Most security tooling looks at software. Key Croc and Screen Crab sit in the cables instead, where your endpoint protection has little to say. They are a good reason to look under the desk now and then.
Key Croc: a keylogger with a plan
The Key Croc sits between a USB keyboard and the computer. Keystrokes pass through and are saved to a log on the device. Two things set it apart from a simple keylogger. It copies the hardware identifiers of the attached keyboard, so the computer still sees the same keyboard as before. It can also run a payload when a defined sequence is typed, which turns it from a passive recorder into something that reacts.
It supports Wi-Fi and SSH and can connect to Hak5 Cloud C², so collected data does not need a return visit. Its reach has limits. Laptops typed on with their built-in keyboard are out of scope, and Hak5's documentation warns that some gaming keyboards, combination keyboards and Apple keyboards may have problems.
Screen Crab: a camera that is not a camera
The Screen Crab does for HDMI what the Key Croc does for the keyboard. It sits between computer and display, is powered over USB, and takes screenshots at a configured interval or records video to a microSD card. It can also send captures through Cloud C² over Wi-Fi. Capture is passive through an onboard splitter, so the picture on the display is not interrupted, and the LED can be disabled.
Where the risk actually is
Few attackers will break in to attach one of these to a random desk. The realistic places are those with little supervision and sensitive content: meeting rooms where the board meets, reception desks, shared workstations, and kiosks. A display in a meeting room often shows exactly what a visitor would like to read.
What actually helps
- Look. Add cable checks to the routine for sensitive rooms and workstations. Anything between the keyboard and the computer or between the computer and the screen should have a reason to be there, as should an HDMI device that draws USB power.
- Do not rely on device inventories alone. A device that imitates the original keyboard will not stand out in a list. A physical check is what finds it.
- Make captured passwords worthless. Passkeys and hardware security keys do not depend on a secret that can be typed, so a keylogger has nothing lasting to record.
- Survey your Wi-Fi. Devices that send data out need a way to do so. Unknown clients and networks near sensitive rooms are worth a look.
- Control access. Lockable cabinets for computers in meeting rooms, ports that are out of reach and escorted visitors make quiet attachment far harder.