Tech Made Simple

Hot Topics: How to Fix Bluetooth Problems | How to Cut the Cable Cord | Best Fitness Trackers Under $50 | Complete Guide to Facebook Privacy

Top News Stories

author photo

Your Wireless Mouse Could Let Hackers Into Your Laptop

by on February 25, 2016
in Privacy, News, Computers and Software, Computer Safety & Support, Accessories, Blog :: 18 comments

Wireless mouse

Mousejacking may not sound like a very potent security threat, but an open doorway into your computer via your wireless USB mouse or keyboard is no joke. Researchers at security startup Bastille Networks have found more than a billion wireless mice and keyboards leave your computer and data vulnerable to hacking.

Wireless mouse dongleThe weak spot is not in the mouse or keyboard itself but in the wireless USB transceiver dongle, that little plug-in thingie you put into the USB port of your computer. Most wireless keyboards and mice implement encryption but do not properly verify the incoming signals, which allows a nearby user with an unauthorized device to forcibly insert keystrokes through the same wireless connection.

If you're using a mouse, hackers send a wireless signal masquerading as a legitimate wireless mouse signal to the USB dongle. Most wireless USB dongles readily accept any invitation from wireless mice. Then hackers can make the wireless signal (now mimicking that of the wireless mouse) feign a wireless keyboard. And then the havoc begins.

Once your PC allows the incoming wireless signal, the hacker can pretty much do anything on your PC, including launching a Web browser, opening a web page or downloading malware and installing it on the PC. With just a fey keystrokes, the hacker can even reformat your hard drives.

According to Bastille, mousejacking can be performed from as far as 200 meters from the target computer with the help of a wireless USB antenna and a laptop. Millions of mice and keyboards are at risk, including those from Logitech, Gigabyte, Dell, Microsoft, HP, Amazon and Lenovo. Bastille researchers have published a list of devices they found to be affected by the vulnerability.

Logitech Unifying ReceiverAfter Bastille notified wireless mice and keyboard manufacturers about the issue, several of them acted quickly to mitigate the issue. Logitech’s widely used Unifying Receiver (the one with a logo of a sun shape against an orange round square) can be updated with a software patch from Logitech. Lenovo has determined that the vulnerability affects only its Lenovo 500 wireless products, and the company is prepared to swap out new and updated dongles for old ones affected by the issue.

Dell’s KM632 and KM714 mouse and keyboard combos are also affected. The company told Forbes that a patch for the KM714 is being readied, but some devices may need to be replaced. Other companies are in various stages of addressing the vulnerability and have yet to issue statements about it.

Thankfully, this security hole does not affect Bluetooth mice and keyboards. Mousejacking also won’t work on USB wireless dongles that are not in active use.

[Image credit: Computer mouse isolated via Shutterstock; Closeup view of a man's hand and computer mouse via Shutterstock]



Discussion loading

gravatar

amazing information

From holi pics on February 29, 2016 :: 8:33 am

i never thought of this. But it looks good.

Reply

gravatar

knew it.....

From TheOncomingStorm on March 06, 2016 :: 3:41 am

i knew there was a reason why i hated and had no trust for wireless peripherals.  this just spelled it out perfectly.

Reply

gravatar

dongle pc bluetooth capability

From marc on March 06, 2016 :: 4:27 pm

i guess this would apply to using a dongle on the pc to give it bluetooth capability as well?

Reply

gravatar

Does this threat only affect newer "unifying" hardware?

From RMN on March 08, 2016 :: 12:08 am

Wireless mice and keyboards have been around for more than a decade, and I am sure millions of them are still in use.  By today’s standards the older models with separate dongles for the mouse and KB are fairly primitive technologically, so should we consider those to be “safe”? Given that the ones listed appear to be primarily newer, “unifying” models, should we therefore assume that only that type of device and dongle are suspect?  Regarding Bluetooth, I have read several stories on the web which report the researchers determined this security issue did not affect Bluetooth devices.

Reply

avatar

Many older mice/keyboards could be at risk

From Josh Kirschner on March 08, 2016 :: 3:15 pm

I wouldn’t assume older models are safe. Unless the manufacturer used proper encryption for their radio transmissions, the same hack could be exploited. And there is no easy way for us, as users, to know which devices could be vulnerable.

While this exploit will probably be pretty rarely exploited, the safest bet, if you’re concerned, would be to move to a Bluetooth mouse and/or keyboard.

Reply

gravatar

Good Point About the Older Mice and Keyboards

From RMN on March 08, 2016 :: 7:18 pm

You are absolutely correct about the older technology not being as secure as newer technology—one only needs to compare Windows 10 with XP and Vista, or the older WiFi security standards to the new standards.  Based on this article, I give kudos to Logitech, Lenovo and Dell for making a firmware update available or at least working on one.  Hopefully the companies whose products cannot be upgraded will remind users to responsibly recycle their products rather than throwing them in the trash and thereby create more hazardous electronic waste.

Reply

Download question

From Jim Caulk on March 10, 2016 :: 5:33 pm

I downloaded the Unifier file, opened it, clicked on Advanced, the choices on the right side were “unpair device” and “update firmware”. The update link wasn’t highlighted. So I clicked down below where it says update.

Just wondering if that will work for the update?

