Abstract

We discover that enabling both eavesdropping and non-invasive, per-key injection is viable on keyboards, in particular, the fast-emerging commodity Hall-effect keyboards. This paper introduces DualStrike, a new attack system that allows attackers to remotely listen to victim input and control any key on a Hall-effect keyboard. This capability opens doors to severe attacks (e.g., file deletion, private key theft, and tampering) based on the victim’s input and context, all without requiring hardware or software modifications to the victim’s computer. We present several key innovations in DualStrike, including a novel, compact electromagnet-based hardware design for high-frequency magnetic spoofing, a synchronization-free attack scheme, and a magnetometer-based listening mechanism using commercial off-the-shelf components. Our real-world experiments demonstrate that DualStrike can reliably compromise arbitrary keys across six recent Hall-effect keyboard models. Specifically, DualStrike achieves over 98.9% keystroke injection accuracy across all tested models. In an end-to-end test, the eavesdropping module achieves a high listening accuracy (i.e., above 99%). To improve the robustness of DualStrike, we implement a calibration algorithm to account for keyboard displacement, allowing it to maintain 98.5% injection accuracy even with offsets up to 4 cm. We also identified DualStrike’s immunity to existing magnetic shielding mechanisms and propose a novel shielding approach for Hall-effect keyboards. 

Demo Ⅰ：Disable User's input

DualStrike can disable user input by injecting random keystrokes at a high APM (approximately 5000 keystrokes per minute). 

User cannot distinguish their intended inputs from the randomly injected sequences. 

   (a) Disable User's input(SteelSeries Apex Pro)                        (b) Disable User's input(Corsair K70 MAX)

Demo Ⅱ：Targeted Keystroke injection with 100% accuracy

DualStrike can perform targeted keystroke injection with 100% accuracy. 

The attacker can send any specified sequence for injection attacks. 

Specifically, we demonstrate this by using a classic game:  Stardew Valley as an example, showing how the attacker can control the game character to move independently of the user's input. 

      (c) Targeted Keystroke Injection(Wooting 60 HE)                (d) Strange Happenings in Stardew Valley 

Demo Ⅲ：Login Suspension

DualStrike can cause user login suspension through keystroke injection. 

Specifically, by striking random keys and the "Enter" key twice, DualStrike can simulate rapid, incorrect login attempts. 

Once the error count exceeds a certain limit, the user will be locked out by the system and unable to log in. 

        (e) Login Suspension(Keydous NJ98-CP)                                     (f)  Login Suspension(Wooting 60 HE) 

Demo Ⅳ：Shuts Down the System In a Flash

DualStrike can inject a system shutdown command in a flash, leaving users no time to react. 

Specifically, for Windows systems, the shutdown can be executed by pressing Ctrl+X followed by pressing 'U' twice. 

(g) System Forced Shut Down(Wooting 60 HE)                 (h) System Forced Shut Down(Corsair K70 MAX)    

Q & A

Q1:  Which type of keyboards may be undermined?

A: DualStrike compromises Hall-effect keys. You may confirm whether your keyboard uses Hall switches by looking up the product description.