KeySweeper - covert Microsoft wireless keyboard sniffer using Arduino and nRF24L01+

[@maheshpadmanabh6564]

You are among the very few people who explain things properly. Great video!

[@samykamkar]

+Mahesh Padmanabh Thanks!

[@samykamkar]

tblb1, I couldn't respond to your comment directly due to permissions on your account, however you're right, sorry, I forgot to mention in the video! The way to prevent this attack is to not use wireless keyboards. Use wired keyboards for communications you wish to keep (more) secure.

[@rockhopper123452]

Hi sammy, Nice video. I see you use alot of programming in some of your tutorials and I was woundering where you learn them. At the time, I only know c# but any other language is a bit difficult.

[@samykamkar]

rockhopper123452 Thanks! Simply start with some basic tutorials. I learned everything online, there are so many amazing resources -- and I've learned a lot with trial and error (more error than trial). Be persistent, try different things, and follow areas you think are interesting!

[@felixautomaton5314]

I don't like wireless mice and keyboards, and I especially hate ones with proprietary protocols. Somewhere inside the company, some manager will probably have made the call to skip real security to cut their development and QA time.

[@mattgsm]

Samy Kamkar what is the name of the intro? song

[@kol2456]

He doesn't just explain things properly. He explains every "bit" (hah) of information involved in whatever he's talking about. Also, love that it looks like a charger adapter. So great

[@samykamkar]

Hi Beshr Al Nahas, I couldn't reply directly to your comment due to your account settings, but regarding programming the nRF chip instead of needing an Arduino, you would *not* be able to do with an nRF24L01+ as it's only an RF chip and lacks an MCU and memory. You could program the nRF24LE1 (the SoC with MCU+RF chip), but unfortunately the programmer costs significantly more than an Arduino, and many of these videos I'll opt for more readily available hardware to allow more users to follow along. Thanks for commenting!

[@TruthVybesTv]

i need to know more about this device.. can it be fitted in an old nokia phone?

[@RuiSantosdotme]

Awesome project as usual, thanks for taking the time to document your projects. I'm looking forward to the next one!

[@samykamkar]

Thanks Rui Santos, me too!

[@iczyg]

That was really interesting how it all fits together. I don't have the time to try this all out, but it's really great that you provide all the source code along with pictures! Solid video & explanation as well.

[@samykamkar]

Thanks Simon Ho!

[@samykamkar]

Thanks Jay Bee!

[@samykamkar]

Hi austin turney, I couldn't respond to your comment directly as your privacy settings don't allow me to (see this to fix: kzbin.info/www/bejne/b3vWpYuFpZWdoNE) To answer your question, to perform this on an Apple keyboard would be an entirely different attack as Apple keyboards use bluetooth rather than the proprietary protocol used here.

[@Brownkevin7]

Did you go to school for electrical engineering?

[@samykamkar]

Brownkevin7 Hi, no, I did not go to school (I dropped out of high school). I learned most of the hardware stuff from the Internet the past year or two.

[@Brownkevin7]

Samy Kamkar Really , No school? Im in school for computer science and kinda sad at the lack of electronics in it but love the programming. Ive been trying to teach myself but it seems like a lot of dedication. Any advice? thanks for the reply you seem like a brilliant person.

[@samykamkar]

Brownkevin7 Cool! Programming is how I started in all of this too, and I only got into hardware recently with some basic Arduino stuff. The learning gap is actually very small, and fortunately it's getting smaller every day -- the cool thing is you can actually use your CS/programming skillZ for hardware using tools like Arduino, Teensy, Raspberry Pi, Beaglebone, etc. Plenty of tutorials out there on getting started, I'd suggest pick up a fun weekend project!

[@Brownkevin7]

Samy Kamkar True! Any advice on a good book for learning electrical conversions like ohms and stuff like that, thats the only part im iffy on and like wiring and designing how id want to wire something, but thanks for the advice and reply i appreciate it you make dope videos and all of them will be getting likes and recommendation to people from me thanks again take care.

[@Sidner77]

Just have to say I had never heard of you before, but I had heard of your work (the MySpace worm and the drone hacking, to be more precise). I really appreciate all the work you have been doing. It had been a while since I've actually heard of the "Samy Worm", so I got to reading the posts you made in 05 about it and I still find reading the code extremely amusing! Concerning the actual videos you have began to post, just gotta say they are really good. The way you present things and the way you speak make it extremely clear to understand what you're talking about. Please, do continue with the excellent work that you've been doing thus far. I think it can only get better and I eagerly await the next video. :)

[@samykamkar]

Thanks so much Pedro Cunha!

[@1234rghji]

I'm very far from being a tech brain, but this was just one of the best video I saw on youtube. And you are the best for learning this amount of knowledge by yourself (from what I understood from comments). Good stuff!

