Goal

• remote control 
• desktop sharing
• leak keyboard log

Motivation

• hack classmate's computer
• USB is easy to get
• Poisontap is interesting?
• 127's childhood dream

USB classes

Faking classes -> Faking device 

Victim

Attacker

Pi

Problems

• Attacker need to be close by
• Attack does not persist after pi is disconnected
• Victim may notice he's hacked!

Victim

Victim

Then... We can

• Windows + R -> open powershell
• problem: 中文輸入法 (Shift not works)
• Solution: Ctrl+Space

Simulate What?

USB Hub

Not only a keyboard,

but also a USB storage!

Use cmd to move our file from USB storage to victim

• easy be detected

Hide it ?

But...

However...

Well...

What if the victim reboot?

Put our program under /user/.../startup

-> execute as routine startup

Victim

Victim

RCE again

RCE

Victim

Our server's ip will be exposed to victim!

Large Traffic Detection

Victim

Slow Network Detected

RCE ->

Leak Information

Leak Infromation?

Eavesdrop your keyboard & window!

IP Exposure?

Upload to trusted server, like youtube stream

tlk.io!

Victim

Meow

Trusted Chatting Server!

Don't plug unknown USB :)

Don't plug untrusted IoT :)