Hardware Hacking 101: Rogue Keyboards & Spy Cables
Federico Lucifredi demonstrates keystroke injection attacks, exploiting OS trust in USB HID devices to execute 1,000 WPM payloads via weaponized cables.
Summary
The Inherent Trust Model of USB Human Interface Devices (HID)
Operating systems automatically trust connected USB keyboards and mice without requiring administrative authentication or cryptographic device validation.
Deconstructing Keystroke Injection Attacks
Federico Lucifredi demonstrates how malicious microcontrollers disguised as USB cables or flash drives inject pre-programmed keystrokes at over 1,000 words per minute.
Live Demonstration of Host Compromise and Evasion
Lucifredi showcases launching hidden terminal shells, disabling antivirus defenses, and exfiltrating corporate data in seconds using weaponized USB hardware.
Defending Endpoints Against Malicious USB Devices
The author reviews defensive countermeasures—including USB port whitelisting, physical port blockers, and behavioral HID typing-speed heuristics.
Related talks
Main Track 1·29 min
Mark Williams · Rob Stanley
Demonstrates modifying ARM Cortex-M mouse firmware to covertly stage and deliver arbitrary payloads through standard USB HID interfaces in high-security tournament settings.
Hardware Hacking Village·20 min
Farith Mauro · Luis Mendoza
Demonstrates physical keystroke injection attacks and hardware implants exploiting USB Human Interface Devices.
Red Team Village·36 min
Mendoza · Mauro Cáseres
Mendoza and Mauro Cáseres demonstrate embedding BadUSB hardware implants inside commercial desktop speakers to silently execute keystroke injection.