How did this keyboard hack happen

[user_123]

Today someone hacked my keyboard at an airport via Bluetooth while I was sitting in the ticketing area waiting to check in. Wonder if anyone can identify what they installed or how they did this.

After using my MacBook a while, it was closed, and it began to beep endlessly, like when you’ve hit an inappropriate key. I assumed I had left my wireless keyboard on in my bag. I opened the MacBook and checked the Bluetooth menu and sure enough, it read that the keyboard was connected. But the behavior was odd. It only made the endless bad keystroke sound when I focused certain apps. Finally I realized when I tried to type into the url bar in a browser, anything typed would be deleted, and the bad keystroke sound would resume. So I restarted the machine.

While it was rebooting, I checked my wireless keyboard and it was off. When my machine restarted, the Bluetooth menu read that the keyboard was connected. When I would click on it to toggle it off, it would reconnect each time.

I noticed the very strange person next to me kept getting closer while he was doing something on his laptop, and that the reboot seemed to stop what he was doing. He got busy again when the machine booted up, and seemed bored again as soon as I killed the Wi-Fi and Bluetooth connection. I realized this guy was probably not waiting flor a flight at all. His behavior was really odd- shoes off, had to be asked by staff for basic common sense things, changed his pants (took them right off) right there in front of everyone. I left the Wi-Fi and Bluetooth off and he didn’t do anything else on his computer and seemed to suddenly not have anything to do.

I went to another part of the airport and turned the Bluetooth back on. Iremoved all the items on my Bluetooth menu. Soon, the keyboard reappeared in the menu, connected.

Does anyone know what he installed on my machine? It looks like he was able to hack my keyboard access through my Bluetooth connection. I wonder what he did and what I need to look for (e.g. brew install a root kit finder). Thanks a lot for any insight or help.

 

[Slartibart]

Which Macbook model? Which external keyboard model? Which version of MacOS?

First: you weren’t necessarily hacked. But:

When something like this happens you can check who (is) logged into your machine by opening a terminal and typing last then press return.
To search further back in time, open the MacOS Console. Here you access various options.



Check the recent folder in Finder - in the menu bar, click on Go>Recent Folders menu. Check additionally Recent Items.

In System Preferences > Security and Privacy, click on the Privacy tab and check two sections: Accessibility and Full Disk Access. Remove unwanted entries.




You can try to see wether a keylogger runs on your system via the activity monitor, some of these appear to use these known entries :

• Perfect Keylogger appears as DashboardClient in the monitor
• Spyrix as skm
• Look for ‘coreservicesd’ to find Aobo
• Check for ‘Elite Keylogger’ when searching Elite Keylogger.
• And finally, ‘Refog’ appears as ‘syslogd’

Problem is that keyloggers can hide and there are partly valid processes with these names. Try Malwarebytes to detect if - some - of these loggers are on your system.

Use one of the following key combos to bring the default install of a logger onscreen:

Perfect Keylogger	Ctrl-Alt-J
Elite Keylogger	Ctrl-Alt-S
Aobo for Mac	Ctrl-Alt-M
Refog	Option-Shift-Command-R

if you find your system is compromised contact law enforcement and ultimately Apple, so they can investigate and help you.




EDIT: disable remote login, screen sharing and remote management via the System preferences first.

 

[user_123]

@Slartibart thank you very much for the reply. I checked everything you listed; no installs for key commands, no running processes for those names. Preference advice taken.

Now that I’ve left that airport, the keyboard doesn’t appear in the Bluetooth menu.

This is a 16 inch 2019 MacBook running Monterey. My external keyboard is the standard apple white keyboard. (Magic keyboard)

Thank you very much for the info.

 

[Slartibart]

This is indeed a strange, somewhat intriguing anecdote. Anyway, enjoy your Mac! 😃