The class of bug is worth understanding because it sidesteps everything else on your machine. Full disk encryption, a hardened browser, a password manager, hardware-backed second factors: all of it assumes that what arrives at the keyboard driver was typed by the person sitting at the desk. A radio that can forge keystrokes makes that assumption false, and the operating system has no way to tell the difference. Human interface device input carries no origin.
MouseJack and the trust asymmetry
In February 2016, researchers at Bastille Networks published findings under the name MouseJack, covering wireless mice and keyboards from a long list of vendors including Logitech, Dell, HP, Lenovo, Microsoft, Gigabyte and Amazon Basics. The devices used proprietary protocols over 2.4GHz, generally built on Nordic Semiconductor nRF24 transceivers, rather than Bluetooth.
The core problem was an asymmetry in how the dongles treated the two device types. Keystrokes were often encrypted. Mouse movement, being considered uninteresting, frequently was not. But many dongles did not enforce which kind of packet could arrive on which channel. Send a forged, unencrypted packet that looks like mouse traffic but carries a keyboard scan code, and the dongle passes it to the host as a keystroke.
Some dongles went further and accepted pairing requests without any user action, letting an attacker register an entirely new device against a receiver already plugged into a target machine.
The hardware required was a Crazyradio PA, a hobbyist nRF24 USB radio sold for roughly the price of a decent lunch, plus an antenna. The researchers demonstrated injection at around 100 metres. From a keystroke injection primitive, everything else follows: open a terminal, pull down a payload, run it. The same end state as a BadUSB device, without needing to touch the machine.
Many affected dongles had no firmware update path at all. The fix for those devices was to replace the hardware. Several vendors shipped updates for their current lines and left older models unpatched, which is why devices bought a decade ago and still in daily use remain a live issue rather than a historical one.
KeySniffer: keystrokes in cleartext
Five months later the same team published KeySniffer, which was worse and simpler. A set of lower-cost wireless keyboards, from vendors including HP, Toshiba, Kensington, Insignia, Anker, EagleTec and General Electric, transmitted keystrokes with no encryption whatsoever.
No pairing to intercept, no key to recover, no injection needed. The keyboards broadcast continuously on predictable frequencies, so an attacker within range could simply listen and record everything typed, including passwords, in real time. Because the transmissions were unencrypted and constant, the keyboards were also discoverable from a distance even when idle.
As with MouseJack, most of the affected models had no update mechanism.
The follow-up work on encrypted links
Encryption on the link is necessary and not sufficient. In 2019 the researcher Marcus Mengs published a series of findings against Logitech's Unifying receivers, a widely deployed system that does encrypt keyboard traffic. The issues included recovering the link encryption key by capturing or forcing a pairing, injecting keystrokes into an encrypted link, and extracting keys from a dongle over USB. Several CVEs were assigned and Logitech issued firmware updates for supported receivers.
Logitech's later Bolt receiver moved to Bluetooth Low Energy with Secure Connections rather than a house protocol, which is the correct direction: a published specification with public cryptanalysis beats an unpublished one, for the same reason Kerckhoffs's principle has held up for a century and a half.
Bluetooth is not free of problems either. The KNOB attack in 2019 showed that the encryption key negotiation could be forced down to a single byte of entropy, making the key brute-forceable. BIAS in 2020 covered impersonation during secure connection establishment. BLUFFS in 2023 broke session key derivation in a way that undermines forward and future secrecy across sessions. Each of these produced specification changes and vendor patches, which is exactly what does not happen to an undocumented proprietary protocol nobody is looking at. The wider Bluetooth attack surface is a separate subject.
| Link type | Public spec | Practical posture |
|---|---|---|
| Wired USB | Yes | No radio to attack. Still exposed to physical implants and malicious USB devices. |
| Bluetooth LE with Secure Connections | Yes | Real cryptography, public scrutiny, an update pipeline. Known attacks exist and get patched. |
| Modern proprietary 2.4GHz, encrypted | No | May be fine. Unverifiable from outside, and patched only if the vendor still cares about the model. |
| Older proprietary 2.4GHz | No | Assume keystroke injection is possible and cleartext interception may be. Often unpatchable. |
What makes this hard to detect
There is no log. The radio link is below the operating system's visibility, so nothing records that a packet arrived from a foreign transmitter. Injected keystrokes appear in the same input queue as real ones. If an attacker injects while the machine is unattended, or while the screen is off but the machine is awake, there may be nothing on screen to see either.
Endpoint security tools can sometimes catch the payload stage, since spawning a shell and fetching a file looks like what it is. They cannot catch the input stage. This puts the class alongside evil maid attacks in the category of threats that defeat software controls by operating beneath them.
Practical guidance, proportional to risk
For most people at home, this is a low-priority risk: an attacker needs proximity, and there are easier ways in. It rises sharply in shared offices, coworking spaces, hotel business centres, conference venues, and any environment where a stranger can sit within radio range of your desk for an hour. It rises again if you handle material that would justify the effort.
- Use a wired keyboard for high-risk work. Unglamorous and completely effective against this class.
- Prefer Bluetooth over a proprietary dongle. Not because Bluetooth is flawless, but because its flaws are published, numbered, and fixed on a schedule.
- Check for firmware updates on receivers you keep. Logitech, Dell and others publish update tools. Many older devices have none, which is itself the answer.
- Retire pre-2016 wireless sets used for anything sensitive. The economics favour replacement over research into whether your specific model was covered.
- Remove the dongle when travelling. A receiver left in a laptop in a hotel room is a listening post for whoever is in the next room.
- Do not assume the ten-metre figure. Manufacturer range is specified for a small stock antenna at both ends. An attacker brings a better antenna.
The general lesson extends past keyboards. Any device that speaks an undocumented radio protocol to a computer, and is trusted by that computer without further authentication, is asking to be taken at its word. Wireless presenters, some barcode scanners, and a good deal of consumer peripheral hardware share the pattern. The security review those protocols received was whatever the vendor chose to do, and you are not going to find out what that was.