If You Give a Mouse a Microchip
Demonstrates modifying ARM Cortex-M mouse firmware to covertly stage and deliver arbitrary payloads through standard USB HID interfaces in high-security tournament settings.
Summary
Physical Peripherals in High Stakes Environments
Competitive esports tournaments feature multi-million dollar prize pools where the incentive to cheat has driven players to develop sophisticated evasion techniques. Because event organizers enforce strict controls on target tournament PCs—including disabling internet access and locking down USB mass storage—players are still permitted to bring their own competition-grade mice and keyboards, creating an overlooked physical attack vector.
Exploiting ARM Cortex M Gaming Peripherals
Modern commercial gaming mice frequently feature onboard ARM Cortex-M microcontrollers and internal flash memory to store custom DPI settings, macro bindings, and user profile configurations across different computers. Mark Williams and Rob Stanley demonstrate how an attacker can reverse engineer the peripheral's firmware and embed a malicious payload delivery routine into unused sectors of the onboard flash memory without disrupting standard optical tracking or button inputs.
Payload Staging Over USB Human Interface Devices
Because the modified mouse continues to operate as an expected Human Interface Device (HID), it bypasses perimeter controls and operating system USB mass storage restrictions. Upon receiving a covert physical trigger sequence or timer condition, the compromised firmware initiates a rapid burst of synthetic keystroke events, opening hidden execution contexts to stage and launch compiled game cheats or arbitrary executables directly into system memory.
Detection Tradeoffs and Hardware Defenses
The authors evaluate the practical tradeoffs of peripheral-based HID attacks, noting that automated window spawning and keystroke injection remain observable to attentive observers or local audit logging agents. They discuss countermeasures for tournament organizers and high-security enterprise facilities, including mandatory hardware quarantine policies, firmware signature verification, and the adoption of USB device whitelisting tools that restrict non-standard HID descriptors.
Related talks
Hardware Hacking Village·50 min
Federico Lucifredi
Federico Lucifredi demonstrates keystroke injection attacks, exploiting OS trust in USB HID devices to execute 1,000 WPM payloads via weaponized cables.
Red Team Village·36 min
Mendoza · Mauro Cáseres
Mendoza and Mauro Cáseres demonstrate embedding BadUSB hardware implants inside commercial desktop speakers to silently execute keystroke injection.
Red Team Village·23 min
Mauro Cáseres
Mauro Cáseres explores weaponized keyboards and hardware keyloggers, demonstrating how physical peripherals can be backdoored for stealthy initial access.