Security News Chinese Keyboard Maker Caught Tracking Typed Keys on Customer’s Computers

[Solarquest]

Chinese mechanical keyboard manufacturer MantisTek has allegedly included keylogging capabilities in the software application offered to customers of its GK2 model.

Specifically developed to provide more customization options for RGB illumination and macros, the keyboard companion software can also track typed keys on the keyboard and send information to a server that’s being hosted on Alibaba Cloud.

A component described as “cloud driver” appears to be responsible for recording the keypresses and sending them to IP 47.90.52.88, with the data then stored in two different locations, namely /cms/json/putkeyusedata.php and /cms/json/putuserevent.php.

The worst thing is that the data is being transmitted unencrypted, which means that anyone who monitors the traffic of your Internet connection can intercept the logged information and see what you typed on the keyboard. Everything that is being typed on a MantisTek keyboard is being collected, including credit card information, personal data, and any other text that users input on websites or in documents.

Remove the software application
The weird thing is that trying to connect to the said IP address using a browser seems to point to a Chinese login page that also hosts a link to Browse Happy. The Chinese text on the page seems to point to a cloud mouse management system, so it could provide access to data collected by the keylogger.

At this point, there’s absolutely no official information on the keylogging capabilities of the software tool and MantisTek has obviously remained tight-lipped, but customers who purchased the said keyboard model are recommended to uninstall the companion application as soon as possible to make sure their keypresses aren’t logged and sent to the company.

Additionally, a firewall that can block the CMS.exe process can also help deal with the keylogger, though in this case users must be sure that all connections to the server are blocked.

As for those whose information has already been tracked, you better keep an eye on your bank accounts and personal details to detect any suspicious activity and report it to law enforcement.

 

[tim one]

Outrageous!! How can we be surprised, then, if from China come out backdoors, adware, and now keyboards with built-in keylogger!

 

[Sunshine-boy]

Lol, the worst news!

 

[lowdetection]

I will ask about, thanks for tip.

 

[ForgottenSeer 58943]

Outrageous!! How can we be surprised, then, if from China come out backdoors, adware, and now keyboards with built-in keylogger!

In years of IT Engineering, I can tell you that I have NEVER seen a Chinese (IT) product (software/hardware) that didn't do some form of spying out of the box.

Of the last dozen Chinese Off-Brand IoT gear I have tested over the last 8 months 100% of them had backdoors of some type. This spans the generic, simple smart-plug, all of the way up to off-brand Chinese routers, switches and AP's. ALL OF IT. Most recently I discovered backdoors and phishing in the most popular Chat-App in Asia (WeChat). I ripped Maxthon up last year after I found spying involvement with it.

Remember, while so much stuff is manufactured in China, even Fortinet hardware is manufactured there, realize that in this case, this gear is carefully inspected, audited, Fortinet engineers are on the assembly line and the operating system (FortiOS, which is a classified trade secret) is programmed in the USA. We're talking about off-brand junk in most cases that is implicated here. China is very adept at ripping off industrial secrets, they are very adept at Form-Factor emulation. This is why you can buy GIRO Bike Helmets for $25 from China when the real ones cost hundreds, those $25 ones are made with left over packing foam from boxes and will shatter on impact. But the Chinese ripped off the form factor and trade secrets from GIRO then use substandard manufacturing and material. The assumption should be - virtually everything home-brewed in China or even by Chinese ex-pats is backdoored, substandard and prone to failure.

With no recourse from world consumers, manufacturers of this junk don't care.. But slap a backdoor in a Microsoft or Logitech keyboard and there are massive repercussions for the company.



This is the second time I have run across Alibaba Cloud this week.. Some garbage Chromium Clone I tested that someone posted about here also sent spy telemetry to Alibaba Cloud.

My solution is simple - policy geography block connectivity from my network to anything geographically close to China and call it a day..

 

[GonzitoVir]

I've always been worried about this chinese cooler pad I bought for my laptop...

