Date: Mon, 8 May 2017 13:19:10 +0200
From: Micha Borrmann <micha.borrmann@...s.de>
To: <bugtraq@...urityfocus.com>
Subject: [SYSS-2017-010] HP Wireless Mouse: Spoofing Attack (CWE-345)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Advisory ID: SYSS-2017-010
Product: Wireless Mouse (part of Wireless Desktop Set ERK-321A, which is shipped together with HP Elite Slice)
Manufacturer: HP
Affected Version(s): MORFGIUO
Tested Version(s): MORFGIUO
Vulnerability Type: Insufficient Verification of Data Authenticity (CWE-345)
                    Mouse Spoofing Attack
Risk Level: Medium
Solution Status: Open
Manufacturer Notification: 2017-03-02
Solution Date: -
Public Disclosure: 2017-05-08
CVE Reference: Not yet assigned
Authors of Advisory: Micha Borrmann and Matthias Deeg (SySS GmbH)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

HP ERK-321A is a wireless desktop set consisting of a mouse and a
keyboard.

Due to unencrypted and unauthenticated mouse data communication, the
wireless desktop set HP ERK-321A is prone to mouse spoofing attacks.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

SySS GmbH found out that the mouse (model MORFGIUO) of the wireless
desktop set HP ERK-321A is prone to spoofing attacks, as the mouse
data communication is unencrypted and unauthenticated.

An attacker can analyze the unencrypted mouse data packets of the 2.4
GHz radio communication sent by the mouse to the receiver (USB dongle)
in order to learn the used protocol. By knowing the used mouse data
protocol, it is possible to spoof mouse actions like mouse movements
or mouse clicks by sending forged data packets.

Thus, an attacker is able to remotely control the mouse pointer of a
target system that is operated with the wireless desktop set HP
ERK-321A. If the graphical user interface of the victim's system is
unlocked, an attacker can for example send a list of mouse actions
that start the virtual on-screen keyboard of the operating system and
execute arbitrary commands in the context of the currently logged in
user, for instance a download and execute attack vector.

As the attacker may not have an unobstructed view to the target
system's screen and may not know the used operating system, the screen
resolution, or the current mouse settings, this kind mouse spoofing
attack is based on heuristics. But concerning an unlocked and
unattended system, an attacker can simply try different attack vectors
for different target system configurations sequentially.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

The SySS GmbH could successfully perform mouse spoofing attacks
against a target system operated with the wireless desktop set HP
ERK-321A using an in-house developed software tool in combination with
the USB radio dongle Logitech Unifying receiver (model C-U0007) and the
RFStorm nRF24LU1+ Research Firmware developed by Bastille [1].

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

The SySS GmbH is not aware of a solution for this reported security
vulnerability.

For further information please contact the manufacturer.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2017-02-21: Detection of the vulnerability
2017-03-02: Vulnerability reported to manufacturer
2017-05-08: Public release of the security advisory

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] RFStorm nRF24LU1+ Research Firmware
    https://github.com/BastilleResearch/nrf-research-firmware
[2] SySS Security Advisory SYSS-2017-010
    https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2017-010.txt
[3] SySS Responsible Disclosure Policy
    https://www.syss.de/en/responsible-disclosure-policy/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Micha Borrmann and Matthias Deeg 
of SySS GmbH.

E-Mail: micha.borrmann (at) syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Micha_Borrmann.asc
Key Fingerprint: F2E7 C6A5 9950 84ED 7AD6  0DD4 EDBE 26E7 14EA 5876

E-Mail: matthias.deeg (at) syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Matthias_Deeg.asc
Key fingerprint: D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is" 
and without warranty of any kind. Details of this security advisory may 
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS Web 
site.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE8ufGpZlQhO161g3U7b4m5xTqWHYFAlkQVCsACgkQ7b4m5xTq
WHbbHg//VuiDUrTylosLvg5xuAFhRmtsDqp9dlOyAbZ9V+phTH90rJoAiG1/lGAi
eRC4GJoQfXp4jbv1X/Vuq4bmRp6y7LXcXB5JkqRMI8Eq8GO16Ue4fraspJpfjtzI
4UENHQdcZnmedXUYoS5GHtkJGkEHQ61f0980XzTZJZ61wi6uKbWRasQCIthwK0G4
pPrZLv0fzYyyGJP2RFpnSrWsWVw1iIdBjLBx+cpjr96SRWls0IbTbhkEa1DccPi9
HnYLDLoKMkoMBfoDHw/hXwR7ee3JhADDg1ZQLMlyv7o5KXG25eV9ehwMo7KxiqDZ
I863j3NIHF0saFkbqMCeBdJM4q2KaXyO262bnTWXOwL0NdjJ6CYvUSdBfMF0ecPG
D6zDWVYtxpVGFHUzPSUfKADwjMd7+FROVcits1lFHWd1CppugQyHzfL5GiL7WzVR
lRnFFumUdKsNDffMII4av+P8aV2bhqcZ6MQF/4O70qq4rxoQJTlErZrr1+qIJEVR
eTB/yqO7tPzFA+6rakuvjsDFAuZr6WzI6sjmcJClMdNQYAkwJOV8m8gRUgAOD9Ag
+zlEEGOWH0oNjvLLv9sAWuaIwdYWgX+8nrKtKFG0Kjpj6X4CrPDv9nKbf+0mOsSD
4hovJce0L2wV4H20KKfyxsirZl7C2Jyx09uwUbNm1AzPR6XmHhs=
=krZ+
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists