KeySweeper - covert Microsoft wireless keyboard sniffer using Arduino and nRF24L01+

KeySweeper (http://samy.pl/keysweeper) is a stealthy Arduino-based device, camouflaged as a functioning USB wall charger, that wirelessly and passively sniffs, decrypts, logs and reports back (over GSM) all keystrokes from any Microsoft wireless keyboards (using proprietary 2.4GHz RF) in the area.

Keystrokes are sent back to the KeySweeper operator over the Internet via an optional GSM chip, or can be stored on a flash chip and delivered wirelessly when a secondary KeySweeper device comes within wireless range of the target KeySweeper. A web based tool allows live keystroke monitoring.

KeySweeper has the capability to send SMS alerts upon certain keystrokes being typed, e.g. "www.bank.com". If KeySweeper is removed from AC power, it appears to shut off, however it continues to operate covertly using an internal battery that is automatically recharged upon reconnecting to AC power.

http://samy.pl/keysweeper

By Samy Kamkar

0:00 Intro
0:59 Demonstration
1:11 Hardware used
5:33 Determining Keyboard Radio Frequency & Wireless Protocol
11:05 Sniffing 2.4GHz Proprietary RF
16:22 Decrypting Wireless Keystrokes
19:26 Using GSM for Internet and SMS
22:17 Powering and Usurping a USB Charger
25:36 Schematic

Subscribe to my channel for more Applied Hacking videos:    / subscription_c.  .

Follow me on Twitter:   / samykamkar  

Music by Darin Leach & Samy Kamkar (Epoch Rises    / epochrises  )
Intro graphics by Darin Leach: https://darinleachgraphics.com

Hardware:
Arduino Pro Mini / Teensy
Nordic nRF24L01+
Adafruit FONA GSM board
AC USB 5v 1A charger
Winbond W25Q80BV SPI Flash chip
3.7v Lithium Polymer/Ion (Lipo/Lion) battery

Software:
Key Sweeper, PHP, jQuery, jQuery Terminal, jQuery UI Virtual Keyboard

Also mentioned: HackRF, RTL-SDR, LO down converter, nRF24LE1H, nRF24LE1, nRF24L01, TI CC2500, Cypress CYRF6936, CYRF7936, Travis Goodspeed, GoodFET, KeyKeriki, Thorsten Schröder, Max Moser