International Research Journal of Engineering and Technology (IRJET)
e-ISSN: 2395-0056
Volume: 12 Issue: 04 | Apr 2025
p-ISSN: 2395-0072
www.irjet.net
SPECTRESTRIKE: ADVANCED WHID EXPLOITATION AND DEFENSE Mr. VIJAY. E1, Ms. NIHAL BABA2 1Mr. VIJAY. E, M.sc CFIS, Department of Computer Science and Engineering, Dr. MGR UNIVERSITY, Chennai, India 2 Ms. NIHAL BABA, Assistant Professor, Cyber forensics and Information Security, University of Madras, Chepauk,
Chennai, India ---------------------------------------------------------------------***---------------------------------------------------------------------
Abstract - Emerging Wireless Human Interface Device
machine. These attacks tend to bypass traditional antivirus solutions and are challenging to identify in real-time. [2]
(WHID) attacks pose a heightened threat to endpoint security, particularly on popular operating systems like Windows. WHID attacks utilize USB-based Human Interface Devices (HIDs), like keyboards or mice, to inject remote malicious keystrokes. The SpectreStrike: Advanced WHID Exploitation and Defense project delves into offensive and defensive perspectives on WHID attacks with the use of the Xiao ESP32S3 microcontroller. In attack, the ESP32-S3 is plugged in over USB onto the target Windows computer while receiving remote control commands via Wi-Fi. It behaves like a regular HID and inserts unauthorized keystroke inputs, imitating a real keyboard to make arbitrary commands execute. To counter such attacks, a strong defense system is employed through Python and the libusb library. The defense system constantly scans USB ports for plugged-in HID devices, checks device descriptors for inconsistencies, and sends alerts on identification of suspicious activity. Moreover, the system blocks the identified malicious device and takes a screenshot of the desktop during the attack, offering visual proof for forensic examination. The solution is light, Windows-platform-specific, and able to run in real-time without administrative privileges needed for detection. The dual-perspective approach offers a complete view of the attack vectors employed in WHID exploitation and provides a practical defense mechanism that can be applied to larger USB threat models. The project supports improving endpoint protection against covert USBbased intrusion attacks and opens avenues for future growth in autonomous intrusion detection systems.
This paper introduces SpectreStrike, a complete study and protection against WHID attacks using the Xiao ESP32-S3 microcontroller. The ESP32-S3 is set up to behave as a rogue HID when plugged in via USB into a Windows machine. Once connected, it connects to a remote command and control server via Wi-Fi, enabling attackers to remotely send keystroke commands wirelessly. [3] This mimics an actual WHID attack scenario where an attacker can gain access to a machine by merely plugging in a hacked device. The attack vector is stealthy yet highly effective and thus a top priority to be researched by security experts as well as system administrators. In order to thwart this attack, a defense system was created based on Python as well as the libusb library. This system constantly checks USB connections, inspects plugged-in devices for unusual properties, and denies any unauthorized HID devices. Furthermore, it takes a screenshot of the desktop when an attack is discovered, offering a forensic snapshot to analyze. [4] The defense runs in real-time on Windows platforms and does not need administrative rights, so it is both convenient and effective to implement in standard user environments. Through the demonstration of both attack and defense elements, this study fills the gap between threat modeling and proactive mitigation for USB security. It illustrates the utmost importance of endpoint-level security against HIDbased attacks and provides a lightweight and extensible system for real-time detection and response. [5] This work's results enhance the emerging domain of physical-layer cybersecurity and pave the way for future research on automated prevention against hardware attacks.
Key Words: WHID Attack, Xiao ESP32-S3, Keystroke Injection, USB Security, Real-time Detection, Device Blocking, Cybersecurity, USB Threat Mitigation.
1.INTRODUCTION Over the past few years, USB-based attacks have become a credible threat to endpoint security because of their ease of use, stealth, and potency. Of these, Wireless Human Interface Device (WHID) attacks are the most malicious. [1] By taking advantage of the native trust that operating systems have for Human Interface Devices (HIDs) such as keyboards and mice, attackers are able to carry out arbitrary commands on a system without the need for software vulnerabilities. WHID attacks use microcontrollers that communicate through USB and are controlled remotely through wireless interfaces to insert malicious keystrokes into a victim
© 2025, IRJET
|
Impact Factor value: 8.315
2. LITERATURE REVIEW Karim Lounis; Mohammad Zulkernine et al., [6] Attacks and Defenses in Short-Range Wireless Technologies for IoT The Internet of Things, or IoT, is a new network model based on wireless and wireline networks, geographically remote and interconnected via a "secured" backbone, i.e., the Internet. It links billions of heterogeneous Things using a broad variety of communication technologies and offers end-users, worldwide, a number of smart applications.
|
ISO 9001:2008 Certified Journal
|
Page 1442