We discover that enabling both eavesdropping and non-invasive, per-key injection is viable on keyboards, in particular, the fast-emerging commodity Hall-effect keyboards. This paper introduces DualStrike, a new attack system that allows attackers to remotely listen to victim input and control any key on a Hall-effect keyboard. This capability opens doors to severe attacks (e.g., file deletion, private key theft, and tampering) based on the victim’s input and context, all without requiring hardware or software modifications to the victim’s computer. We present several key innovations in DualStrike, including a novel, compact electromagnet-based hardware design for high-frequency magnetic spoofing, a synchronization-free attack scheme, and a magnetometer-based listening mechanism using commercial off-the-shelf components. Our real-world experiments demonstrate that DualStrike can reliably compromise arbitrary keys across six recent Hall-effect keyboard models. Specifically, DualStrike achieves over 98.9% keystroke injection accuracy across all tested models. In an end-to-end test, the eavesdropping module achieves a high listening accuracy (i.e., above 99%). To improve the robustness of DualStrike, we implement a calibration algorithm to account for keyboard displacement, allowing it to maintain 98.5% injection accuracy even with offsets up to 4 cm. We also identified DualStrike’s immunity to existing magnetic shielding mechanisms and propose a novel shielding approach for Hall-effect keyboards. 

Hall-effect switches cannot distinguish magnetic fields generated by legitimate keystrokes from those introduced externally, while their magnetic variations can also leak information about key movements. Exploiting this fundamental vulnerability, we develop an attack model that achieves both real-time keystroke eavesdropping and non-invasive, per-key keystroke injection. The attack is also robust against practical disturbances, such as keyboard displacement, making it applicable to realistic usage scenarios. With DualStrike, an attacker can:
Eavesdrop on sensitive user inputs, such as root and system passwords, and then use the captured context to launch targeted keystroke injections. For example, the attacker may execute malicious commands, download malware, or tamper with sensitive files—all without modifying the victim’s keyboard or computer.