Screen Crab

Key Capabilities

1. Stealth Video & Screenshot Interception:

• • Passively captures display output directly from the HDMI cable. Because it operates strictly at the hardware level, the target operating system has no knowledge that the video signal is being recorded.

2. Zero Host Performance Impact:

• • Unlike software screen recording tools (which consume CPU and RAM and can be detected by Task Manager or Antivirus software), the Screen Crab operates independently and never slows down the computer.

3. Smart Image Deduplication (DEDUPLICATE):

• • Saves memory by comparing captured frames. If the screen remains on a static image (such as an idle desktop or wall dashboard), the Screen Crab skips saving identical duplicates to avoid filling up storage.

4. Wi-Fi & Remote Streaming:

• • Equipped with onboard Wi-Fi to stream captured screenshots and live video directly to a remote security server (Hak5 Cloud C2) or send real-time visual alerts over the network.

5. MicroSD Media Storage:

• • Saves full-quality JPEG screenshots and MP4 video recordings directly to a MicroSD card for local retrieval during physical audits.

Best Uses & Scenarios

1. Visual Data Exfiltration Audits:

   • Demonstrates how sensitive information displayed on screens—such as unencrypted passwords, medical records (HIPAA), financial statements, or customer PII—can be stolen visually even if the network is locked down.

2. Kiosk, ATM & Point-of-Sale (POS) Assessments:

   • Evaluates public-facing digital displays, self-checkout kiosks, or banking terminals where the back of the display screen might be physically accessible to bad actors.

3. Air-Gapped & Legacy System Monitoring:

   • Allows security auditors to monitor high-security, air-gapped servers or legacy industrial consoles where installing software agents is strictly prohibited or technically impossible.

4. Physical Red Team & Cable Management Audits:

   • Tests whether office staff notice unauthorized hardware dongles connected to the back of their desktop monitors or conference room displays.

Key Defensive Mitigations 

Because the Screen Crab intercepts visual signals at the physical cable level, software antivirus tools cannot block it. Strong protection requires physical and procedural safeguards:

1. Physical Cable & Port Inspection:

   • Establish routine physical security walk-throughs to inspect the backs of monitors, docking stations, and display walls for unauthorized dongles or inline adapters.

2. Cable Enclosures & Lockable Display Backs:

   • Encase display ports and monitor connections in locked security cages or tamper-resistant conduit, especially on public kiosks, ATMs, and reception desks.

3. Tamper-Evident Port Seals:

   • Apply numbered security seals over HDMI and DisplayPort connections on critical workstations (e.g., domain admin desks, financial processing terminals).

4. Screen Shielding & Privacy Filters:

   • Use physical polarized privacy filters on monitors displaying sensitive credentials or customer information to block line-of-sight viewing and visual capture.

5. Clean Desk & Physical Security Awareness:

   • Train personnel to report any unfamiliar hardware dongles, extra cables, or loose adapters attached to their workstation monitors.

Helpful links:

Screen Crab Product Page
Screen Crab Documentation page
Hak5 Youtube channel