Reply

gravatar

Here Is What Worked For Me

From RMN on March 10, 2016 :: 8:37 pm

1.  Plug in your Logitech Keyboard (KB) and/or Mouse and turn them on.
2.  Download and install from the Logitech site via the link in the article the Setpoint (for PC) and the Options (only if you are using the KB and mouse with a tablet or smartphone) software.
3.  Use the link in the article to connect with the Logitech site and download and install the Unifying software
4.  Open the Unifying software and in the left pane click on the Unifying Receiver.
5.  This will bring up in the right pane the version number of the firmware of the Unifying receiver you have plugged into your receiver.
6. From the Logitech site:  “The version of the firmware is listed in the right pane.
•If the firmware version is in 012.xxx.000xx format, download and save RQR_012_005_00028.exe through the following link: http://logt.ly/0222
•If the firmware version is in 024.xxx.000xx format, download and save RQR_024_003_00027.exe through the following link: http://logt.ly/0224”
7. Run the appropriate downloaded firmware package.
8.  Reopen the Unifying software (if it closed during the above activity), click on the Advanced tab, and again click on Unifying Receiver in the left pane.
9.  In the right pane, click on Update Firmware and wait until the firmware update is complete.
10 Close and reopen the Unifying software, click on the Unifying Receiver in the left pane, then verify the version number is the updated version in the right pan.

REMINDER:  this is only for Logitech devices!  Hope this helps!  grin

Reply

gravatar

URL of Logitech Site from Above Article

From RMN on March 10, 2016 :: 8:55 pm

For those with aggressive security software that restricts or blocks clicking on links in Internet articles, I have copied the URL of the link to the Logitech site from the above article so you can cut and paste it into your browser:

https://forums.logitech.com/t5/Mice-and-Pointing-Devices/Logitech-Response-to-Unifying-Receiver-Research-Findings/m-p/1493878/thread-id/73186

Reply

Nope, not working

From Jim Caulk on March 10, 2016 :: 10:41 pm

The right pane says my firmware is:
040.001.00017
And the update firmware button is not
highlighted.

Reply

gravatar

Your Firmware Version Does Not Appear to be One Requiring an Update

From RMN on March 11, 2016 :: 4:04 pm

Jim,

As your receiver firmware version is not/not one of the two listed in the Logitech article, it most likely (a) is not/not impacted by the security issue, (b) does not need to be updated or (c) cannot be updated.  At this point we have no way of knowing which one of the three options is correct.  In any event, Logitech appears to be only updating two specific Unifying receiver firmware versions, and your firmware version does not appear among the two listed in the Logitech article as having an update available.

Reply

gravatar

Microsoft mice

From Jay on April 22, 2016 :: 11:45 am

How does this affect Microsoft mice? Does Microsoft have a patch?

Reply

gravatar

Microsoft Mice--Patch Released

From RMN on April 22, 2016 :: 4:27 pm

Microsoft released MS security advisory 3152550 on 12 April as an optional windows Update for certain of its input devices.  See the update for details.

Reply

gravatar

Microsoft Mice--Security Patch Information

From RMN on April 22, 2016 :: 4:53 pm

Jay,

Here is the link to the Microsoft Security Advisory I mentioned in my earlier reply.  It has lots of details in it as well as the list of mice it covers. 

Cut and paste the link below into your browser to read the advisory.

https://technet.microsoft.com/en-us/library/security/3152550

You should be able to download the patch for your system directly by going to the optional updates via Windows Update and using the advisory number above to find the right update and then download and install it.

Reply

gravatar

Firmware no longer available.

From BobInSCal on September 01, 2016 :: 10:40 pm

The firmware appears to be no longer available on the forum website, nor through the internet archive (forum restructured?). If most folks are like me, you won’t run software downloaded from the shortened URL from RMN (though it does download a file with an .exe extension).

Reply

gravatar

Firmware no longer available.

From BobInSCal on September 01, 2016 :: 10:42 pm

Arrrgh. No edit button. For what it’s worth the shortened URL expands to: http://aws13-customer-care-assets.s3.amazonaws.com/Software/RQR_012_005_00028.exe

Reply

gravatar

Mousejacking Update

From RMN on September 02, 2016 :: 12:03 am

Regret I do not have full internet access where I am at present and will likely lose it over the next day or so due to an approaching hurricane.  As best I remember from five months ago, the Microsoft solution was to update their products through their Mouse and Keyboard application via Windows Update, whereas Logitech chose to upgrade the unifying firmware in their unifying receiver.  You should be able to update the Logitech products through the update program in the Logitech App or their version of the mouse and keyboard center already installed on your device.  For Microsoft, any Mouse and Keyboard Center updates your PC/laptop/tablet downloads from Microsoft will automatically install the security update for those mouse and keyboard products that Microsoft has chosen to update against this reported threat.  I really have not seen any significant reporting on the mousejacking issue since this all first came out this past winter.

Reply

gravatar

Mousejacking Update

From BobInSCal on September 02, 2016 :: 12:16 am

If you’re on Windows, you can certainly (probably) update the firmware via Logitech’s software. My interest in locating the official firmware was in being able to restore it after I “play” with Marc Newlin’s microjack software on a Linux machine (which uploads its own firmware to the unifying receiver).

© 2015 Techlicious LLC. Home | About | Meet the Team | Sponsorship Opportunities | Newsletter Archive | Contact Us | Terms of Use | Privacy Policy

site design: Juxtaprose