 

[plat1098]

Out of prudence and distaste, I got rid of the Lenovo driver software for my Lenovo keyboards and had the generic ones installed. Thanks for the heads-up.

 

[_CyberGhosT_]

Outrageous!! How can we be surprised, then, if from China come out backdoors, adware, and now keyboards with built-in keylogger!

Right, I lmfao every time someone posts a Chinese security software, or hardware for that matter, then proceed to tell me how awesome it is. I'm good you go ahead lol

 

[ForgottenSeer 58943]

Right, I lmfao every time someone posts a Chinese security software, or hardware for that matter, then proceed to tell me how awesome it is. I'm good you go ahead lol

Same here.. I always die a little inside when I see people promoting one of the Chinese AV softwares floating around.. Yup, go ahead..

Some guy at work brought in a $19 Smart Plug for me to see. I told him it was backdoored. He said it was small, cheap and didn't do anything but connect to an app to turn on and off the out.. 15 minutes of testing. Yup. Backdoored. ICMP sweeps of the network, DHCP exploration, exfiltration of data on entire network, device names/connected devices, operating systems, open ports, to Chinese IP addresses..

 

[spaceoctopus]

You built or buy a nice Pc. 70$ Internet security Suite, feeling confident and secure...but your keyboard is logging all your data.Well done :X3:

 

[curtcobian]

Made in China quality is lovely product from hacking perspective.

 

[ForgottenSeer 58943]

You built or buy a nice Pc. 70$ Internet security Suite, feeling confident and secure...but your keyboard is logging all your data.Well done :X3:

Put a real keyboard on it, Model M, then you don't have to worry about it.

 

[ForgottenSeer 58943]

We were just talking (at work) about how everything seems compromised these days..

I brought up my little secret. I have a new-in-box but older exploit free model AIR-GAP laptop stored away with secured, encrypted linux on it. Chipsets that aren't compromised, etc. Someday in the future, I am sure my kids or someone else will be thankful for what will amount to a totally secure laptop they could use with virtually no risk.

At the least, I just keep it there for peace of mind knowing at any point in the future I can 'plug in' with a completely invulnerable system in an age when everything will likely be riddled with backdoors and spyware.

Sometimes I wonder how secure it would be to setup a BBS again and completely bypass the internet.

 

[mlnevese]

We were just talking (at work) about how everything seems compromised these days..

I brought up my little secret. I have a new-in-box but older exploit free model AIR-GAP laptop stored away with secured, encrypted linux on it. Chipsets that aren't compromised, etc. Someday in the future, I am sure my kids or someone else will be thankful for what will amount to a totally secure laptop they could use with virtually no risk.

At the least, I just keep it there for peace of mind knowing at any point in the future I can 'plug in' with a completely invulnerable system in an age when everything will likely be riddled with backdoors and spyware.

Sometimes I wonder how secure it would be to setup a BBS again and completely bypass the internet.

You just reminded me of the nice times of invite-only BBSs

 

[Lightning_Brian]

Right, I lmfao every time someone posts a Chinese security software, or hardware for that matter, then proceed to tell me how awesome it is. I'm good you go ahead lol

I couldn't agree more!

 

[Azure]

Apparently they aren't sending the key presses but only how many times each key has been pressed

Update: MantisTek GK2's Keylogger Is A Warning Against Cheap Gadgets (Updated)

 

[Entreri]

I wouldn't trust any Chinese tech products, including the likes of Lenovo, forget about less well known and lower market value corporations in China.

Lenovo was caught spying a few years ago, who is to say they don't have firmware level or bios level spyware now?

This is a country that killed it's own babies for an extra buck (baby formula), nothing is sacrosanct.

 

[_CyberGhosT_]

Apparently they aren't sending the key presses but only how many times each key has been pressed

Update: MantisTek GK2's Keylogger Is A Warning Against Cheap Gadgets (Updated)

Ummm, ok if that's what they are calling it lol