CHERRY B.UNLIMITED AES JD-0400EU-2/01 Insufficient Protections

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512  
  
Advisory ID: SYSS-2016-032  
Product: CHERRY B.UNLIMITED AES  
Manufacturer: Cherry GmbH  
Affected Version(s): JD-0400EU-2/01  
Tested Version(s): JD-0400EU-2/01  
Vulnerability Type: Insufficient Protection of Code (Firmware) and   
Data (Cryptographic Key)  
Risk Level: Medium  
Solution Status: Open  
Manufacturer Notification: 2016-04-22  
Solution Date: -  
Public Disclosure: 2016-07-29  
CVE Reference: Not yet assigned  
Authors of Advisory: Gerhard Klostermeier and Matthias Deeg (SySS GmbH)  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Overview:  
  
CHERRY B.UNLIMITED AES is a wireless desktop set consisting of a  
mouse and a keyboard.  
  
The manufacturer describes the product as follows (see [1]):  
  
"CHERRY B. UNLIMITED AES combines secure data transmission and an  
advanced energy supply in a design which has been thought through to the  
very last detail. For high professional requirements and security both  
at home and in the workplace."  
  
Some of the key benefits of CHERRY B.UNLIMITED AES are (see [2]):  
  
* Data transmission using 128-bit encryption, complying to Advanced   
Encryption Standard (AES)  
* USB cable charging function for both keyboard & mouse - even when in  
use  
* High-quality, pre-charged NiMH batteries from GP with a very low  
self-discharge  
* Almost interference-free wireless 2.4 GHz technology (range of up to  
10 metres)  
* 3-button mouse: infrared sensor and adjustable resolution  
(1,000/2,000 dpi) with ergonomic side panels  
* Multi-station capability operation of several wireless products in  
one room  
* Easy to install, requiring no technical knowledge  
* Mini USB receiver  
* Keyboard awarded the "Blauer Engel" environmental seal  
  
Due to the insufficient protection of the flash memory of the keyboard  
and of the USB dongle, an attacker with physical access has read and  
write access to the firmware and the used cryptographic key.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Vulnerability Details:  
  
The SySS GmbH found out that the embedded flash memory of the wireless  
keyboard CHERRY B.UNLIMITED AES and of the corresponding USB dongle can  
be read and written via the SPI interface of the used transceivers with  
an embedded microcontroller nRF24LE1 (keyboard) and nRF24LU1+ (USB   
dongle) as the flash memory is not protected by the offered read back  
protection feature (RDISMB - Read DISable Main Block).  
  
Thus, an attacker with physical access to the keyboard or the USB dongle  
can simply read and write the SPI-addressable code and data flash  
memory.  
  
By writing a custom-made firmware to the code flash memory, an attacker  
can also gain access to all contents of the extended endurance flash  
memory of the CHERRY B.UNLIMITED AES keyboard that is not directly  
accessible via the SPI interface and where the AES cryptographic key  
is stored.  
  
Concerning the USB dongle, all data flash memory is accessible via  
the SPI interface. Thus, no custom-made firmware is required to extract  
the AES cryptographic key from the USB dongle.  
  
By having read and write access to the code and data flash memory, an  
attacker can either extract the cryptographic key, for instance to  
perform further attacks against the wireless communication, or modify  
the firmware or the cryptographic key.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Proof of Concept (PoC):  
  
The SySS GmbH could successfully read the contents of the code and data  
flash memory of the CHERRY B.UNLIMITED AES keyboard and of the USB  
dongle using the hardware tool Bus Pirate [3] in combination with the  
software tool nrfprog [4].  
  
For accessing the AES cryptographic key stored in the extended endurance  
flash memory, the SySS GmbH developed a small firmware for copying  
the contents of this memory area to the SPI-addressable flash memory  
from were it could simply be dumped via the SPI interface.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Solution:  
  
According to information from the manufacturer Cherry GmbH, the reported  
security issue will currently not be fixed in affected products.  
  
The written statement in German from Cherry GmbH regarding this and other  
reported security issues is:  
  
"Nach Prufung der von Ihnen festgestellten 'Sicherheitsschwachstellen'  
haben wir uns dazu entschlossen, die AES Verschlusselung bis auf weiters  
nicht weiter mit den Produkt zu promoten. Derzeit arbeiten wir an einem  
Nachfolgeprodukt. Wie bisher, empfehlen wir Kunden mit hohen  
Sicherheitsanfordungen ein kabelgebundenes Produkt zu verwenden.  
Je nach Anforderung, auch mit CC-Zertifizierung."  
  
