CHERRY B.UNLIMITED AES JD-0400EU-2/01 Crypto Issues / Replay Attacks

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512  
  
Advisory ID: SYSS-2016-031  
Product: CHERRY B.UNLIMITED AES  
Manufacturer: Cherry GmbH  
Affected Version(s): JD-0400EU-2/01  
Tested Version(s): JD-0400EU-2/01  
Vulnerability Type: Cryptographic Issues (CWE-310)  
Missing Protection against Replay Attacks  
Risk Level: Medium  
Solution Status: Open  
Manufacturer Notification: 2016-04-11  
Solution Date: -  
Public Disclosure: 2016-06-29  
CVE Reference: Not yet assigned  
Authors of Advisory: Matthias Deeg and Gerhard Klostermeier (SySS GmbH)  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Overview:  
  
CHERRY B.UNLIMITED AES is a wireless desktop set consisting of a  
mouse and a keyboard.  
  
The manufacturer describes the product as follows (see [1]):  
  
"CHERRY B. UNLIMITED AES combines secure data transmission and an  
advanced energy supply in a design which has been thought through to the  
very last detail. For high professional requirements and security both  
at home and in the workplace."  
  
Some of the key benefits of CHERRY B.UNLIMITED AES are (see [2]):  
  
* Data transmission using 128-bit encryption, complying to Advanced   
Encryption Standard (AES)  
* USB cable charging function for both keyboard & mouse - even when in  
use  
* High-quality, pre-charged NiMH batteries from GP with a very low  
self-discharge  
* Almost interference-free wireless 2.4 GHz technology (range of up to  
10 metres)  
* 3-button mouse: infrared sensor and adjustable resolution  
(1,000/2,000 dpi) with ergonomic side panels  
* Multi-station capability operation of several wireless products in  
one room  
* Easy to install, requiring no technical knowledge  
* Mini USB receiver  
* Keyboard awarded the "Blauer Engel" environmental seal  
  
Due to an insecure implementation of the encrypted data communication,  
the wireless keyboard CHERRY B.UNLIMITED AES is prone to replay attacks.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Vulnerability Details:  
  
The SySS GmbH found out that the wireless keyboard CHERRY B.UNLIMITED  
AES is prone to replay attacks.  
  
An attacker can sniff the AES-encrypted data packets of the 2.4 GHz  
radio communication sent by the keyboard to the receiver (USB dongle)  
and replay the recorded communication data at will causing the same  
effect as the original data communication.  
  
A replay attack against the keyboard can, for example, be used to gain  
unauthorized access to a computer system that is operated with a  
vulnerable CHERRY B.UNLIMITED AES keyboard. In this attack scenario, an  
attacker records the radio communication during a password-based user  
authentication of his or her victim, for instance during a login to the  
operating system or during unlocking a screen lock. At an opportune  
moment when the victim's computer system is unattended, the attacker  
approaches the victim's computer and replays the previously recorded  
AES-encrypted data communication for the password-based user  
authentication and by this gets unauthorized access to the victim's  
system.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Proof of Concept (PoC):  
  
The SySS GmbH could successfully perform a replay attack as described  
in the previous section using a software-defined radio.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Solution:  
  
According to information from the manufacturer Cherry GmbH, the reported  
security issue will currently not be fixed in affected products.  
  
The written statement in German from Cherry GmbH regarding this and other  
reported security issues is as follows:  
  
"Nach Prufung der von Ihnen festgestellten 'Sicherheitsschwachstellen'  
haben wir uns dazu entschlossen, die AES Verschlusselung bis auf weiters  
nicht weiter mit den Produkt zu promoten. Derzeit arbeiten wir an einem  
Nachfolgeprodukt. Wie bisher, empfehlen wir Kunden mit hohen  
Sicherheitsanfordungen ein kabelgebundenes Produkt zu verwenden.  
Je nach Anforderung, auch mit CC-Zertifizierung."  
  
