Enlarge (credit: FBI)
Update: May 25, 2016 8:09am PDT The author of the FBI advisory contacted Ars to say the point he wanted to convey is that threat stems not from KeySweeper itself, but from similar types of devices that could easily contain additional functionality. “Arduino being modular and programmable, a cyber actor could swap out parts or alter coding and change what is (frankly) a negligible threat into something actually problematic (e.g., swapping the nRF chip out for some form of Wi-fi sniffer),” the author wrote “It’s the fact this thing looks completely harmless, but can hide something capable of stealing data over the air.”
FBI officials are warning private industry partners to be on the lookout for highly stealthy keystroke loggers that surreptitiously sniff passwords and other input typed into wireless keyboards.
The FBI’s Private Industry Notification is dated April 29, more than 15 months after whitehat hacker Samy Kamkar released a KeySweeper, a proof-of-concept attack platform that covertly logged and decrypted keystrokes from many Microsoft-branded wireless keyboards and transmitted the data over cellular networks. To lower the chances that the sniffing device might be discovered by a target, Kamkar designed it to look almost identical to USB phone chargers that are nearly ubiquitous in homes and offices.