Scott Schober TWEET:
@ScottBVS
Author of HACKED AGAIN & Expert #Cybersecurity Speaker & Contributor on Fox, Bloomberg, CNN, CNBC, ABC, WSJ, Huff Po. Wireless Threat Detection Tools
Time to get Antikeylogger @StrikeForceTech Built-in Keylogger Found in Keyboards—Sends Data to China
https://thehackernews.com/2017/11/mantistek-k...ogger.html
Built-in Keylogger Found in MantisTek GK2 Keyboards—Sends Data to China
Tuesday, November 07, 2017 Swati Khandelwal
Tweet
Share
28
Share
619
Share
4.24k
Share
Share
Mantistek-GK2-Mechanical-Gaming-Keyboard-Keylogger
"The right keyboard can make all the difference between a victory and a defeat in a video game battlefield."
If you are a gamer, you can relate to the above quote.
But what if your winning weapon betrays you?
The popular 104-key Mantistek GK2 Mechanical Gaming Keyboard that costs around €49.66 has allegedly been caught silently recording everything you type on your keyboard and sending them to a server maintained by the Alibaba Group.
This built-in keylogger in Mantistek GK2 Mechanical Gaming Keyboard was noticed by a few owners who headed on to an online forum to share this issue.
According to Tom's Hardware, MantisTek keyboards utilise 'Cloud Driver' software, maybe for collecting analytic information, but has been caught sending sensitive information to servers tied to Alibaba.
After analysing more closely, Tom's Hardware team found that Mantistek keyboard does not include a full-fledged keylogger. Instead, it captures how many times a key has been pressed and sending this data back to online servers.
The affected users also provided a screenshot showing how all your plain-text keystrokes collected by the keyboard are being uploaded to a Chinese server located at IP address: 47.90.52.88.
However, even if there's no malicious intent, capturing and uploading keystroke counts without users' consent violates trust and puts systems' security at risk by leaking sensitive information.
Mantistek-GK2-Mechanical-Gaming-Keyboard-Keylogger
Since Alibaba Group also sells cloud services like Google and Amazon, this collected information is not necessarily being sent to the Alibaba itself, but someone who is using its cloud service.
Opening the IP address in question directly into a web browser and on a Chinese login page, which translates to "Cloud mouse platform background management system" and is maintained by Shenzhen Cytec Technology Co., Ltd.
Reportedly, the MantisTek keyboard's software sends the collected data to two destinations at that IP address:
/cms/json/putkeyusedata.php
/cms/json/putuserevent.php
The best way to prevent your keyboard from sending your keystrokes to the Alibaba server is to stop using your Mantistek GK2 Mechanical Gaming Keyboard until you hear back from the company about this issue.
If you cannot prevent yourself from using the keyboard, but want to stop it from sending your key presses to the Alibaba server, just make sure the MantisTek Cloud Driver software is not running in the background, and block the CMS.exe executable in your firewall.
To block the CMS.exe executable, add a new firewall rule for the MantisTek Cloud Driver in the "Windows Defender Firewall With Advanced Security."
@ScottBVS
Author of HACKED AGAIN & Expert #Cybersecurity Speaker & Contributor on Fox, Bloomberg, CNN, CNBC, ABC, WSJ, Huff Po. Wireless Threat Detection Tools
Time to get Antikeylogger @StrikeForceTech Built-in Keylogger Found in Keyboards—Sends Data to China
https://thehackernews.com/2017/11/mantistek-k...ogger.html
Built-in Keylogger Found in MantisTek GK2 Keyboards—Sends Data to China
Tuesday, November 07, 2017 Swati Khandelwal
Tweet
Share
28
Share
619
Share
4.24k
Share
Share
Mantistek-GK2-Mechanical-Gaming-Keyboard-Keylogger
"The right keyboard can make all the difference between a victory and a defeat in a video game battlefield."
If you are a gamer, you can relate to the above quote.
But what if your winning weapon betrays you?
The popular 104-key Mantistek GK2 Mechanical Gaming Keyboard that costs around €49.66 has allegedly been caught silently recording everything you type on your keyboard and sending them to a server maintained by the Alibaba Group.
This built-in keylogger in Mantistek GK2 Mechanical Gaming Keyboard was noticed by a few owners who headed on to an online forum to share this issue.
According to Tom's Hardware, MantisTek keyboards utilise 'Cloud Driver' software, maybe for collecting analytic information, but has been caught sending sensitive information to servers tied to Alibaba.
After analysing more closely, Tom's Hardware team found that Mantistek keyboard does not include a full-fledged keylogger. Instead, it captures how many times a key has been pressed and sending this data back to online servers.
The affected users also provided a screenshot showing how all your plain-text keystrokes collected by the keyboard are being uploaded to a Chinese server located at IP address: 47.90.52.88.
However, even if there's no malicious intent, capturing and uploading keystroke counts without users' consent violates trust and puts systems' security at risk by leaking sensitive information.
Mantistek-GK2-Mechanical-Gaming-Keyboard-Keylogger
Since Alibaba Group also sells cloud services like Google and Amazon, this collected information is not necessarily being sent to the Alibaba itself, but someone who is using its cloud service.
Opening the IP address in question directly into a web browser and on a Chinese login page, which translates to "Cloud mouse platform background management system" and is maintained by Shenzhen Cytec Technology Co., Ltd.
Reportedly, the MantisTek keyboard's software sends the collected data to two destinations at that IP address:
/cms/json/putkeyusedata.php
/cms/json/putuserevent.php
The best way to prevent your keyboard from sending your keystrokes to the Alibaba server is to stop using your Mantistek GK2 Mechanical Gaming Keyboard until you hear back from the company about this issue.
If you cannot prevent yourself from using the keyboard, but want to stop it from sending your key presses to the Alibaba server, just make sure the MantisTek Cloud Driver software is not running in the background, and block the CMS.exe executable in your firewall.
To block the CMS.exe executable, add a new firewall rule for the MantisTek Cloud Driver in the "Windows Defender Firewall With Advanced Security."
1
