FBI warns of fake USB chargers
The US’ Federal Bureau of Investigation (FBI) has issued a warning after discovering the spread of fake USB chargers. These look like a standard USB mobile charger, but covertly log, decrypt, and report back all keystrokes to hackers from Microsoft wireless keyboards. It works even after the USB has been unplugged because it has a built-in rechargeable battery. To counter the threat, users can either restrict the use of wireless keyboards or use keyboards that use Advanced Encryption Standard (AES) encryption technology.

Intellectual property

Trade secrets

Personally identifiable information

Passwords

Other sensitive information

UPCOMING WEBINAR 🔐 Mastering API Security: Understanding Your True Attack Surface Discover the untapped vulnerabilities in your API ecosystem and take proactive steps towards ironclad security. Join our insightful webinar! Join the Session

"The primary method of defense is for corporations to restrict the use of wireless keyboards. Since the KeySweeper requires over-the-air transmission, a wired keyboard will be safe from this type of attack." FBI advised.

Last year, a white hat hacker developed a cheap Arduino-based device that looked and functioned just like a generic USB mobile charger, but covertly logged, decrypted and reported back all keystrokes from Microsoft wireless keyboards.Dubbed KeySweeper , the device included a web-based tool for live keystroke monitoring and was capable of sending SMS alerts for typed keystrokes, usernames, or URLs, and work even after the nasty device is unplugged because of its built-in rechargeable battery.Besides the proof-of-concept attack platform, security researcher Samy Kamkar, who created KeySweeper, also released instructions on how to build your own USB wall charger.Now, it seems like hackers and criminal minds find this idea smart.The FBI has issued a warning advisory for private industry partners to look out for highly stealthy keyloggers that quietly sniff passwords and other input data from wireless keyboards.According to the advisory, blackhat hackers have developed their custom version of KeySweeper device, which "", could allow criminals to steal:Since KeySweeper looks almost identical to USB phone chargers that are ubiquitous in homes and offices, it lowers the chances of discovering the sniffing device by a target.However, according to a Microsoft spokesperson, customers using Microsoft Bluetooth-enabled keyboards are protected against KeySweeper threat. Also, its wireless keyboards manufactured after 2011 are also protected, as they use the Advanced Encryption Standard (AES) encryption technology.So, the primary method of defense is either to restrict the use of wireless keyboards, or to use keyboards that use the Advanced Encryption Standard (AES) encryption technology.Although the FBI made no mention of malicious KeySweeper sniffers being found in the wild, the advisory indicates the information about the KeySweeper threat was obtained through an undescribed "investigation."Sniffers work against wireless devices that do not use secure encryption for the data transmitted between a keyboard and the computer.