Concerning Corsair K100 keylogging

[James777Bond]

Back Story: I had a fellow coworker (let’s call him Bob) who recently build a new PC. He bought a brand new Corsair K100 keyboard of Amazon (sold and shipped). His build is less than a month old and has only downloaded game launchers (steam, blizzard, etc) and supporting software for hardware (iCue, Synapse). 
 

I guided him for his build which is why I know why he has and what he build. Giving him the liberty to choose all of his hardware with forcing him to learn and showing him what’s available. I’ve personally have build 20+ systems for friends and hundreds of hardware repairs and reimagining OSs.

 

Incident: I was frantically contacted via text that he was experiencing auto typing on text boxes. First thought, his keyboard has a bad key switch. I recommend disconnect the keyboard and plug it back in. And owning a K70 myself, I recommend that he could force a firmware on his keyboard. He contacted me back telling me that definitely, disconnecting the keyboard stopped typing in text box fields. Then told me he was in process of the firmware update. After, he told me the auto typing was completely gone. Said many thanks. 

 

This morning, he explained what he saw on his monitor. He saw exact keywords that he had typed on his own keyboard. I was shook. I had never heard of anyone encountering a true key logging keyboard. In addition, he said he saw the window pop up trying to rename the PC. He would see complete sentences written out that he had previously written out. And that’s we’re I became a bit disturbed. Bob told me he searched the Corsair forums and there are other users who have had the same experience.

 

Corsair forums: Bob then shared a post with other users who had the same problem. They also had even more concerning stories, including emails that were being typed back in their entirety a week later. Some have reported that it doesn’t even matter if iCue is installed. These posts are from a week ago and as early August of this year.
 

saving you a click…

“ It's a Wednesday at 8PM, I was just authoring a document and the keyboard starting typing full sentences from a sensitive chat conversation I was having early Monday morning, repeating keystrokes with control characters and all.  I saw it backspacing and correcting my sentence the same way I did.” -Travis1515

Discussion: I have advised Bob to not log on to sensitive accounts for a month just to verify that the forced firmware update fixed the issues. But the main issue is still concerning. Imagine buying this keyboard, use it, sell it, and now someone else has your keystrokes. I would recommend other people who have the same model board to, at least, do a forced firmware update. The true, scary, question is, is this intentional? Is someone trying to store keystrokes and use them for malice? Is this test firmware that automatically replies keystrokes to check if the keyboard works? 

 

Link:

https://forum.corsair.com/forums/topic/179736-k100-keyboard-randomly-starts-typing-on-its-own/

[NF-A12x25]

gamer keyboards  

[solado]

Quote

Is someone trying to store keystrokes and use them for malice?

Deffinatly not going to be this one, if someone keylogs your system they do it with as little evidence as possible. They want to hide in the background, gone are the days of messing about for fun now most hacks are financially motivated & the longer someone can sit in your system (or network) undetected the better.

[Middcore]

So somebody was such a good hackerman that they wrote this keylogger and then penetrated Corsair's systems to embed it in the Corsair peripheral software, if not the onboard memory of the keyboard itself, but is also such an inept hackerman that they can't keep the keylogger from spontaneously vomiting out stuff it logged at random and giving the whole thing away.

 

I don't buy it.

[Volbet]

With how this is described it doesn't sound nefarious. Rather, this sounds like either an error in Corsair's onboard macro-recording function or like user error, where people unknowingly start recording and executing macros. 

If it is indeed an error on Corsair's side, a firmware upgrade will hopefully fix it. 

 

I do own a Corsair K100, but I haven't encountered this error. 

[Middcore]

8 hours ago, Volbet said:

With how this is described it doesn't sound nefarious. Rather, this sounds like either an error in Corsair's onboard macro-recording function or like user error, where people unknowingly start recording and executing macros. 

 

I think this is the most plausible explanation.

[Drizzt]

On 10/31/2022 at 3:01 PM, James777Bond said:

Back Story: I had a fellow coworker (let’s call him Bob) who recently build a new PC. He bought a brand new Corsair K100 keyboard of Amazon (sold and shipped). His build is less than a month old and has only downloaded game launchers (steam, blizzard, etc) and supporting software for hardware (iCue, Synapse). 
 

I guided him for his build which is why I know why he has and what he build. Giving him the liberty to choose all of his hardware with forcing him to learn and showing him what’s available. I’ve personally have build 20+ systems for friends and hundreds of hardware repairs and reimagining OSs.

 

Incident: I was frantically contacted via text that he was experiencing auto typing on text boxes. First thought, his keyboard has a bad key switch. I recommend disconnect the keyboard and plug it back in. And owning a K70 myself, I recommend that he could force a firmware on his keyboard. He contacted me back telling me that definitely, disconnecting the keyboard stopped typing in text box fields. Then told me he was in process of the firmware update. After, he told me the auto typing was completely gone. Said many thanks. 

 

This morning, he explained what he saw on his monitor. He saw exact keywords that he had typed on his own keyboard. I was shook. I had never heard of anyone encountering a true key logging keyboard. In addition, he said he saw the window pop up trying to rename the PC. He would see complete sentences written out that he had previously written out. And that’s we’re I became a bit disturbed. Bob told me he searched the Corsair forums and there are other users who have had the same experience.

 

Corsair forums: Bob then shared a post with other users who had the same problem. They also had even more concerning stories, including emails that were being typed back in their entirety a week later. Some have reported that it doesn’t even matter if iCue is installed. These posts are from a week ago and as early August of this year.
 

saving you a click…

“ It's a Wednesday at 8PM, I was just authoring a document and the keyboard starting typing full sentences from a sensitive chat conversation I was having early Monday morning, repeating keystrokes with control characters and all.  I saw it backspacing and correcting my sentence the same way I did.” -Travis1515

Discussion: I have advised Bob to not log on to sensitive accounts for a month just to verify that the forced firmware update fixed the issues. But the main issue is still concerning. Imagine buying this keyboard, use it, sell it, and now someone else has your keystrokes. I would recommend other people who have the same model board to, at least, do a forced firmware update. The true, scary, question is, is this intentional? Is someone trying to store keystrokes and use them for malice? Is this test firmware that automatically replies keystrokes to check if the keyboard works? 

 

Link:

https://forum.corsair.com/forums/topic/179736-k100-keyboard-randomly-starts-typing-on-its-own/

This happened to me as well. I am not trolling. I recorded a video with my phone. I was scared I was hacked. I included a link to my post above.