[@samykamkar]

1234rghji Thanks!

[@redsafi1984]

Samy you've done an awesome job presenting. I'm impressed, usually us nerds have a hard time articulating ideas.

[@samykamkar]

Redwan Safi Thanks! Fortunately I re-recorded it 283 times until it sounded almost articulate!

[@amac8487]

I really wish I was into "hacking" and had the desire to go all out and do the things you do. I am blown away by what you have accomplished on your own... and your concise ability to teach others. I came across you via Tim Ferriss podcast, and must say I am highly impressed with your work. Thanks for the entertainment... as I don't necessarily plan to build these contraptions... but DAMN is it fun to listen/be introduced to.

[@samykamkar]

***** Thanks Aaron!

[@markgreen7858]

@@samykamkar can you buy one of these already built in

[@mikal_1]

Duuuuude, that XOR operation on the 0xCD is such a genius move! I hope people can appreciate how smart that is! Love it :D you're awesome!

[@samykamkar]

Thanks Mladamas!

[@Torman2242]

I wish people were more aware of how vulnerable they are when it comes to IT stuff. Your videos helps telling them. Thank you for sharing this project this us. I'm looking forward the next one!

[@samykamkar]

Torman2242 Thanks Torman! Looking forward to sharing more with you!

[@samykamkar]

Brian Gray I couldn't respond to your comment directly due to your account settings, but I did use maniacbug's original RF24 library just due to the fact that it's the most widely available. I had to use custom SPI commands to accomplish a number of things that I wanted however as it was faster than wading through the 100 forks to see which fit my needs.

[@brianwgray]

Samy Kamkar Thank you, I've been hoping that perhaps, I had not been able to get a successful lock due to grabbing the wrong library, missing a modification, etc. I've seen that some of the libraries modify the clock divisor etc. such as described in (maniacalbits.blogspot.com/2013/04/rf24-performance-improvement-wspi.html) so I thought perhaps it would be something simple that I'm doing wrong. I've added caps, additional voltage regulation boards, external highly regulated power supplies etc. so I was hoping for a revelation to get me back on track.

[@samykamkar]

Brian Gray Does it show any potentials when scanning? What kind of keyboard? Have you tried holding a key down during the scan? For the regulated supply, have you tried a 3.3v regulated supply to the nRF chip with shared ground between Arduino and nRF? I assume you tried a 10uF+ cap directly on the nRF chip between + and GND? Have you made sure the wires between the Arduino and nRF aren't too long? Are you using a legitimate nRF chip (I've seen clones, more obvious when they're chip-on-board [epoxy glob instead of an SMD chip], that aren't capable of sniffing)?

[@brianwgray]

Samy Kamkar The keyboards were purchased for this project and are the Microsoft 800 Model: 1455 described in your documentation. Matching FCCid etc. I have tested 2 separate keyboards holding shift, various other keys, and simple repetitive typing. On at least one occasion, I've seen some possibly related potential traffic while holding a key. This appears to have been a false positive every time? I've attempted several variations of supplying power. Raw from my FTDI cable, and various supply configurations from my KORAD KD3005D power supply including powering the nrf24L01+ with 3.3V + I don't recall if I've explicitly ensured a shared ground but I will configure a test of this within the next hour or so. I have added a 10uF cap to one of my nrf24L01+'s and also attempted using an addicore socket adapter board with another (www.amazon.com/gp/product/B00QOJACOA/ref=oh_aui_detailpage_o01_s00?ie=UTF8&psc=1). In addition, I have attempted testing with a Neewer® BLACK NRF24L01 + PA + LNA Wireless module (www.amazon.com/gp/product/B00H6ZO5Y4/ref=oh_aui_detailpage_o04_s00?ie=UTF8&psc=1) with similar lackluster results. None of the chips that I've been using appear to be clones that I'm aware of. I've iteratively shortened the attaching wires to where no wire is greater than 1.25" I have used both stranded and solid core 20 gauge wire over the past month. In attempt to narrow down possible issues, I've introduced additional hardware... and used an Arduino mega 2560 with various iterations of nrf chips, flash chip included, removed, etc. to see if I was simply having issues with solder joints or some other possible issue. [Intending to use the mega to interact with the mini pro via the backtrace functionality.] If I modify the code to replace if (p[4] == 0xCD) with (1) as also mentioned in these comments, I primarily receive a stream of FFFF... , with other occasional 'noise'. I similarly see streams of FFFF... when the backtrace option is enabled. Is this normal or possibly a sign of something I may be doing incorrectly, perhaps something you've seen? I don't see any connection faults, shorts, etc. I am unable to guarantee that I'm doing any of this properly. I am greatly appreciative of your quick replies and willingness to offer suggestions.

