Hacking a Computer via Hotkeys

---

When setting up comprehensive security, there are numerous recommendations, and the necessity of following them depends on your level of paranoia and the threats you wish to protect yourself from. One such recommendation will be discussed today. I will neither advise you to follow it nor dissuade you – I will simply present it as it is.

I previously wrote about the BadUSB attack. This is a very dangerous attack where a device connected via a USB port begins to impersonate another device. For example, a USB flash drive presents itself to the computer as a keyboard and gains all the privileges of a keyboard.

Such devices can be purchased on forums in the darknet and on AliExpress. Here is an example of such a product; I have not tested it myself, but I will trust the reviews and description.


As you can understand, the device can be controlled remotely by sending keystrokes to the target computer. At first glance, this may seem like nothing more than a fun toy; however, everything changes when we remember about hotkeys.

Hotkeys allow you to launch various applications and control them by pressing combinations on the keyboard. For example, thanks to hotkeys, you can launch the terminal and execute the necessary commands in it.

So, the attacker inserts this flash drive into the victim's computer, and the computer perceives it as a keyboard. Then, using hotkeys, the attacker launches the terminal/console.

For example, in macOS, you can launch the combination command+space, then type "terminal" and <Enter>. Windows users can launch the console with the key combination Win+r, then type cmd and press <Enter>.


The terminal/console/command line is a tool for managing the computer using commands. After launching the terminal/console, the attacker has a multitude of opportunities even without administrative rights, such as copying files from the computer and sending them to a server or simply deleting them.