Input Hijacking
Attackers can do more than
just steal data being transmitted over wireless links. Many devices and software
services accept input from the user to take action. This command channel can be
hijacked, allowing the attacker to interact with sensitive applications they
should not have access to.
Using a wireless input device such as a keyboard can allow
passwords and credit card information to be intercepted. Hijacking the
connection and taking control of the input may be possible as well, allowing the
attacker to input arbitrary data, change passwords on online bank account
interfaces, purchase a thousand bags of composting material to be delivered to
your door, or send letters of resignation to your employer.
Popular wireless keyboard receivers can pick up transmissions from
a different keyboard. If the communications travel over radio links instead of
infrared, an attacker can sit down nearby and associate with the receiver using
the same make and model of keyboard. In many cases, hijacking the mouse can be
done through the same receiver as well.
In order to use such devices safely, you must gain a basic
understanding of radio emission characteristics in order to assess the risk of
using such devices for sensitive data. Chapter 2 will cover the nature of
radio emissions to allow you to evaluate the risks of data interception and
command channel hijacks in more detail.
Sections