[@samykamkar]

Brian Gray Have you double checked the wiring? One thing to note is many RF24 projects use pin 10 for CSN, but I use pin 8 (since the flash chip code is fixed to pin 10 and can't change) I'm not sure about the noise you're seeing, when I get back to the hardware in a day or two I'll do some testing. My immediate guess is something isn't wired properly -- and definitely make sure anything that is connected to something else are all sharing the same ground.

[@brianwgray]

Samy Kamkar, I've gone through the wiring dozens of times. I have two others with their own hardware (in the same position as me) that have looked over my wiring. I 'think' I have the wiring done properly including the CSN switched from pin 10. The grounding was done appropriately in previous testing but I made an additional effort to make explicit ground points with the same result as previously mentioned. My next troubleshooting step will most likely be to load example nrf ping code to confirm that the hardware is functioning or not. All frustrations aside, this has been an interesting project to work with, thank you for sharing it.

[@702stormrider]

You are the tesla of this era. I'm seriously amazed, not by this product, but you as a person! Subscribed!!

[@nicknack125]

Just noticed you're the same guy who did the ding dong doorbell guide - your projects are awesome! I'm looking to build the doorbell one in the future, then expand upon it by attempting to collect or find a database of doorbell codes to cause mayhem for all. Kind of like the TV-B-Gone of ding-dong-ditching. Keep up these awesome projects - looking forward to the next!

[@samykamkar]

Thanks nicknack125!

[@DoomRater]

Bloody brilliant work. So essentially with all of this hard work we have ways to rebuild the plug funcationality and hide it anywhere we want to sniff. Or... potentially send signals to computers via robots, or any number of tasks that we might want to use this information for. Of course building a keystroke logger with enough redundancies to make my head spin seems like the most ingenious purpose I can come up with.

[@josephcalabria2976]

You are one of the greatest coders I have ever seen. You are a genius

[@samykamkar]

Thanks Joseph Calabria, hope you enjoy the vids!

[@josephcalabria2976]

Samy Kamkar I'm always waiting for another. A lot of help for a starting hacker/coder!

[@SirRaine]

You sir are amazing, I saw your combo-breaker video and you became my hero. I doubt it's possible but I would love to learn from you. Watching your videos make me geek out haha

[@MuhammadAli-1080p]

That was literally the case, massive thank you for explaining, we found similar case like this about 8 months ago, massive thank you to explain that

[@kikamonju]

you have such a scientific manner of speaking that I forget you're talking about remote spying.

[@samykamkar]

Max Richie Scientific remote spying. kzbin.info/www/bejne/epPXXoKcl7aHptk

[@StephenPavis]

Nevermind I found it but amazing work on this projects your work never ceases to amaze me!

[@samykamkar]

+Stephen Pavis Thanks!

[@anoncker]

Simply genius! I just discovered your channel and it was probably the best thing I did in 2015 xD Keep the videos coming =D

[@Mk43305]

I think some of the Microsoft engineers just jumped of a bridge :D

[@ugandanwarrior5657]

By the way they didn't even try to encrypt data. Using XOR is pathetic

[@u0000-u2x]

@oH well,lord! base64 is better

[@Killberty]

Wow dude, you did it again. Awesome passionate video and very creative. Please never stop making videos :)

[@samykamkar]

Killberty, thanks! It was a blast. I'll keep working to provide you some fun information and content!

[@Killberty]

Samy Kamkar How a bout making a hardware keylogger (plugged begween an usb Keyboard and the pc) with a teensy 3.1? A cheap variant with flash storage and an expensive one with wireless? I know there are many around but none is documented and explained and high qualtiy (as i am used to by your videos) and this should not be too hard for you.

[@samykamkar]

Killberty Cool idea -- I have an idea for something similar to a hardware keylogger...I have a few projects in the works for future vids and then will get back to a keylogging related one for you!

[@Killberty]

Samy Kamkar I would love to see this. I love you (nohomo). Can't wait for your next video. :)

[@IAMT4505]

Great video. I just want to say Samy that i am big fun of you from the day i saw you in a DEFCON event and i wanna say that you are great researcher and i admire your work.. well done!

[@samykamkar]

Thanks Tasos!

[@hansforster1867]

Awesome Video! Keep on your good work! I hope, we'll see you back at defcon again some time soon!

[@samykamkar]

Thanks Hans Förster! More videos on the way for you!

[@santicomp]

I'm subscribed to +EEVBLOG,+THE SIGNAL PATH BLOG, +MIKES ELECTRIC'S,+KEVIN DARRAH and others. I must say you're channel is incredible, i love the content and the way you explain it. keep it up very cool

[@SandeepKamble1337]

No words. Your every releases so unique and I again think why I'm Security in Security.

[@trudyandgeorge]

Please, never stop playing.

[@samykamkar]

George Edwards you got it.

