Multiple Vendor USB, PS/2 and Laptop Keyboard Electromagnetic Emanation Capture Vulnerability

Bugtraq ID:	31831
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Oct 20 2008 12:00AM
Updated:	Oct 21 2008 02:06AM
Credit:	Martin Vuagnoux and Sylvain Pasini
Vulnerable:	Logitech Deluxe Keyboard (PS/2) 0
Not Vulnerable:

Multiple Vendor USB, PS/2 and Laptop Keyboard Electromagnetic Emanation Capture Vulnerability

Keyboards from multiple vendors are prone to an information-disclosure vulnerability because the devices fail to adequately shield electromagnetic emanations.

Attackers may exploit this issue to obtain keystroke data; information harvested may aid in launching further attacks.

Very few details are currently available. We will update this BID as more information emerges.

Multiple Vendor USB, PS/2 and Laptop Keyboard Electromagnetic Emanation Capture Vulnerability

The following videos are available to demonstrate this issue:

http://lasecwww.epfl.ch/keyboard/

Multiple Vendor USB, PS/2 and Laptop Keyboard Electromagnetic Emanation Capture Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple Vendor USB, PS/2 and Laptop Keyboard Electromagnetic Emanation Capture Vulnerability

References: