Sophism: “The use of a convincing but untrue argument in order to deceive”

Blog

Mother Duck - A New Keystroke Injection Tool

At Sophism, we’ve always had a soft spot for keystroke injection attacks — not just because they’re cool, but because they expose a fundamental trust problem in modern computer systems.

If you're not familiar, here’s a quick primer. When you plug a USB device into a machine, it tells the operating system what it is — a keyboard, a mouse, storage, etc. The OS trusts that claim and loads the appropriate drivers. Users expect devices to "just work", which is what makes “plug and play” seamless across Windows, macOS, and Linux. But that trust can be abused. A device can lie about what it is, and the OS will believe it.

That’s the idea behind well-known tools like the Rubber Ducky from Hak5, as well as open-source projects like Rogan Dawes’ awesome ALOA (“a little offensive appliance”). These devices emulate keyboards and inject keystrokes directly into a target system, allowing an attacker to execute commands as if they were the legitimate user. With WiFi-enabled variants, attackers can remotely deliver payloads in real time from a phone within range. Think about the impact of a threat actor being able to send emails as the legitimate user (internal phishing, anyone?), or quietly download and execute a malware dropper via a hidden PowerShell window.

From a defensive perspective, this is a nightmare. These devices behave like legitimate peripherals, making them incredibly difficult to detect. And while they’re great for “drive-by” attacks, they’ve traditionally had two limitations: you need physical access, and you leave something visibly plugged into the machine (a forensic trace).

Recently, a client asked us a simple question: what if there was nothing to find?

That’s where things get interesting. Most computers already have internal USB interfaces on the motherboard — so instead of plugging a malicious device into an external USB port, we started exploring whether we could embed one directly inside a laptop. No external indicators, no suspicious hardware, nothing visible unless you know exactly where (and how) to look. We also thought about minimising forensic footprint — what if the implant acted purely as a proxy, leaving virtually nothing to analyse if it was ever discovered?

So we built something. We call it “Mother Duck”, and we’re about to deploy it as part of a red team engagement. A tiny, fully functional keystroke injection implant based on the ESP32-S3-MINI-1U microcontroller, designed to blend in with standard motherboard components and operate entirely out of sight. In other words: the same class of attack, but moved into the supply chain and physical layer — exactly where traditional controls struggle most.

If you’re responsible for security, it’s worth asking: how would you detect — or defend against — a user’s keyboard that an attacker effectively controls? At that point, you’re no longer looking for malware or rogue devices — you’re looking for subtle behavioural anomalies: commands executed at odd times, workflows that don’t quite match the human behind the keyboard, user activity that is technically valid but contextually wrong.

This is the kind of problem modern security teams need to be testing against. If supply chain attacks are on your threat model, we should talk.

We’ll share what we learn in a future post 🙂

Challenge Everything. Assume Nothing.

Strategic Adversary Thinking | Ethical Deception | Proven Resilience