[@spacet1me]

SAMY YOU ARE A FUCKIN GENIUS AND THE FEW CREATING NEW INNOVATIVE METHODS IN THIS TECH DRIVEN WORLD. NEVER FUCKIN STOP SPREADING INFORMATION AND YOUR RESEARCH PLEASE. YOU HAVE MANY FANS. AWESOME VIDEO!!!

[@yeyintminthuhtut]

Really awesome Samy ! I was your fan since your SkyJack video ! Waiting more your masterpiece videos :)

[@samykamkar]

Thanks *****! More videos are coming up!

[@ShteebVS]

I made something similar with an Arduino uno that only sniffed packets over wifi. Very creative man. Thank you for sharing!!

[@TheRealMisterJ]

I know this is kinda an older video but still interesting.. Just found your channel through Simone's channel and your both so awesome! Keep up the cool vids dude!

[@samykamkar]

Thanks!

[@deangreenhough3479]

Nice work, nice guy, very talented. Amazed I've missed you. Thank you for clearly explaining an unexplainable project.

[@ulricrainard]

Samy, assuming all of your projects are done for the common good; You are very bright and a great explainer. I enjoyed this project, because you are a clever lever living in the new world of robot~o~logy and your description of the invalid way we are compromised by all of the mini personal ways we no longer control brings me to understand the destination of all of the gizmos that surround the engineering productology, you so well understand.This comment is by a totally out of his league viewer. The future belongs to the brains behind the change. Good riding with your insights, sir. Bravo to You_ I think. Seriously, though_ I enjoyed the direction you are going. not there yet.

[@samykamkar]

Thank you ulric rainard!

[@SouthernOregonCoast]

In this example he demonstrates his curiosity, creativity and drive to OWN his future. Thanks for sharing your process, it was very educational. Samy, what got you going on this track? A special teacher, role model . . . what? As you say "Simply start with some basic tutorials. I learned everything online, there are so many amazing resources -- and I've learned a lot with trial and error (more error than trial). Be persistent, try different things, and follow areas you think are interesting!" Kudos to you!

[@samykamkar]

Thanks Jim Chamberlain! It probably started with someone performing a DoS attack on me when I was young...thought my brand new computer was fried! Scary and exciting at the same time...

[@GeorgeBurnett]

#samyismyhero

[@SouthernOregonCoast]

Samy Kamkar So it is good to hear that a DoS attack has a silver lining. Keep up the good work and inspiring others to learn valuable skills.

[@lawrancedevlin7171]

Samy Kamkar But most of all, samy is my hero!

[@blairc5428]

Really great video Samy. Your problem solving skills are quite impressive!

[@samykamkar]

Thanks Blair!

[@cmatbmed]

Great video. Great description. Always amazes me to see what companies call encryption. Sickening. Really want to give this a try. Thanks for your research.

[@samykamkar]

Thanks Ed Armstrong!

[@James382aa]

Such an awesome video keep it up man

[@samykamkar]

Thanks Christian kaltoum!

[@munis002]

its great to see a professional from the comunity takeing time and making these vedios great vid

[@samykamkar]

Thanks *****!

[@NewtonGaire]

dude saw u before in Motherboard's documentary :D Great fan of yours since then... :D

[@samykamkar]

Awesome, thanks Newton Gaire!

[@NewtonGaire]

Samy Kamkar your Defcon "How i met your girlfriend " was also awesome.. i am starting in security sector.. what shall i start from . really love to know from an experienced person :D

[@samykamkar]

Newton Gaire Awesome, thanks! I'd say just work on a project that's out of your reach -- it won't be for long, just set a goal for yourself that may seem tough and just work towards it in any way possible. Research, test, and be persistent! Even if you never complete it, the information you will learn on the way will be invaluable. Good luck!

[@alanmoreno6180]

I felt like I understood most of this material. Really interesting stuff right here

[@samykamkar]

Thanks Alan Moreno!

[@krist0sh]

WIsh I'd know partly as much about this as you! Great concept, and great explanation! Looks like an interesting project for sure!

[@samykamkar]

Thanks TCN0101!

[@kattaliraees]

27 mins went like 5 mins. Awesome work dude and awesome video too. You got the skills and the skill to video it perfectly :). I am so pissed of to myself, why the hell I didn't heard about you before. Anways subscried, followed (twitter) and checked out your website and checking your old projects one by one :P any where else?

[@samykamkar]

Thanks Raees Mohammed! The Tubes of You, Twitter and my site are the only places I release stuff -- working on some new projects for you to check out!

[@samiant5199]

Wow your tutorials are like pottery... I love them. This puts my PS2 data logger to shame :') So good keep it up.

[@rashidferoz6909]

Now that's called thinking out of the box! A brilliant and true hacker mind.

[@grimthereeper]

I love people and videos like this.

[@samykamkar]

Thanks grimthereeper!

