DualStrike: Accurate, Real-time Eavesdropping and Injection of Keystrokes on Commodity Keyboards

DualStrike: Accurate, Real-time Eavesdropping and Injection of Keystrokes on Commodity Keyboards

Speakers: Xiaomeng Chen

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=KorydOCokaE

Overview

DualStrike is the first attack system to achieve both eavesdropping and injection on commodity hall effect keyboards -- a rapidly growing keyboard technology used primarily in gaming but expected to expand into laptops. By placing an array of electromagnets and magnetometers underneath a desk surface, the system can listen to keystrokes with near 100% accuracy and inject characters at over 40 keystrokes per 200 milliseconds (faster than a human eye blink), achieving 100% injection accuracy across all 51 targeted keys.

The attack exploits the fundamental operating principle of hall effect keyboards: they use permanent magnets in key switches to trigger keystrokes through magnetic field changes detected by hall effect sensors. Only 9 microtesla is sufficient to trigger a keystroke, making both eavesdropping and injection feasible through standard desk surfaces. The researchers also propose a practical countermeasure: embedding small ferromagnetic chips beneath each hall sensor, which reduces injection accuracy to zero without affecting keyboard functionality. All hardware designs and software are open-sourced.

Background

▶ Watch: Hall effect keyboards: how magnetic sensing replaces mechanical switches (0:00)

Hall effect keyboards represent a significant shift in keyboard technology, replacing the mechanical contact switches of traditional keyboards with contactless magnetic sensing. A permanent magnet embedded in each key switch moves up and down as the key is pressed, and a hall effect sensor underneath detects the changing magnetic field to register the keystroke.

This design offers several advantages over mechanical keyboards: contactless operation (theoretically unlimited lifespan), adjustable press distance (users can customize trigger sensitivity through firmware), and faster response times (important for competitive gaming). The market for hall effect keyboards has been growing exponentially, with major manufacturers entering the space, and there is speculation that the technology will be integrated into laptops.

Prior keyboard attack research has explored visual methods (shoulder surfing), acoustic side channels, and electromagnetic eavesdropping on legacy keyboard multiplexers. For injection, previous work includes BadUSB (physical USB insertion) and GhostType (electromagnetic injection on legacy keyboards). However, GhostType could not achieve per-key injection, limiting its practical impact. No previous work has achieved both eavesdropping and injection on hall effect keyboards specifically.

Key Findings

▶ Watch: Prior work limitations and the dual eavesdropping+injection goal (4:00)

Only 9 microtesla triggers a keystroke. Reverse engineering of proprietary hall effect sensors (which lack public datasheets) revealed that the magnetic field threshold for triggering a keystroke is remarkably low -- 9 microtesla. The relationship between key press distance and magnetic field strength follows a cubic relationship.

Near-100% eavesdropping accuracy. Using 8 magnetometers placed underneath the keyboard, the system classifies which key is pressed with accuracy approaching 100%, using a lightweight MLP (multi-layer perceptron) classifier. The magnetic field patterns from different keys are highly distinctive.

100% injection accuracy at over 10,000 actions per minute. An array of suction electromagnets can inject keystrokes at speeds far exceeding human typing, achieving 100% accuracy across all 51 targeted keys. More than 40 characters can be injected within 200 milliseconds -- faster than a human eye blink.

End-to-end attack enables real-time eavesdropping + injection. By combining both capabilities, an attacker can monitor what the user types (including passwords and sensitive data) and inject malicious commands (deleting root files, downloading malware) in a single system hidden beneath the desk.

5x faster switching through circuit optimization. Adding additional power sources per electromagnet reduced current rise time, improving electromagnetic switching frequency by 5x -- critical for achieving the high injection speeds.

Calibration handles keyboard displacement. A calibration technique using predetermined key sequences (e.g., public Wi-Fi passwords) estimates keyboard displacement in x, y, and rotation angle, maintaining ~90% accuracy even with misalignment.

Practical countermeasure identified. Small ferromagnetic chips placed beneath each hall sensor shield against external magnetic interference, reducing injection accuracy to zero without affecting normal keyboard operation.

Technical Deep Dive

▶ Watch: Eavesdropping with magnetometers and injection with suction electromagnets (8:00)

Reverse engineering proprietary sensors: Hall effect keyboard manufacturers use proprietary sensors without public datasheets. The researchers built a caliper-based test fixture to precisely control key travel distance while measuring magnetic field readings, establishing the 9-microtesla threshold and the cubic distance-field relationship.

