Diabolic Drive is a stealthy, wireless keystroke-injection tool that can send payloads over Wi-Fi while disguised as a regular 64 GB USB flash drive. Diabolic Drive is excellent for use in cybersecurity, particularly when red teaming, as it behaves like a typical flash drive until it is wirelessly instructed to deploy keystrokes.

Diabolic Drive adheres to the standard form factor of a "universal" USB drive, allowing it to be easily concealed with an inconspicuous flash-drive enclosure. When plugged in, anyone can interact with it like a normal flash drive, and it performs just like a genuine device, with average read speeds of up to 20 Mbps and write speeds of up to 10 Mbps. This behavior helps mask its wireless keystroke-injection features. Diabolic Drive is the first off-the-shelf product that combines all of these features into a single device. As such, it opens up untold social engineering attack possibilities.

Diabolic Drive on the left, standard flash drive on the right

Diabolic drive can be accessed remotely over Wi-Fi. Fire your payload remotely and precisely, or pre-program the drive to deliver keystrokes when plugged in.

Deliberately Stealthy

When plugged into a host, Diabolic Drive acts like a regular USB flash drive, including any audio notifications that would normally occur. Even when it’s configured to identify itself as a flash drive, a human-interface device (HID), and a virtual COM port simultaneously, it triggers only a single audio notification, which is how a standard flash drive would behave. (The COM port allows you to program Diabolic Drive using the Arduino IDE, and you can disable it with "Stealth Mode" for actual red-team engagements.)

Choose Your Moment

By default, Diabolic Drive enters the "spectre" state, after it’s plugged in, rather than going "active" immediately. As long as it remains in that state, it appears only as a flash dive…right up until you deem it safe to expose the HID interface and begin injecting keystrokes, at which point you can initiate the attack remotely over a Wi-Fi connection! Until then, the HID interface is completely dormant, with no unexpected behavior to detect and no abnormal logs generated.

Spoofable Hardware IDs

For maximum stealthiness, Diabolic Drive allows you to spoof the identifying information it presents when connecting as a flash-storage device and as a human-interface device (HID). For flash storage, this includes the vendor ID (VID), the product ID (PID), vendor info, product info, rev info, the vendor string, the product string, and the serial number (SN), which makes it extremely challenging to distinguish Diabolic Drive from a regular flash drive. For the ATmega32U4 HID, you can spoof the VID and PID of an HID that was previously connected to a particular target computer in order to avoid a pop-up notification about the installation of a new keyboard when Diabolic Drive exposes its HID interface.

Features & Specifications

Diabolic Drive was designed for maximum capability and stealth, with an eye toward openness, flexibility, control, and future proofing. It contains the following components:

• Microchip ATmega32U4 microcontroller running at 16 MHz and 5 V
• ESP8266ex running at 160 MHZ and 3.3 V, thanks to the onboard LDO regulator
• Diabolic Drive's ATmega32U4 and ESP8266 are connected via Serial and I²C protocols, which means that Diabolic Drive supports almost any open source firmware and software built for those chips. (You can find a list of options in our documentation, linked below.)
• 64 GB flash storage memory, which supports reading and writing data while simultaneously firing your payload
• High-gain, 4.1-dBi, 2.4-GHz ceramic chip antenna
• W25Q32 SPI flash memory of 4 MB (can store millions of characters for payload deployment)

Comparisons

Diabolic Drive in a commercially available Flash drive enclosure

Programming Options

ESP8266

• OTA through an onboard web interface
• Through ATmega32U4 acting as a Serial Bridge that gives you full control in case something goes wrong. (Also supports the NodeMCU Firmware Programmer app)

ATmega32U4

Upload Arduino Sketches by directly plugging your Diabolic Drive into your computer, as ATmega32U4 has native USB support through a built-in USB transceiver that handles the USB connection.

Access ATmega32U4 Bootloader

This unique bootloader feature gives you full control over Diabolic Drive’s ATmega32U4 through the USB 3.0 pins. By default, Diabolic Drive uses a modified version of the Arduino Leonardo bootloader. It is also compatible with the original Arduino Leonardo bootloader.

Support & Documentation

You can find project information, programming instructions and a list of firmware options in our Github repository. We will publish our design files by the time we ship Diabolic Drive to backers.

Manufacturing Plan

Crafted in the spirit of hardware hackers who use minimal technology and rely more on their knowledge and experience to get the job done, this device provides a unique set of features. We have carefully designed our hardware to be as stealthy as possible when deploying wireless payloads, to operate without specific software dependencies, and to be compatible with a wide variety of open-source firmwares. We will meticulously test each device to ensure that it operates at 100% effectiveness before shipping units to backers. Using the Arduino IDE, you can program your Diabolic Drive with the firmware of your choice in under two minutes.

Fulfillment & Logistics

During the campaign, we are covering all US domestic shipping costs and subsidizing international shipping costs, so be sure to reserve yours while it’s available at the lowest total price.

After our production run is complete, we will box everything up and send it along to Crowd Supply’s fulfillment partner, Mouser Electronics, who will handle distribution to backers worldwide. You can learn more about Crowd Supply’s fulfillment services under Ordering, Paying, and Shipping in their guide.

Risks & Challenges

The most significant hazard lies in the supply chain, due to potential delays caused by component shortages. While such issues are sometimes unavoidable, we have worked hard to mitigate any risks of component shortages by minimizing the likelihood and potential impact should a shortage occur. We pledge to maintain transparency and candor regarding our manufacturing progress.