[@KindAlcoholic]

Great job man. I learned a lot in 28 minutes. I can't wait to make one of these.

[@samykamkar]

KindAlcoholic Thanks, glad you enjoyed it!

[@dirtylaundrydon]

You my friend are the ultimate hacker guru! Earned yourself a new loyal subscriber

[@Masterpieced]

Awesome videos Samy! Please keep them coming

[@samykamkar]

Thanks Masterpieced! You got it

[@MultiBiggie007]

subscribed!! very interesting, i like the way you explain the multiple options and why you do certain things.

[@InventionTherapy]

What a cool use for an Arduino!

[@MyBigThing2010]

I'm so happy to find someone who speaks proper English AND is willing to take the time to explain stuff in depth for dumb ass newbs like me! SUBBED IMMEDIATELY, halfway through the video. even though I don't understand this in full...I'm hoping to be able to speak passable geekanese by this time next year. ...I'd love to be able to binge watch and understand everything but sadly I think I'd go cross eyed and suffer a cranial explosion somewhere around video #7ish haha. I'm learning C & python now and wanna get into Linux and learning java hopefully around New year's...thanks for taking tube time to put info out there like this...it's highly appreciated!

[@harayz]

all your vids are nicely explained and very structured which makes em highly informative, educational plus entertaining! here is my unworthy 2 cents for your consideration - instead of music use the audio (snippets) of the next/previous vid that are linked at the end of (this) video. it can serve as the teaser or hint of the content and plus music (in my case) volume can be tad funky on some machine/settings. anyhoo - really enjoy your stuff, your www on android cracks me up and stay awesome. ps: this is a compliment - you very much remind me of aaron swartz

[@adriantarver2229]

Samy is my hero. :-D Keep up the fun exploitation through drive by plugins via usb devices.

[@oilarbitrage7526]

Excellent work and excellent job. Thanks for the straightforward and very detailed explanation.

[@bsals8736]

Fan!!! Your channel and videos are legit! Please keep them coming:)

[@samykamkar]

+b sals Thanks! Working on it!

[@omriinbar1831]

Hey Samy Kamkar, I made my own version using your guide with only the arduino pro mini and the nrf24l01 and I've been running into a few problems: 1. When I check the Serial monitor I can see that it can read the keystrokes from my keyboard. However, it doesn't do that so well and most of the time the keystrokes are missed and after a while, it stops working altogether. Any idea why? 2. How can I read the stored keystrokes from the keysweeper after I've obtained the device back/used the backtracker? Anyhow, love the videos and can't wait for the Rolljam! Omri.

[@ukimalla]

Samy you're the coolest! Awesome video! I love your work, and i just love how u've been replying to a lot of the comments. I recently graduated high school and i just love your videos. I do a some programming, but the most hacking i've done is build a phishing website a few years back. I tried writing my own keylogging software once but i failed.. How do you suggest i pick things up? i don't have access to Arduino in my country as we don't even have ebay here. I probably love computers as much as you do! You replying to my comment will probably make my day! :D Just suggest me the first cool computer related article that comes to your mind?

[@samykamkar]

Uki Malla, thanks for commenting! It's okay to not succeed in creating something, the fact that you even tried means you probably learned a lot along the way. I have a *ton* of projects I haven't completed, but each one I do I learn more information that helps me successfully create something else in a future project. Every little piece of information is like a building block and over time, you can put them together to construct some really amazing things. You can do so much without an Arduino by focusing on software and networking. One thing I had a lot of fun learning is network hacking, learning TCP/IP, common tools like tcpdump, nmap, ngrep, dsniff, etc, then building my own versions of those tools from scratch which *really* taught me how each piece works and works together. Good luck and thanks for commenting!

[@TheAjakshay]

Big fan here. You are doing some awesome work.

[@michaelparker2449]

I need to stop watching this channel because its making me paranoid to use anything with a wireless connection.

[@SilverSpoon_]

you are right to be paranoid. you are right.

[@Ja_xon_]

Thank you Samy, I'm very happy about this video specially as i read about it in the hacker news, very interesting :)

[@samykamkar]

Thanks Mohamed Mostafa :)

[@nicoletutt7015]

Samy - Great work and awesome video presentation! Can you speak to the effectiveness of this method against keyboards that include 128 bit AES encryption? Your video mentions simple XOR deciphering but also mentions "all keystrokes from any Microsoft wireless keyboards (using proprietary 2.4GHz RF) in the area". I wasn't clear if you were also implying decryption of keystrokes generated on what are advertised as 'secure' 128 bit AES enabled devices. Thanks for your hard work!

