details:

SySS GmbH found out that the wireless desktop set Fujitsu LX901 is
vulnerable to keystroke injection attacks by sending unencrypted data
packets with the correct packet format to the receiver (USB dongle).

The Fujitsu wireless keyboard itself only transmits keystrokes via
AES-encrypted data packets with a payload size of 16 bytes using the
2.4 GHz transceiver CYRF6936 from Cypress Semiconductor (see [2]).

However, the receiver (a.k.a. bridge) of the Fujitsu wireless desktop
set not only processes keyboard data packets encrypted with the correct
shared AES key contained in the keyboard and bridge firmware, but also
unencrypted data packets with the data packet format described in the
CY4672 PRoC LP Reference Design Kit by Cypress Semiconductor (see [3]).

Thus, an attacker is able to send arbitrary keystrokes to a victim's
computer system. In this way, an attacker can remotely take control over
the victim's computer that is operated with an affected Fujitsu LX901
wireless desktop set.

In combination with the replay attack described in the SySS security
advisory SYSS-2016-068 (see [4]), a keystroke injection attack allows to
remotely attack computer systems with an active screen lock, for example
in order to install malware when the target system is unattended.


Proof of Concept (PoC):

The SySS GmbH could successfully perform keystroke injection attacks
against the Fujitsu wireless desktop set LX901 using an in-house
developed firmware for a 4-in-1 wireless module using a CYRF6936
transceiver (see [5]).



SySS GmbH is not aware of a solution to the described security issue.


Disclosure Timeline:

2018-10-19: Vulnerability reported to manufacturer
2018-10-22: Fujitsu confirms receipt of security advisory
2018-10-25: Fujitsu asks for more information about the reported
security issue
2018-10-26: Provided more information concerning the reported security
vulnerability to Fujitsu
2018-10-29: Fujitsu asks for more information about the reported
security issue and proof of attacks (replay and keystroke
2018-10-30: Clarified some misunderstandings concerning the replay
(SYSS-2016-068) and the keystroke injection (SYSS-2018-033)
vulnerabilities, provided source code of a developed PoC
tool, and provided videos with proof-of-concept attacks
exploiting these two security issues
2019-03-15: Public release of security advisory



[1] Product website for Fujitsu Wireless Keyboard Set
[2] Datasheet WirelessUSB LP 2.4 GHz Radio SoC (CYRF6936)
[3] CY4672 PRoC LP Reference Design Kit
[4] SySS Security Advisory SYSS-2016-068
[5] Banggood 4-in-1 RF Transceiver Module
[6] SySS Security Advisory SYSS-2018-033
[7] SySS Responsible Disclosure Policy
[8] SySS Proof-of-Concept Video: Fujitsu Wireless Keyboard Set LX901 Keystroke Injection Attack



This security vulnerability was found by Matthias Deeg of SySS GmbH.

E-Mail: matthias.deeg (at) syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Matthias_Deeg.asc
Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB



The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS Web



Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en




RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

April 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    21 Files
  • 2
    Apr 2nd
    35 Files
  • 3
    Apr 3rd
    21 Files
  • 4
    Apr 4th
    16 Files
  • 5
    Apr 5th
    15 Files
  • 6
    Apr 6th
    1 Files
  • 7
    Apr 7th
    2 Files
  • 8
    Apr 8th
    23 Files
  • 9
    Apr 9th
    19 Files
  • 10
    Apr 10th
    15 Files
  • 11
    Apr 11th
    14 Files
  • 12
    Apr 12th
    11 Files
  • 13
    Apr 13th
    2 Files
  • 14
    Apr 14th
    5 Files
  • 15
    Apr 15th
    14 Files
  • 16
    Apr 16th
    19 Files
  • 17
    Apr 17th
    19 Files
  • 18
    Apr 18th
    8 Files
  • 19
    Apr 19th
    4 Files
  • 20
    Apr 20th
    5 Files
  • 21
    Apr 21st
    1 Files
  • 22
    Apr 22nd
    4 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2019 Packet Storm. All rights reserved.

Security Services
Hosting By