How to Turn Your KVM into a Raging Key Logging Monster

Revisiting Hardware Keylogging Attack Vectors

While keylogging is widely considered a solved problem, peripheral hardware sitting physically connected between monitors and input devices offers an overlooked attack surface.

Reverse Engineering KVM Switch Firmware

Yaniv Balmas and Lior Oppenheim tear down standard desktop KVM (Keyboard, Video, Mouse) switches, mapping out custom serial buses and decompiling 8051 microcontroller assembly firmware.

Implanting Persistent Malware in Peripheral Hardware

The researchers detail overwriting firmware flash memory to convert the KVM switch into an active hardware keylogger that captures keystrokes across physically connected systems.

Bridging Air-Gapped Networks

The authors demonstrate using the compromised KVM to exfiltrate credentials and bridge air-gapped workstations, showing that malware can persist across full host reinstalls and hardware swaps.