{"id":50140,"date":"2016-05-31T16:11:02","date_gmt":"2016-05-31T23:11:02","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=50140"},"modified":"2025-08-27T01:14:01","modified_gmt":"2025-08-27T08:14:01","slug":"keysweeper-keylogger-threat","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/keysweeper-keylogger-threat\/","title":{"rendered":"Meet KeySweeper, the Stealthy Hardware Recording Your Keystrokes"},"content":{"rendered":"

If there\u2019s one reason why classic James Bond films are so widely enjoyed, it\u2019s because of the unbeatable gadgets. From complex and indescribable to common and crafty, Bond gadgets always capture the audience\u2019s imagination. In fact, some Bond gadgets were so powerful in concept that they became real<\/a>, everyday objects. Fingerprint readers and cameras are embedded into our phones, we can lock and unlock remote-controlled doors, and leveraging GPS location technology is daily occurrence. They\u2019re all common, and have become everyday technologies.<\/p>\n

This is why KeySweeper is so unsettling<\/a>. KeySweeper is a $10 proof-of-concept<\/a> spying tool that\u2019s simple, clever and very Bondish; it\u2019s a keylogging device<\/a> disguised as a USB charger (the kind of charger you plug into an outlet to charge your phone). The device intercepts and decrypts signals sent from wireless keyboards, allowing it to record usernames, passwords and a bevy of personal data over a cellular connection.<\/p>\n

So, whether you\u2019re using a wireless keyboard in your office, or a hotel room, watch out: all a cybercriminal has to do is plug the tool into a strategic AC outlet and wait.<\/p>\n

Like I said, it\u2019s a very Bond-esque device, which is why the FBI is so concerned<\/a>. In late April, FBI officials issued a private industry notification<\/a> about the threat to businesses. The notification broke down what KeySweeper is, what KeySweeper objects could look like and how organizations can avoid falling into this particular keylogger trap.<\/p>\n

Thankfully, KeySweeper has a few limitations working against it. First, it has to be near its target in order to pick up on the wireless keyboard\u2019s signals. Second, it\u2019s limited to wireless keyboards made before 2011 (some encryption standards have changed since then). Finally, it needs to be powered to work \u2014\u00a0meaning that unplugging strange devices and unknown chargers could kill the attack.<\/p>\n

That last limitation, however, can be easily overcome. KeySweeper devices can be augmented with a small battery that allows it to run even when it\u2019s unplugged, which means it could steal signals for hours without a power source.<\/p>\n

So, if you happen to notice a device like the below plugged into an outlet near you, and you\u2019re using a wireless keyboard, take heed\u2014it could be a KeySweeper attack in the works. Now, the KeySweeper program can take many forms, in addition to the below wall plug-in example. That said, it\u2019s best to be suspicious of any unfamiliar devices around you when you\u2019re typing wirelessly.<\/p>\n

\"keysweeper1\"Samy Kamkar \/ samy.pl\/keysweeper<\/em><\/p>\n

Tips to Avoid Keylogging<\/h2>\n

KeySweeper could soon be the first example of a long running battle with keylogger attacks. To protect yourself from KeySweeper and other keyloggers, follow these tips:<\/p>\n