[evilos]

It's funny to see all the commenters who didn't read the article closely enough or at all. This is basically the bluetooth device equivalent of "left S3 bucket open to public".

That said, really cool work. I honestly thought it would be harder to turn a usb connected device into an exploit vector.

That it's as easy as emulating a keyboard that pops a local terminal and runs a malicious command is actually pretty funny. Though it will be a non-admin terminal so the damage should be somewhat limited. And on Windows, users often just click through any UAC prompt so I bet you'd get full access on many windows boxes.

[debugnik]

I assume the malicious HID keyboard can press through the UAC prompt on its own, just like the user's actual one can.

[evilos]

That's a fantastic point haha, I've never tried it myself.