Eavesdropping module: Eight magnetometers positioned beneath the keyboard in a strategic array capture magnetic field changes during keystrokes. The signal processing pipeline includes preprocessing, peak detection (producing clear per-keystroke peaks), and MLP classification. The distinct magnetic signatures of each key position enable high-accuracy classification.

Injection module: Finite element analysis (FEA) was used to evaluate different electromagnet types (solenoids vs. suction magnets). Suction electromagnets (commonly used in door locks) were selected for their stronger, more concentrated magnetic fields. The optimal core ratio was determined through simulation. An array of 51 electromagnets targets the most common keys. RL circuit modeling identified the current rise time as the bottleneck for injection speed, solved by adding dedicated power sources per electromagnet (5x improvement).

System integration: The complete system fits beneath a standard desk, with 51 electromagnets for injection and 8 magnetometers squeezed between them for eavesdropping. Table thickness variation was tested, with the system maintaining reliable performance across typical desk thicknesses.

Calibration: When users move the keyboard, the attack accuracy degrades due to the cubic distance-field relationship. The calibration technique prompts users to type known sequences (like public Wi-Fi passwords), then uses the observed magnetic patterns to estimate x/y displacement and rotation angle mathematically.

Demo / Proof of Concept

▶ Watch: System integration: 51 electromagnets and 8 sensors beneath desk (10:00)

A demonstration site shows DualStrike in action, performing real-time eavesdropping and injection on commodity hall effect keyboards. The evaluation tested six popular hall effect keyboards on the market.

Key results:

• Eavesdropping: Near-100% accuracy across all tested keyboards
• Injection: 100% accuracy across all 51 targeted keys, even at 10,000+ actions per minute
• Speed: 40+ characters injected in 200ms (eye-blink time)
• Robustness: ~90% accuracy maintained with keyboard displacement in x, y, and rotation
• Distance: Functional through standard desk surfaces; up to 10cm with higher-voltage power sources

The countermeasure (ferromagnetic chip shielding) was validated to reduce injection accuracy to zero.

Defensive Implications

▶ Watch: Countermeasure: ferromagnetic chips reduce injection to zero (14:00)

For keyboard manufacturers: The most effective defense is embedding small ferromagnetic chips beneath each hall effect sensor during manufacturing. This is a low-cost, non-intrusive modification that eliminates the injection attack vector without affecting normal keyboard functionality. Manufacturers should adopt this as a standard design practice.

For high-security environments: Organizations handling classified or sensitive information should be aware that hall effect keyboards introduce a new electromagnetic attack surface. Until countermeasures are standard, sensitive environments should either use traditional mechanical keyboards or implement physical shielding beneath desks.

Broader implications for hall effect sensors: The Q&A revealed that hall effect sensors are used in automotive ABS braking systems (detecting wheel rotation), BMW gear switching, and smartphone compasses. The same magnetic interference principles could potentially affect these systems, representing a broader safety concern beyond keyboards.

For users: The attack requires physical proximity (the array must be placed beneath the desk), making it primarily a targeted attack vector rather than a mass exploitation technique. However, in shared workspaces, coworking spaces, or hotel business centers, this is a realistic threat model.

Key Takeaways

• Hall effect keyboards can be both eavesdropped and injected through a desk surface using only 9 microtesla of magnetic field
• Near-100% eavesdropping accuracy and 100% injection accuracy across 51 keys at 10,000+ actions per minute
• 40+ characters can be injected in 200ms (faster than an eye blink), enabling instant malicious command execution
• End-to-end attack combines eavesdropping and injection: monitor passwords, then inject malicious commands
• Ferromagnetic chip countermeasure reduces injection accuracy to zero without affecting keyboard function
• All hardware and software are open-sourced; demo site available
• Hall effect sensor vulnerability extends beyond keyboards to automotive and other safety-critical applications

About the Speaker(s)

The talk was presented by Don Chin on behalf of the first author Xiaomeng Chen (master's student who could not attend due to visa issues). Chen is described as a passionate system builder focused on human-machine collaborative systems. The research demonstrates expertise in electromagnetic engineering, reverse engineering, and embedded systems security.