Mike Ritland
๐ค SpeakerAppearances Over Time
Podcast Appearances
Not at this stage. So at this stage, we're just blindly sending keystrokes in, right? So as long as you know what OS it is or something like that, that's all you need on a desktop. I know if I hit Command Space, it's going to open up Spotlight on a Mac. And then I can open up Chrome and then go to the address bar, do some things, right? For example.
Like that's a very repeatable series of keystrokes. And you can do them really fast once you know it. Just for an example. Okay. All right. So that's the basics of the very core functionality. And then you combine that with keylogging and suddenly... You're getting a bigger picture here.
Like that's a very repeatable series of keystrokes. And you can do them really fast once you know it. Just for an example. Okay. All right. So that's the basics of the very core functionality. And then you combine that with keylogging and suddenly... You're getting a bigger picture here.
Like that's a very repeatable series of keystrokes. And you can do them really fast once you know it. Just for an example. Okay. All right. So that's the basics of the very core functionality. And then you combine that with keylogging and suddenly... You're getting a bigger picture here.
Oh, yeah, so you see a little window blink, right? That's basically your terminal. In that case, there's a lot of things I could do.
Oh, yeah, so you see a little window blink, right? That's basically your terminal. In that case, there's a lot of things I could do.
Oh, yeah, so you see a little window blink, right? That's basically your terminal. In that case, there's a lot of things I could do.
And then if you detect the Trojan on there and you remove it, and the cable's still in play, which it's designed to be, just put it right back on. No shit. Which is absolutely a thing that has happened with a bunch of my customers. They have told me that they did an engagement with a very high-profile client.
And then if you detect the Trojan on there and you remove it, and the cable's still in play, which it's designed to be, just put it right back on. No shit. Which is absolutely a thing that has happened with a bunch of my customers. They have told me that they did an engagement with a very high-profile client.
And then if you detect the Trojan on there and you remove it, and the cable's still in play, which it's designed to be, just put it right back on. No shit. Which is absolutely a thing that has happened with a bunch of my customers. They have told me that they did an engagement with a very high-profile client.
We can go into these types of things, but that reinfection vector is exactly what they used.
We can go into these types of things, but that reinfection vector is exactly what they used.
We can go into these types of things, but that reinfection vector is exactly what they used.
Either or. So all about flexibility. So you can program this a couple different ways. So what I showed was me remotely connecting to it and I hit go. But this can be configured that when it powers up, when it gets plugged in, it powers up. It can immediately run a payload. It can wait a series, however long you want, and then run a payload.
Either or. So all about flexibility. So you can program this a couple different ways. So what I showed was me remotely connecting to it and I hit go. But this can be configured that when it powers up, when it gets plugged in, it powers up. It can immediately run a payload. It can wait a series, however long you want, and then run a payload.
Either or. So all about flexibility. So you can program this a couple different ways. So what I showed was me remotely connecting to it and I hit go. But this can be configured that when it powers up, when it gets plugged in, it powers up. It can immediately run a payload. It can wait a series, however long you want, and then run a payload.
Yeah, exactly. So when I say payload, it's the series of keystrokes that gets run.
Yeah, exactly. So when I say payload, it's the series of keystrokes that gets run.
Yeah, exactly. So when I say payload, it's the series of keystrokes that gets run.
You can. There's ways of typing out. If you've got a small executable, that you want to transfer over, there's a couple ways to do that. Like, you just use the keystrokes to download it, right? You can download stuff from, like, the terminal, for instance. Or I could use Chrome and download it there and go to the downloads folder and open it up there. Through keystrokes. Yep.