Going the Distance - Long Range Keystroke Injection via LoRa Mesh Networks

The talk opens with a building-infiltration scenario: an attacker gets brief physical access, plants a device, and needs a way to trigger it later. The speaker reviews the limits of existing USB keystroke-injection tools. Prerecorded payloads are fire-and-forget, and their Wi-Fi command channels are useless on air-gapped networks. The proposed alternative is a device that receives text commands over long-range LoRa radio and relays them through the Meshtastic mesh, so no internet or Wi-Fi is needed.

The middle of the talk covers the build. The project, M.I.A., re-implements the Meshtastic protocol on a radio library instead of the stock firmware. Most of the difficulty was getting LoRa radio parameters exactly right, decoding protobuf field structure, and fixing AES counter-mode nonce handling. The speaker also noted a key-size discrepancy on the default channel. Commands use a text prefix that the device parses into keystrokes. A live demo sent a command from a stock node that made the target machine open a website.

The speaker closes by listing limits: physical access is still required, range depends heavily on obstacles, and mesh traffic is hard to detect. For defenders, the suggestions were controlling which USB devices may connect and scanning for unexpected radio activity with software-defined radios. The firmware, hardware design and tooling are promised as open source.