2

I'm considering buying a Logitec M570 wireless trackball. This device uses Logitec's "Unifying" wireless technology: a single tiny USB insert supports multiple logitec devices.

This thread mentions the fact that the Unifying system uses AES128, and points to Logitec's whitepaper on this topic: see here. This document has the following very scary statement in it:

Note that the encryption keys are never transmitted over the air. By spying the packets exchanged during the pairing process, a hacker would not be able to f ind the encryption keys without knowing the secret algorithm implemented to construct them.

Secret algorithm? Is Logitec really so stupid as to use a secret proprietary algorithm for key exchange, when there are perfectly functional publicly known and tested algorithm (I'm thinking of Diffie-Hellman)? Does anyone know of:

  • Known vulnerabilities in the pairing of Logitec devices (better known than this vague statement)?
  • Any research/audit of these devices?

3 Answers 3

2

In the section of the whitepaper cited, Logitech plainly claims that

The same unique key is constructed both in the keyboard and in the receiver based on random values exchanged during the pairing process.

and

Note that the encryption keys are never transmitted over the air.

That sounds a lot like Diffie-Hellman. It would appear that the secret algorithm is used for key generation in the device and dongle, and not for key exchange. The keys themselves may or may not be weak depending on the algorithm and the source of randomness.

Note however that Bastille states that Unifying receivers are susceptible to (1) forced pairing, (2) keystroke injection, and (3) keyboards masquerading as mice. Logitech has responded with a firmware update.

Disclaimer: I am not a security expert, and I do not own a Logitech device, but I found this because I had the same kind of questions.

1

I don't have any hard facts to add, but a little speculation never hurt anyone. :)

If you take Logitech's claim "without knowing the secret algorithm" at face value, then it basically means that the only thing stopping an attacker from recovering the key during pairing is knowledge of the key agreement algorithm. Anyone who manages to extract the program from a device could break its security. Now, if they truly used some well-known secure key agreement system then I believe they wouldn't add such a claim to their whitepaper.

In this Unifying Receiver teardown you can see that they're using the chip NRF24LU1P, which leads to a specification by NordicSemi. It's a SoC with a 16 MHz 8-bit CPU. It has built-in AES128 support, but no other crypto. There is a 32-bit multiply unit, which helps with asymmetric cryptography, but I've seen more powerful 32-bit microcontrollers take many seconds to compute a 1536-bit Diffie-Hellman handshake (minimum that's considered secure today), so that's ruled out. It might not exclude something like Curve25519, however.

Fortunately pairing is something users do quite rarely, which limits exposire to opportunistic attackers quite a bit.

1
  • Sounds like some hard facts to me, if not the absolutely positively conclusive ones we all want...
    – stochastic
    Nov 30, 2016 at 14:37
-1

Okay, I'm a bit late to answer the initial question.

Anyways, yes, the "secret algorithm" is a problem.

Here's a link to a tweet, which summarizes some new issues:

  • PoC 1: Sniff pairing on RF, derive keys and decrypt RF traffic to Unifying dongle (initial question)
  • PoC 2: Attack on encryption itself, injects encrypted keystrokes without knowledge of keys (not a problem in key exchange, but bad AES implementation)
  • PoC3: Dump all keys from Unifying dongle and decrypt everything
  • final demo: misuse a Unifying dongle as RF relay for a remote shell (covert channel, connected devices still work)

https://twitter.com/mame82/status/1100833910701912065?s=19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .