logo elektroda
logo elektroda
X
logo elektroda

Logitech Hack by piotr_go

piotr_go  39 26451 Cool? (+13)
📢 Listen (AI):

TL;DR

  • A Logitech wireless peripheral hack demonstrates remote keyboard and mouse impersonation, plus interception of keystrokes and clicks.
  • The approach is presented as different from MouseJack, because Logitech’s released patch does not block it.
  • A short video shows the attack working in practice.
Generated by the language model.


Hello.
Some time ago I was looking for a way to communicate with Logitech wireless peripherals in order to use them in my own projects.
Due to the recent reports on the possibility of impersonating someone else's keyboard / mouse, I decided to boast myself.
I don't know how exactly they did it in the project " MouseJack "but apparently I did it differently. How do I know? Because the released Logitech patch does not block my way :P .
What is possible? Remote emulation of someone else's keyboard / mouse, interception of keystrokes / clicks.
I will not describe the details for obvious reasons.







[movie: 3f3918cdc1] https://filmy.elektroda.pl/46_1456491985.mp4 [/ movie: 3f3918cdc1]
Attachments:
  • logitech_hack.mp4 (24.71 MB) You must be logged in to download this attachment.

About Author
piotr_go
piotr_go wrote 2904 posts with rating 3336 , helped 94 times. Been with us since 2003 year.

Comments

Frog_Qmak 26 Feb 2016 17:43

Cool, but what's the use for this? It's just about wireless peripherals, and has LOGITECH been found, does it have any specific properties that a colleague uses somewhere? [Read more]

piotr_go 26 Feb 2016 17:57

For example, you can control a robot you have built with a wireless logitech pad (directly, without using a computer), or you can remotely install spyware or format a disk. It came to logitech because... [Read more]

Pumbas 26 Feb 2016 22:34

It works with logitech "unifying"? I don't even have an idea how to approach such a topic without knowing their product from the inside - is the communication used by Logitech described anywhere?... [Read more]

piotr_go 26 Feb 2016 23:07

Yes Not really, there are some scraps of information, but I haven't seen any description of what and how it is sent. The MS keyboard is better described (about 50% of the info needed) due to the... [Read more]

Tomekkoko 27 Feb 2016 02:48

There is a chance that if I lose my unifying receiver, I will fasten it and the keyboard and mouse will work? Why, for example, the F710 pad has a different receiver than mice and keyboards? [Read more]

Zbyszunio 27 Feb 2016 10:38

and you don't need to see that person's screen? [Read more]

08FEDRA 27 Feb 2016 11:47

to fire up the console all you need is Win + R, "cmd" and enter. ;) [Read more]

piotr_go 27 Feb 2016 12:08

The hardware receivers are the same, the limitation is only in the software. [Read more]

george2002 28 Feb 2016 00:56

I always wondered why it hadn't happened yet - that wireless mice and keyboards hadn't been hacked :) for this, always not for the sake of safety, but to save the battery, I turn off the wireless... [Read more]

Kuniarz 28 Feb 2016 09:10

Wouldn't it be easier to log out and have a strong password? :) [Read more]

piotr_go 28 Feb 2016 11:17

typing the password (on the wireless keyboard) can be intercepted so it would have to be one-time or ... + capcha [Read more]

Sas_AS 28 Feb 2016 15:04

Well done. As you can see, anything is possible, even if someone said it was impossible. Working out this topic is a big step towards using mainly pads as an alternative way of control. Can this device... [Read more]

piotr_go 28 Feb 2016 16:40

Yes I didn't need it so I didn't work it out, but it should be possible to do probably yes, I don't think it was on another radio, they probably limited to only one device per receiver... [Read more]

Sas_AS 28 Feb 2016 18:00

http://obrazki.elektroda.pl/8356576900_1456677087_thumb.jpg Most of these receivers are on the NRF, in order: Newest Orange: NRF D 24LU1P 500 Hz receiver: NRF F 24LU1P F710 receiver: NRF D 24LU1P ... [Read more]

piotr_go 28 Feb 2016 18:24

Nice collection. So far, they are all functional, so I have not tried to repair / reload the FW (except for the last update). it is possible -> Link ooo good to know it's compatible [Read more]

Sas_AS 28 Feb 2016 19:55

Okay, it got a little brighter. You just have to figure out how to take over the flash content, maybe something in the frame or the temp appears at the moment of updating (although logitech is probably... [Read more]

rekinisko 28 Feb 2016 20:05

Generally, Logitech's communication is based on the NRF algorithm. The data that is needed is the encryption key and the channel frequency. Earlier receivers could only work with one device, later... [Read more]

