Access to keyboards are still instant win buttons
Like the old answer, compromised keyboards are prime targets to hacking because so much sensitive information passes through them. Mice are probably a good thing to compromise but I don't know how much they add.
It's very common for high security computer networks to be protected by what's known as an 'air wall' or 'air gap'. These are designed to drastically increase the difficulty when exfiltrating data from a secured computer/network. Combined with the inaccessibility of the target locations by radio, this raises an interesting problem...which requires interesting solutions.
Occasionally, high security computers will be put in close physical proximity to low security computers that have (direct or indirect) access to the internet. The air gap still exists between those two computers, so we need someway to jump the gap.
Jumping the Gap
Using the USB cable tampering technique described below, in the keyboard include an SoC that is capable of driving the USB antenna (I mean, EMI shroud) as a transmitter or receiver.
Each SoC will be capable of the following:
- Detecting whether this computer is capable of connecting to the broader Internet
- Driving the radio receiver
- Driving the radio transmitter
- Storing key presses and mouse strokes for later transmission.
If a keyboard detects that it can connect through the PC to the Internet, it will put itself in receiver mode and begin to store the transmissions from nearby keyboards. Else, the keyboard will put itself into transmit mode and start broadcasting all keystrokes. A small amount of overcurrent may be required to get acceptable transmit ranges. As with the old answer, a fingerprint should be added to each keyboard to ensure that keystroke streams can be properly analyzed.
As time goes by, the receiver keyboards will collect keystroke streams from the transmitting keyboards. Possibly, using a virtual USB network device built into the SoC, the keyboard can upload data to the appropriate network. Care must be taken to ensure that these transmissions don't look like exfiltration traffic. Perhaps a few bytes an hour on well-known service ports? You'll have to contend with firewalls, blocked ports and a host of other network defense measures. That SoC plays a huge role in getting out the required data.
Access to keyboards and mice are instant win buttons
All of the other office supplies are yeah, kind of useful, for espionage (I can think of ways to track internal supply chains by doping printer toner with "fingerprint" chemicals). BUT! Keyboards and mice are super win. Every password is typed on a keyboard. Every secret letter is typed on a keyboard.
Putting micro storage devices in to keyboards and mice doesn't make a ton of sense since USE can't reliably recover devices at disposal. Even if they could be recovered, keyboards and mice can stay in service for many years. With perfect storage these devices would contain data from a "long long time ago" which would be of decreased value compared to data of "this happened five minutes ago". Further, let's assume that CoC is super paranoid and destroys all electronic devices on retirement. (Doing so would be really good operational security. I'd be surprised if they didn't do this.)
USE should do the following to selection of keyboards: Leave the USB cable shield floating and add a 'fingerprint' to each keyboard.
Interesting. However, I think that the shield (cable braid and plug/socket shell) must be connected to ground on at least one end. If the shield were left floating, then other signals would be able to couple to it and use the shield as a nice long antenna to radiate EMI. (source)
The 'fingerprint' for each keyboard ensures that USE spies can differentiate between affected keyboards. It'd be a shame to have five spying keyboards but the data isn't useful because you can't tell one keyboard from another.
Need more range? Embed a radio-reflective layer of metal into the whiteboards and build in an ever so slight concave curve with a focal length of several hundred meters. To gather these reflected signals, station a listen post at the focus of the whiteboard.
You've basically turned affected keyboards into miniature radio towers. I'm not an electrical engineer so I can't tell you the range of transmission but any range of transmission is an exploitable property. Combine this with some kind of recording device that listens for data from these keyboards and you've got a first rate espionage tool.
The benefit of this approach is that if detected, it is merely a manufacturing defect in the keyboard, not an overt attempt at espionage. Care must be taken to ship 'defective' keyboards at or below the typical failure rate for keyboards (I wasn't able to find a source for what the defect rate is.) Stuxnet survived for a very long time because it didn't do anything beyond making centrifuges wear out faster.
This attack also doesn't rely on the Internet to get data out.
You can't control where the keyboards are deployed so you may end up with some less than useful placements. You're unlikely to get a juicy stream from the Supreme High Leader of the People's Republic personal machine. However, you are likely to get intel from his secretary. Remember, secretaries know everything.
Keylogging attacks reveal passwords, usernames, meeting agendas, private notes to colleagues, internal dissent (if any), operating procedures, power hierarchies, office politics, (after analysis) possible recruits.
No handwavium required. All proposals for espionage with these tools can be accomplished with 2017 level tech.