[@samykamkar]

Hi Nicole Tutt, thanks for reaching out! It appears that out of the 11 wireless keyboards Microsoft offers, one of them does state it provides AES encryption (the 2000 model), however I haven't tested it and can't speak to the security around that model. I actually ran to Best Buy a few days ago to pick one up but while they offered several Microsoft wireless keyboards, they did not offer the 2000 model and none of the others mentioned encryption or AES.

[@je6566]

damn you're better than marcus from watchdogs 2

[@samykamkar]

I learned everything I know from him.

[@adizivojevic8635]

@@samykamkar 😂😂😂

[@kamran_aghlami]

Incredible!! Amazing!! Keep teaching us master! 🙌

[@benedekt.5909]

Hi Samy, I want to build the KeySweeper. I did the hardware, and uploaded the sketch, but i've some problem. At the first test it locked on the 21th channel, but stopped at "2setupRadio "; At the second test i got this output: pastebin.com/RN3PT4v0. I typed in "a" before the "locking" in the tuning process, than i typed "bcdefgh". As you can the keysweeper didn't print the letters out. I did a lot of tests, but the KeySweeper can't catch my keystrokes. (I've the Microsoft Wireless Keyboard 800 with FCCID C3K1455 and IC3048A-1455.) Why is that? Benedek T.

[@TheAliTrixx]

This is awesome. Thank you for the video, it taught me so much stuff. Keep the awesome work going, it's nice for once to see hardware hacking rather than software hacking.

[@NoneYobusiness2]

Think of these things being sold over ebay as a regular wall USB charger XD Welp, no more ebay shopping for me

[@alexwchenpro]

Your hacks are so awesome and crazy, can't wait for the next one! Are you in the Bay Area?

[@samykamkar]

Thanks Alexander Chen! Nope, in Los Angeles

[@samykamkar]

Devesh singh Sweet! Let me know how the build goes!

[@djnagl]

Good evening, I have a few items worth mentioning. I was wondering if you could possibly provide some detail as to how we can use some sort of counter-measure that can detect when in fact our keystrokes are being logged. In other words having a small program running in the background that's on constant alert & notifies the user if/when someone is sniffing out their keystrokes. I know you said to use a wired keyboard to prevent being hacked...but what about if you're wired keyboard is first connected to an external 4 port USB port, that then itself connects to your on-board USB hub, is this vulnerable?

[@2006hitech]

I thought you don't even need the arduino if you programmed the nRF chip directly. But the video is awesome.

[@sungwilliam1173]

Holy shit... This is amazing man. I am mind blown... Did you use python to code the whole thing?

[@samykamkar]

Sung William Thanks! It's C for the Arduino and some PHP/Javascript on the web side.

[@JesusVillanueva]

Awesome detailed video. Do you know if something like this would be possible with the Logitech and their Unifying wireless devices protocol? I asks more at someone trying to keep from being intercepted. I rarely us the keyboard with my notebook outside my home, as it is a ergonomics advantage at home, but no convenient to carry. I do live near apartments within wireless range. Thanks.

[@samykamkar]

Jesus Villanueva I believe Logitech uses similar nRF chips, though they use some form of AES encryption. It may be susceptible to other vulnerabilities, but it would require some deep investigation.

[@Xclann]

You mentioned in that Microsoft only lists 1 keyboard that uses AES Encryption. It seems recently, Microsoft has updated their website to mention keyboards that uses AES Encryption with 128 bit keys. Have you tried KeySweeper on any of those keyboards yet? For example, the Sculpt Ergonomic Keyboard is a pretty recent one.

[@samykamkar]

Hi XClann, they had a "Sculpt Ergonomic Keyboard" at Best Buy a few days ago but it had no mention of AES or encryption, however it never mentioned "for Business" like the one I see on Microsoft's site. I'll pick a new one up and check it out.

[@Xclann]

Hi Samy Kamkar . Thanks for the reply! Let me know if KeySweeper works on it.

[@mikemck3598]

Random Q... What lights or setup do you have on your ceiling? Any chance its computer controlled?

[@samykamkar]

Hey Mike Mck, yup, the lights are actually christmas lights I hacked, tied to an Arduino to control and added an nRF24L01+ chip for wireless control. Originally they were GE G35 christmas lights (RGB LEDs, independently addressable), which like all other christmas lights, have a box/remote that you control them with, but very limited in control unless you like flashing green and red. I cut off the box, tied an Arduino to the data line instead, and control it through that. Darco has a great writeup on reverse engineering the G35 lights proprietary protocol here: www.deepdarc.com/2010/11/27/hacking-christmas-lights/ I did this about 4 years ago before addressable LED strips were affordable (you could pick up a 50-strand of the G35 lights for $30 or so). These days when dealing with addressable LEDs, I prefer the WS2812B strands. You can see a custom panel I made with ~1000 LEDs, controlled wirelessly via iPad, here: kzbin.info/www/bejne/hZSuYYOtpNika8U And here I tied it to an Xbox Kinect for depth keying: kzbin.info/www/bejne/oZKzkpaGf9WbfZo

[@DarthCaniac]

This video is fantastic! Everything is explained so well. Please don't ever take a job with the feds, so we can get more awesome videos like this. :)

[@samykamkar]

Thanks!