The English translation of this statement is:  
  
"We have examined the 'security flaws' you reported to us. As a result,  
we decided, until further notice, to no longer refer to AES encryption  
in order to promote the affected product. At the moment, we are  
currently working on a successor product. As we already did in the past,  
we recommend to our customers having particularly high security demands  
using wired products which, depending on the requirements, should be   
CC certified."  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Disclosure Timeline:  
  
2016-04-22: Vulnerability reported to manufacturer  
2016-05-24: Response from manufacturer with information about  
the reported security issue and rescheduling of the  
publication date in agreement with the manufacturer  
2016-07-04: Received written statement from manufacturer concerning the  
reported security issue  
2016-07-29: Public release of the security advisory  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
References:  
  
[1] Data sheet for CHERRY B.UNLIMITED AES  
http://cherry.de/PDF/EN_CHERRY_B_UNLIMITED_AES.pdf  
[2] Product website for CHERRY B.UNLIMITED AES  
http://cherry.de/cid/wireless_keyboards_CHERRY_B_UNLIMITED_AES.htm?rdeLocaleAttr=en&WT.mc_id=  
[3] Website of Bus Pirate hardware tool  
http://dangerousprototypes.com/docs/Bus_Pirate  
[4] nrfprog Github repository  
https://github.com/nekromant/nrfprog  
[5] SySS Security Advisory SYSS-2016-032  
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2016-032.txt  
[6] SySS Responsible Disclosure Policy  
https://www.syss.de/en/responsible-disclosure-policy/  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Credits:  
  
This security vulnerability was found by Gerhard Klostermeier and  
Matthias Deeg of the SySS GmbH.  
  
E-Mail: gerhard.klostermeier (at) syss.de  
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Gerhard_Klostermeier.asc  
Key fingerprint = 8A9E 75CC D510 4FF6 8DB5 CC30 3802 3AAB 573E B2E7  
  
E-Mail: matthias.deeg (at) syss.de  
Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Matthias_Deeg.asc  
Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Disclaimer:  
  
The information provided in this security advisory is provided "as is"   
and without warranty of any kind. Details of this security advisory may   
be updated in order to provide as accurate information as possible. The  
latest version of this security advisory is available on the SySS Web   
site.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Copyright:  
  
Creative Commons - Attribution (by) - Version 3.0  
URL: http://creativecommons.org/licenses/by/3.0/deed.en  
  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v2  
  
iQIcBAEBCgAGBQJXmxoGAAoJENmkv2o0rU2r8AkQAIZmeRn3i7P5XwBPDJxB4iLC  
gSR8dAY/MVztzAQ6PkZAjIbEPdS5yuXoCoPs1w/3UIRlPY/2X3whobyh9HuXpBbG  
C56nr6sa+tyGdTJfCAIVIDDkkMXPC0cI38aA0g6S3wii6JZe4HERwN0Kkw8MXsl8  
XsBFK+LiIeHqAhtzor4MjzSWorEuVVYYk6LrDPXc3XWB0izdYwn3PJXoXtJzL7vS  
+xsoR4uhfXhsPkwILcYdrEaOBHYOezrBqEE3vsRcmXNhUKmY+6+UMfezYX2Oo9Eh  
yeFjmMQ2AaEroMQIdIgCNF9BNdW0WwuAXX3Zl32EkFDlCP1tRS7oaAvwUWt2gZf/  
oKu0Du9VZgDCCCqHn4fQV1SKm9nvFQa06BatYBrYoF90ZLeaoBfQ5i0QzhSGcFn2  
SZQ08in9A4yYCwgTr4IfJ3iC+th56FIbWidAqdBxWW5De5kUiLViHLxGdQRc0qHQ  
eSvpze8katJzHm3GMf+xLRBWY8hJuv5jCf2N3M0UBIKrnmVbdP2+RrNjPITg0tco  
qXejiyahHlDJeAiy1LaiyDJiqH6Yv5Ttf0zfDAScjPdbl0eNBT1jmWgBvog/oOyz  
y3xpEWt1cmCScOrHs2gvThWIJ3clwwpV4Vi+CyvS4UFc+2qP7zS7hbY26Smwfkdy  
w1WUGdWFuJS0FqIrH40F  
=rWBu  
-----END PGP SIGNATURE-----  
`