Sas_AS 28 Feb 2016 20:28

It is 90% correct, as I wrote earlier, but the old one (with a red border) could also work with 2 devices. This is the situation with the MK270 set, which was introduced for sale before the unifying technology,... [Read more]

rekinisko 28 Feb 2016 22:30

As you wrote. There are at least two types with red color without the unifying logo. There are still 500Hz, 1000Hz for gamers, with blue color for headphones, there is a bit of it. Recently, I had a lot... [Read more]

FAQ

TL;DR: 100 % of Logitech nRF24-based dongles are rated for only 1 000 flash cycles, so “you pay extra for a better soft in the receiver and that's it” [Elektroda, piotr_go, post #15480774] Logitech’s 2016 patch does NOT stop keystroke injection demonstrated in this thread [Elektroda, piotr_go, post #15473003]

Why it matters: Knowing chip limits, firmware quirks and attack vectors lets you repair gear—or secure it—before surprises strike.

Quick Facts

• Unifying receivers can pair with 6 – 8 devices in one USB port [Elektroda, Sas_AS, post #15480117] • Red-border (non-Unifying) dongles usually handle only 1 – 2 devices [Elektroda, Sas_AS, post #15480117] • nRF24LU1P on most dongles: ~1 000 program/erase cycles [Elektroda, piotr_go, post #15480774] • Replacement Unifying dongle street price: PLN 25 – 40 (≈€6 – 9) [Elektroda, Sas_AS, post #15480842] • Tested control range: one average room (~5 m) [Elektroda, piotr_go, post #15479305]

What makes Logitech Unifying different from older red-border receivers?

Both use 2.4 GHz, but Unifying firmware lets one dongle talk to up to eight devices and stores multiple AES keys; red-border models store at most two keys and lack the multi-device protocol [Elektroda, Sas_AS, post #15480117] Hardware is often identical (nRF24LU1P or CC2544), the distinction is software.

Which RF chips are inside the various nano receivers?

Thread teardowns show: nRF24LU1P (newest orange, F710, 500 Hz); CC2544 (some Unifying and old red-border); nRF24L01 + Atmega90USB162 (very early models) [Elektroda, Sas_AS, post #15479526]

Is the wireless traffic encrypted?

Keyboards use AES-128; mice/pads often send unencrypted movement packets [Elektroda, piotr_go, post #15497992] Attackers who capture the pairing can decrypt keys; otherwise they can still inject because receivers accept properly-formatted packets without authentication after pairing.

Does Logitech’s MouseJack patch stop the attack shown here?

No. Piotr_go confirmed his method still works after the official patch: “the released Logitech patch does not block my way” [Elektroda, piotr_go, post #15473003] The fix tightened channel filters but did not add full packet authentication.

Why does my K400/K270 stop pairing after repeated attempts?

The keyboard stores pairing data in small OTP (one-time programmable) memory. Once full, no new keys fit; only UV exposure could erase it [Elektroda, piotr_go, post #16887047] This planned-obsolescence edge-case leaves the board unable to connect to new dongles.

What range can I expect, and how can I extend it?

Standard nano receivers work reliably within one room (~5 m); F710 tests showed no “sensational” reach [Elektroda, piotr_go, post #15479305] A larger antenna or centrally-placed USB extension cable can add several metres, but walls still attenuate 2.4 GHz signals.

How do I revive a bricked Unifying receiver?

  1. Short RESET and GND to enter DFU mode (nano pads shown in photo) [Elektroda, Sas_AS, post #15479526]
  2. Run Logitech Firmware Update; if it reports “DFU receiver”, click Update.
  3. If update fails, flash known-good .bin via your custom boot-loader, then re-run Logitech software [Elektroda, piotr_go, post #15480722]

How can I detect Logitech packets amid 2.4 GHz noise?

Look for packets that pass a Nordic CRC; “The microwave oven does not send CRC” [Elektroda, piotr_go, post #15474593] Once channels and addresses match, payload patterns reveal keyboard or mouse frames.

What simple steps reduce the risk of wireless-keyboard attacks?

  1. Update dongle firmware to the latest Unifying build (e.g., 013.000.00001) [Elektroda, Sas_AS, post #15479526]
  2. Disable or unplug receivers when away; power-cycling breaks live sessions [Elektroda, george2002 & Kuniarz, #15477780-#15478301].
  3. Use strong OS logins; but remember wireless keystrokes can be sniffed, so prefer 2-FA or on-screen password tools.
Generated by the language model.
%}