[@momashi69]

+Samy Kamkar I've heard about these exploits. Interesting to see an example. Anyway of jamming this shit or countermeasures that can make the sniffer's work more difficult?

[@samykamkar]

You can potentially find vulnerabilities in the sniffer itself. Using a keyboard with proper encryption (eg AES) solves the sniffing issue, however others have found that even AES encrypted keyboards are vulnerable to keystroke injection attacks (which I've also included in the KeySweeper source code).

[@Xpl1k3R890]

i didnt get all that proffesional talk about codes and frequencies but strangely the video was enjoyable

[@samykamkar]

Awesome, glad you enjoyed it *****!

[@Xpl1k3R890]

why do you hack?

[@samykamkar]

***** I like puzzles, but I quickly found digital puzzles (hacking!) has real world application...it feels pretty awesome to actually solve a puzzle, and all of the sudden have the actual *ability* to do something with that information or skill.

[@itspoffy]

I have my NF and Arduino. I was curious if it would be easy to simply use the Arduino IDE while using the serial monitor. I wanted to make one and show a few folks in the workplace that its possible as well as see if i can stiff from outside so I can show the vulnerability without sounding like I need a tinfoil hat.

[@ghostrider090]

Great video as always, thanks man!

[@samykamkar]

Thanks ghostrider090!

[@nithikasandinu9034]

please continue this channel

[@KennedySanchezcld]

Atta boy! you have magic power in your hands :)

[@samykamkar]

Thanks Kennedy Sanchez!

[@LaraLoverLL]

if they did it in parallel, this would be impossible! it could be craccked but would take enourmous amounts of time......... ur example is the reason serial is weak to hacckss. good job, really smart bro!

[@LY5AT]

You've been reported to cyber police! Awesome project!

[@samykamkar]

Thanks linutas!

[@gautiercastelain548]

The judge dreed is on your back ^^ Linas Dragûnas we doesn't like spy :)

[@Avant_gardens]

consequences will never be the same

[@TheLun4tic]

can you do this with other non-encrypted keyboards as well and is it documented somewhere?

[@mobius3506]

I am wondering whether this device [or a close variant] could be developed to replace the receiver "dongle" for my microsoft wireless keyboard? In my case i have a NEW Microsoft sculpt wireless keyboard without a working receiver. And there are MANY unhappy people out here in the same boat. If this device reads my keyboard transmission[s], would it be possible to just send that info to my computer as the keyboard would? Maybe it would be necessary to shield it from transmission[s] from other Microsoft devices but in my case that's a non-issue since I work from home.

[@MrClaudiodonate]

Brilliant, men, just brilliant. Congrats!

[@samykamkar]

Thanks Claudio D.!

[@itspoffy]

I actually got it working with serial monitor, but the keypresses seem to show repeated and I miss presses. I'm guessing the serial output is adding delay and I'm having problems because of that?

[@acessdeniedify]

But most of all, samy is really my Hero please upload new videos samy :-)

[@samykamkar]

access denied you got it! Working on one now!

[@BeatriceGatta]

I like this project, but I'm terrible at DIY stuff... will you just publish tutorials or will you also sell them ready-made?

[@Derbauer]

Samy, wow dude! i cant really imbibe all the technical explanation even though you have made it quite simple, but its still a fascinating thing to watch. So i would to ask your opinion on a couple of things. What do you think of AES encryption in say encrypted volumes, is it secure or do you think its cracked, even with a strong password? Also, what do you think of the current tls 1.2 encryption implementation for https and is it safe from hackers (assuming all the security certificates are real etc.,im not talking about compromised user laptops etc, just normal coffee shop surfing or paying my bills online), and what encryption products would you recommend, like for example what do you think of Veracrypt and also silent circle's messaging service vs whatsap end to end encryption claims. I think it would be really beneficial if you could make an entire video about your thoughts on what solutions you implement on a day to day basis which makes YOU personally feel secure from other hackers, because your opinion does count 'cause you know your sh!t and if you are recommending something then im interested to hear it. I of course understand that nothing is secure 100% etc etc, but please, a penny for your thoughts on security and encryption Samy!

[@AAFCnut]

Hey Samy Kamkar, what did you use as low voltage protection on that lipo cell? wouldn't want your sniffer to self combust if your target or passer by unplugged it for a long time...

[@igrewold]

dude, this is an alpha project so you add whatever you feel is necessary to take it further.

