CVE-2016-6257 in Ultraslim Dongle
Summary
by MITRE
The firmware in Lenovo Ultraslim dongles, as used with Lenovo Liteon SK-8861, Ultraslim Wireless, and Silver Silk keyboards and Liteon ZTM600 and Ultraslim Wireless mice, does not enforce incrementing AES counters, which allows remote attackers to inject encrypted keyboard input into the system by leveraging proximity to the dongle, aka a "KeyJack injection attack."
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 03/16/2019
The vulnerability described in CVE-2016-6257 represents a critical security flaw in the firmware of certain Lenovo wireless input devices, specifically targeting the Ultraslim dongles used with various keyboard and mouse models. This issue stems from the improper implementation of encryption mechanisms within the wireless communication protocol, creating a significant attack surface that adversaries can exploit without requiring sophisticated technical skills or physical access to the target system. The vulnerability affects devices that utilize the Liteon SK-8861, ZTM600, and other similar wireless components, making it particularly concerning given the widespread deployment of these peripherals in enterprise and consumer environments.
The technical flaw resides in the firmware's failure to properly enforce incrementing AES counters during the encryption process of wireless keyboard input data. This cryptographic weakness allows attackers to replay previously captured encrypted keystrokes or inject new keystrokes into the system by positioning themselves within close proximity to the wireless dongle. The attack vector operates through a technique known as "KeyJack injection attack" where the malicious actor can inject encrypted keyboard commands without requiring the legitimate encryption keys or complex cryptographic attacks. This vulnerability specifically targets the counter mechanism that should ensure each encrypted packet is unique and prevents replay attacks, creating a persistent security gap that undermines the entire encryption framework.
The operational impact of this vulnerability extends beyond simple data theft or unauthorized access, as it enables attackers to execute arbitrary keyboard commands on targeted systems. The proximity requirement for the attack makes it particularly dangerous in environments where physical security is inadequate, as attackers can potentially gain access to systems by simply positioning themselves near the wireless dongle. This capability allows for the execution of malicious keystrokes that could lead to privilege escalation, credential theft, system compromise, or the execution of malicious software through automated keyboard input sequences. The attack can be particularly devastating in corporate environments where wireless keyboards and mice are commonly used, as it provides a stealthy method for attackers to bypass traditional network security controls.
Security practitioners should implement immediate mitigations including physical security measures such as restricting access to wireless dongles, deploying RF shielding solutions, and conducting regular security assessments of wireless infrastructure. Network administrators should also consider implementing endpoint detection and response solutions that can monitor for unusual keyboard input patterns or unauthorized device connections. The vulnerability aligns with CWE-327, which addresses the use of weak or broken cryptographic algorithms, and maps to ATT&CK technique T1056.001 for input injection attacks, highlighting the need for comprehensive security controls that address both physical and network-based threats. Organizations should also consider replacing affected devices with models that implement proper counter mechanisms or ensure that firmware updates are applied where available to address this specific cryptographic weakness.