The Line-Up
// one single track.

Wireless keyboards are trusted implicitly: whatever the keyboard sends, the host types. Yet the 2.4 GHz links they use have drawn far less scrutiny than the Bluetooth stacks beside them, and the keyboard itself is a networked microcontroller that listens to, and acts on, whatever signals it receives. This talk presents a fully remote attack chain against a mass-market wireless mechanical keyboard, taking an attacker in radio range - no cable, no Bluetooth bond, no pairing, no code on the host or the keyboard - to passive keystroke recovery, keystroke injection into the logged-in host, and code execution on the keyboard's own microcontroller. The keyboard runs an open-source firmware fork, so the whole chain can be read straight from the source: every finding is citable and every fix is a concrete patch the audience can inspect. This is not a rerun of MouseJack, which spoofed unencrypted dongles to inject keystrokes into the host and stopped there. Here the keyboard itself is the target: its link ships AES and a pairing step and still falls, and the chain does not stop at the host but evolves keystroke injection into remote code execution on the keyboard's own microcontroller.

Reading the firmware shows the 2.4 GHz link is neither confidential nor authenticated. The AES key is the example key printed in the FIPS-197 specification, the keystream is selected by a 7-bit counter sent in the clear, and a fixed in-band magic is a permanent known-plaintext crib, so keystrokes decrypt off-air with no key recovery at all. The same receive path feeds an open USB keyboard-configuration protocol into the raw-HID handler with no auth check, dispatched identically to a wired frame. A forged, correctly-encrypted frame remaps a key or writes a macro so the victim's own keyboard types for the attacker, delivered by an ACK-window race against the dongle's brief post-transmit listen period.

That same protocol yields code execution. A buffer command copies an attacker-supplied length into a 32-byte stack buffer, the bound present only as a comment, overwriting the receive worker's saved return address for arbitrary PC on the Cortex-M4. The SoC marks SRAM execute-never, so injected shellcode faults; I defeat this with a short ROP chain that stores zero to `MPU_CTRL` before returning into now-executable RAM. The whole chain was confirmed on hardware, wirelessly, from a US$10 hobbyist radio driving dependency-free Python. Presented vendor-blind pending coordinated disclosure, the talk includes a live demo that demonstrates off-air keystroke decryption, a reversible over-the-air key remap, and injected code triggering an RGB rainbow on the keyboard's LED indicator.