[@MyBigThing2010]

I wonder what logitech is using? they are in pretty wide spread use n I think they sell to off shoots like best buy for their store branded products

[@Killberty]

Hi Samy, some moar questions :D What is the cheapest arduino you can recommend? Will this porject work with an atmega168 or similar (you know, you can promgram those with arduino)? And finally, when will you upload your next video? I am dying waiting :p

[@samykamkar]

Hey Killberty! In general I really like the Arduino Nano (with ATmega328), and you can get a clone on ebay for a few dollars. It's powerful enough for most projects, has a nice size, and is inexpensive. This project will *probably* work with an ATmega168 since the processor/timing-intensive stuff is moved off board onto the nRF and GSM chips, but I don't know if the 168 chip has enough space and memory for everything. It probably does but you'd need to test. Throw out some suggestions on videos...I'm here messing with car cig lighter modifications, totally unrelated to security and more with Arduino and power but may throw a vid on that up once I finish this circuit.

[@Killberty]

Samy Kamkar hey Samy, prepare for some cool video suggestions :D -Hardware Keylogger - additional challenge: make it one as small and one as cheap as possible -Teensy to reverse TCP meterpreter on windows + DNS + other things your creative mind will think of -Teensy built into a (HP brand pls) laptop for keylogging -Any Android via USB Hack (Pin code brute force plus anything cooler you might think of) -Teensy combined with storage to execute a program on it e.g. Mimikatz (github.com/gentilkiwi/mimikatz) or with procdump for not flagging anti virus (you smell the ducky, don't you? :D ) or some nirsoft tools to steal passwords ;) Also a question: My teensy will transmit keystrokes on ANY OS apart from Windows, on Win it will install drivers for keyboard/mouse/joystick which takes hours, so i can't prank my dad/friends by just plugging the teensy in for 1-2sec. Any workaround? PS: It works flawlessly on *nix, MacOS, even Android

[@samykamkar]

Killberty These are awesome suggestions, thanks! I will work on something around at least one of these!

[@Killberty]

Samy Kamkar tahnks, what about the driver thing? ETA for your next videoß :)

[@samykamkar]

Killberty Oh yeah, are you sure it can't just start typing (even if it does ask to install drivers)? I've been out of town but am working on two new projects -- hope to have something in the next two weeks for you!

[@escobarstatus06]

Stuff like this is what makes me not want to buy electronics off ebay

[@IMcPwn]

Hi Samy, you might remember me from my pull request on Github where I helped you out on your USBdriveby project. Anyway, I really enjoyed your tutorials and I’m trying to follow/replicate them. A big problem is I have no experience in soldering or wiring. Right now I’m trying to replicate your KeySweeper device, the problem is, my Adafruit FONA does not fit inside the USB charger. I purchased the one you linked, the SMA edition, which has a yellow screw that makes it slightly too long to fit inside the USB charger, (not even close with the antenna on). I’m wondering if there’s a way to make this work, or if I got the wrong one, (it looked like you used the UFL in the video). Also, if you could provide an actual picture of how you wired the micro controller to the FONA and NRF that would make figuring how to replicate your project much easier! Thanks Samy! -IMcPwn

[@samykamkar]

Hi IMcPwn! Regarding the FONA, you're right, sorry about that! I use both for projects and linked to the one I didn't use, though they've been out of stock for a while in the uFL version. However don't fret, you can always solder the SMA connector off and connect a uFL connector, or connect an antenna directly after soldering it off, or cut a hole in the charger. Also, I hacked up a smaller antenna in my build -- you can actually cut off the plastic on most antennas to expose the wire inside, or steal an antenna from an old GSM phone, or make one from a wire. You can do a little research on making your own antenna, but it's just a wire cut to length, so you could just solder the SMA connector off and solder a wire to it and everything will fit! Hold on to the connector for future projects. I don't have any picture of this soldered as it's all glued up in my KeySweeper, though a schematic is provided in the git as well as the end of the page. You can look at how I wired things up in my Digital Ding Dong Ditch project though: samy.pl/dingdong/ Most pins should be the same but no guarantee, I would simply go off the schematic in the KeySweeper project. And thanks for the git love!

[@bhuwanmohan]

Wow man ! That adafruit phone board ! Is that an open source GSM baseband transceiver ? If so, its potential is endless !!

[@samykamkar]

Bhuwan Mohan Check it out here! www.adafruit.com/products/1946

[@essaiche2108]

Hi Samy, awesome project. I was hoping you were able to provide a couple of instructions and maybe a schematic to use the SPI flash chip? Thanks Ess.

[@samykamkar]

Hi Ess Aiche, thanks! I've updated the code with the pinout -- search for the word "flash": github.com/samyk/keysweeper/blob/master/keysweeper_mcu_src/keysweeper_mcu_src.ino

[@RnO7579n7578]

+Samy Kamkar do you know any of these chargers for sale? so i could get one for damn cheap here in China