Allegations a keylogger is embedded in the software of a popular gaming keyboard are dogging PC peripheral maker Mantistek.
The Chinese manufacturer is facing a blizzard of accusations that its popular GK2 Mechanical Gaming Keyboard has spyware installed and is sending keystroke data back to the company’s servers.
Roots of the claims trace back to user forum posts at online retailer Banggoood’s website and on Reddit. Users there claimed a forensic analysis of network traffic revealed the keyboard was sending data that appeared to be keylogger data without a user’s explicit permission.
Keyboard sleuths maintained the Mantistek GK2 Mechanical Gaming Keyboard was using a “cloud driver” that was sending keyboard data to a Mantistek server located on Alibaba Group’s cloud infrastructure.
“So apparently the software of the Mantistek GK2 is sending all our keypress to an Alibaba.com server! This is sick, imagine the level of information they have about passwords and logins,” wrote a Reddit user on Sunday.
Within the same timeframe, a number of other privacy-minded Mantistek GK2 Mechanical Gaming Keyboard owners began more closely monitoring their keyboard’s communications. In a forum post at the site Asia, users reported that the keyboard sent keypress statistic files (/cms/json/putkeyusedata.php and /cms/json/putuserevent.php.) in plain text to two Alibaba destinations.
However, the story changed two days later.
Now, according to reports by Tom’s Hardware, prior allegations were incorrect. Further analysis of the keyboard’s behavior indicate the keyboard captured “how many times keys have been pressed” and not what keys were pressed.
“In a closer look, it seems that the Cloud Driver software doesn’t send the key presses to the Alibaba server but only how many times each key has been pressed,” Tom’s Hardware wrote Tuesday.
The theory has now shifted from Mantistek offsetting low price of the keyboards (under $50) by selling user data to now the company just wanting to better understand durability and failure rates of its keyboards.
Mantistek could not be reached for comment. Alibaba Group and large online sellers of Mantistek keyboards such as Amazon and Banggoood did not return email requests for comment.
Despite glaring privacy concerns being snuffed, users are still irked Mantistek is capturing any keystroke data at all. Several simple workarounds have been posted online, include disabling the keyboards Cloud Driver software to blocking network access.
