The Anti-virus Times

The developers behind the SwiftKey keyboard disabled the cloud sync feature after users reported that other people's email addresses and phone numbers were appearing on the prediction bar. Users complained that the keyboard’s predictive text feature was suggesting other users' phone numbers and email addresses to them. They also reported incidents of the language settings changing without their knowledge.

The SwiftKey keyboard application stores user input history in the cloud. Thus, it uses this information to personalize the predictive text feature separately for each user. But, it turned out that an issue with the SwiftKey cloud was resulting in users receiving information about other people's keystrokes.

Currently, the company is claiming that there is no reason to panic and that the problem isn’t really a security issue.

https://blog.swiftkey.com/important-information-relating-to-the-status-of-our-sync-services

http://www.anti-malware.ru/news/2016-08-01/20502

I reversed engineered the Logitech dongle DFU process so they can run custom firmware and be used for nRF24L sniffing/injection.

https://twitter.com/marcnewlin/status/756229468851695616

He turned the Unifying Dongle into a sniffer. As far as I can tell, attackers can send fake clicks to the Logitech dongle.

https://geektimes.ru/post/278904

Samy Kamkar crafted a device that covertly collects data from the wireless keyboards of certain manufacturers including Microsoft.

Kamkar's device looks like a USB charger. Just leave it in a room where wireless keyboards are being used and the device will log every keystroke.

The gadget can use an internal battery as well as an electrical outlet. If you disconnect it from a power supply, the red LED indicator will turn off, but the device will remain operational.

Information about the package contents, an assembly manual, and KeySweeper software download links are published on Samy Kamkar's blog at GitHub.

https://tjournal.ru/p/keysweeper

http://www.securitylab.ru/news/469775.php

Wireless keyboards manufactured by Hewlett-Packard, Toshiba, Kensington, Insignia, Radio Shack, Anker, General Electric, and EagleTec contain a vulnerability that lets attackers intercept keystrokes from a distance of up to 75 meters.

It turned out that 8 out of the 12 keyboards examined do not encrypt the data they transmit.

"As far as I know, there is no way to update the firmware for these devices, because it is hardcoded in the chip on the board. That's why there is no way to solve the problem by somehow toggling on encryption”, Marc Newlin said.

Previously, the security researcher with Bastille Networks reported that clicks could be injected remotely into wireless mice. He was able to send commands that imitate keystrokes (not mouse clicks) from a distance of 225 meters. And the operating system interpreted these signals correctly by performing the corresponding tasks or inserting a symbol in the text editor.

https://geektimes.ru/post/278904