Skip to main content

Mac > News

Wed, 05 Aug 2009 Apple keyboard firmware vulnerability demonstrated

This is no less serious a vulnerability than the iPhone SMS exploit

Dan Moren Macworld.com

  • Email to a friend
  • Print this article
  • Bookmark this page
  • RSS feed

Apple may have rolled out a security patch for the iPhone SMS vulnerability demonstrated at last week’s Black Hat security conference, but it wasn’t the only Apple device under attack.

One hacker demonstrated a way that a keylogging application - a piece of malware that keeps track of what you type - could be installed in the firmware of Apple’s keyboards.

As it turns out, Apple’s keyboards (both the laptop and external USB versions) include both a small amount of RAM and flash memory - plenty of room to run a simple keylogging program.

And because Apple’s keyboard firmware updater is apparently unencrypted and doesn’t need to be validated, it’s not very difficult for such an exploit to be injected into a seemingly innocuous program.

Once the keylogger’s in the keyboard firmware, it’s virtually undetectable by the usual malware-scanning tools - after all, it’s not on your hard drive. The exploit's creator demonstrated how it could be used to easily retrieve passwords entered by a user.

This is no less serious a vulnerability than the iPhone SMS exploit, even if it isn’t quite as prominent as a flaw involving Apple’s hottest new device. You can read the full paper or view the presentation slides at the Black Hat site.

Check out our new Macworld Mobile site.

Follow Macworld UK on twitter: www.twitter.com/macworlduk

Email A Friend

Email this article to a friend or colleague:



PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

<<prev article | back to news index | next article>>

Question of the day!

Mark Hattersley
Editor in Chief

Do you share your creations online?

Question of the day!

Do you share your creations online?

% of Macworld readers agree with you

Yes
TBC
No
TBC

What do you create and how do you share it?

124 characters remaining

Follow the conversation at @TabletChat

paintings & illustrations, mostly, which i upload to flickr.RT @fragmentedm

I draw manga/anime characters. I also do graphic design and photography.RT @spialelo

Yes. I usually put them up on my #deviantart account for feedback on how to improve.RT @spialelo

Comments received


RealityCheck said on Wed, 05 Aug 2009

Hope they patch this quicker than they did Java.

"even if it isn’t quite as prominent as a flaw invovling Apple’s hottest new device" - can't you just be journalists without brown noses for once?

Slinky said on Wed, 05 Aug 2009

I think they were trying to point out that this was as serious a flaw as the iPhone one; even if it was getting less coverage than that because the iPhone is the hotter device.

Between that and the RealityCheck tag you do just come across as a troll y'know. Maybe think (or read carefully) before posting next time. Just a thought.

dig said on Wed, 05 Aug 2009

this is overhyped bull. i'd love to see one of these guys try to make this hack happen in the real world.

@dig said on Wed, 05 Aug 2009

A fully patched Mac was hacked in seconds earlier this year, sure it is not that hard. The question is - why bother?

Disclaimer
Opinions expressed here are those of the writers and do not reflect those of Macworld. Macworld accepts no responsibility legal or otherwise for their accuracy of content.
Click here to read the house rules.

Click here for the latest reader comments

Latest News


More news...