0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Logitech R700 Laser Presentation Remote Keystroke Injection Vulnerability
Author
Risk
[
Security Risk High
]0day-ID
Category
Date add
CVE
Platform
Product: R700 Laser Presentation Remote Manufacturer: Logitech Affected Version(s): Model R-R0010 (PID WD904XM and PID WD802XM) Tested Version(s): Model R-R0010 (PID WD904XM and PID WD802XM) Vulnerability Type: Insufficient Verification of Data Authenticity (CWE-345) Keystroke Injection Vulnerability Risk Level: High Solution Status: Open Manufacturer Notification: 2019-04-12 Solution Date: - Public Disclosure: 2019-06-04 CVE Reference: CVE-2019-12506 Author of Advisory: Matthias Deeg (SySS GmbH) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: Logitech R700 Laser Presentation Remote is a wireless presenter using 2.4 GHz radio communication. The manufacturer describes the product as follows [1]: "Brilliant red laser pointer helps you get their attention - and keep it." Due to unencrypted and unauthenticated data communication, the wireless presenter Logitech R700 Laser Presentation Remote is prone to keystroke injection attacks. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: SySS GmbH found out that the wireless presenter Logitech R700 Laser Presentation Remote is vulnerable to keystroke injection attacks. An attacker can analyze the unencrypted and unauthenticated data packets of the 2.4 GHz radio communication sent by the wireless presenter to the receiver (USB dongle) in order to learn the used protocol. By knowing the used data protocol, it is possible to inject packets in the data communication that are actually interpreted as keystrokes by the receiver on the target system. Thus, an attacker is able to send arbitrary keystrokes to a victim's computer system, for example in order to install malware when the target system is unattended. In this way, an attacker can remotely take control over the victim's computer that is operated with an affected receiver of a Logitech R700 wireless presenter. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): SySS GmbH could successfully perform keystroke injection attacks against the wireless presenter Logitech R700 Laser Presentation Remote using an in-house developed software tool in combination with the USB radio dongle Crazyradio PA and the nrf-research-firmware by Bastille Networks Internet Security [2, 3]. The following output of the developed proof-of-concept software tool illustrates a successful attack: # python2 logitech_presenter.py -a 7F:20:9E:C2:07 _____ ______ ___ _ _ _____ _ _ | __ \| ____|__ \| || | | __ \| | | | _ __ | |__) | |__ ) | || |_ | |__) | | __ _ _ _ ___ ___| |_ | '_ \| _ /| __| / /|__ _| | ___/| |/ _` | | | / __|/ _ \ __| | | | | | \ \| | / /_ | | | | | | (_| | |_| \__ \ __/ |_ |_| |_|_| \_\_| |____| |_| |_| |_|\__,_|\__, |___/\___|\__| __/ | |___/ Logitech Wireless Presenter Attack Tool v1.0 by Matthias Deeg - SySS GmbH (c) 2016 [*] Configure nRF24 radio [*] Actively searching for address 07:C2:9E:20:7F [*] Ping success on channel 8 [*] Ping success on channel 8 [*] Press <CTRL+C> to start keystroke injection ^C [*] Start keystroke injection ... [*] Done. This demonstrated keystroke injection attack also worked in 2016 against the wireless presenter Logitech R400, which is described in the SySS security advisory SYSS-2016-074 [4]. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: SySS GmbH is not aware of a solution for this reported security vulnerability. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2019-04-12: Vulnerability reported to manufacturer 2019-06-04: Public release of security advisory # 0day.today [2024-12-25] #