The English translation of this statement is:  
  
"We have examined the 'security flaws' you reported to us. As a result,  
we decided, until further notice, to no longer refer to AES encryption  
in order to promote the affected product. At the moment, we are  
currently working on a successor product. As we already did in the past,  
we recommend to our customers having particularly high security demands  
using wired products which, depending on the requirements, should be   
CC certified."  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Disclosure Timeline:  
  
2016-04-11: Vulnerability reported to manufacturer  
2016-04-12: Manufacturer acknowledges e-mail with SySS security advisory  
2016-05-24: Response from manufacturer with information about  
the reported security issue and rescheduling of the  
publication date in agreement with the manufacturer  
2016-07-04: Received written statement from manufacturer concerning the  
reported security issue  
2016-07-29: Public release of the security advisory  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
References:  
  
[1] Data sheet for CHERRY B.UNLIMITED AES  
http://cherry.de/PDF/EN_CHERRY_B_UNLIMITED_AES.pdf  
[2] Product website for CHERRY B.UNLIMITED AES  
http://cherry.de/cid/wireless_keyboards_CHERRY_B_UNLIMITED_AES.htm?rdeLocaleAttr=en&WT.mc_id=  
[3] SySS Security Advisory SYSS-2016-031  
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2016-031.txt  
[4] SySS Responsible Disclosure Policy  
https://www.syss.de/en/responsible-disclosure-policy/  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Credits:  
  
This security vulnerability was found by Matthias Deeg and Gerhard  
Klostermeier of the SySS GmbH.  
  
E-Mail: matthias.deeg (at) syss.de  
Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Matthias_Deeg.asc  
Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB  
  
E-Mail: gerhard.klostermeier (at) syss.de  
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Gerhard_Klostermeier.asc  
Key fingerprint = 8A9E 75CC D510 4FF6 8DB5 CC30 3802 3AAB 573E B2E7  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Disclaimer:  
  
The information provided in this security advisory is provided "as is"   
and without warranty of any kind. Details of this security advisory may   
be updated in order to provide as accurate information as possible. The  
latest version of this security advisory is available on the SySS Web   
site.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Copyright:  
  
Creative Commons - Attribution (by) - Version 3.0  
URL: http://creativecommons.org/licenses/by/3.0/deed.en  
  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v2  
  
iQIcBAEBCgAGBQJXmxnjAAoJENmkv2o0rU2rW48QAKGdpX0rOt7EGa0naxGWA6UQ  
sucDvRFhsB+RG1LR2FuqP4d7xUbIsKDm4mpnlBQA6pA+3+ZzeBDuTx31Na1/Alui  
lp54Z48+tRkC70pnvPJH7P7GrR1RT/3dlt6ypeCv7pA7SKfzvalLL1KnQ624UmZ0  
Ta8D0I0TMGI8Z5yamsineT1WHRqSgnxE1tNtl2FEjrkXFRDRB+OrxSVUt/26G1zJ  
LT1JzD+G+xjwAr5WJUO2P2dnEI+N6FlrgqaFJKH3KuAUKNcPtnY41hyp7RqL5VXa  
j6AZKFLQqRhZ4MrfR3NudQmaN8ksS0F0sBwsNFBZ6JyLhd+IwxBPR2WuNXKBgZ8X  
Rn+/TLIkhV6PXYwq9jhqok1wFEMLjMPDCjnDMBXMaHO1XwvfV8Sugg+5QrhE+4US  
65afUq6UgWdWahwRbfpv71HGv0GWsjLISycS3unfLdNYtIeS0GCDEyZxq1PTioI1  
tT/510oWY/5Bz7OdOkirMrpP2XHeWjQQSOz/LTxtwbInjC5/gHBgHwoxui8YzxI1  
4IushgdjPG/G9gYWclRx6VcLPrexDy3szXEuDX6LeVePt2+ybayL0WEKRw3+HNey  
32r3g4fMwRKlb+90hI+YzLYEforapVh5jgZRR1TKuOvUkCghY98os8dOhT+C2lgK  
Fs7Qn4mKZe/iD2vYlgqP  
=rRuZ  
-----END PGP SIGNATURE-----  
`