Entering Through the Door, But Not the Front One

Imagine your entire company brought down by an exposed USB port.

Self-service kiosks have become ubiquitous — from drive-thru ordering terminals at restaurants to ticket issuance devices in airports and bus stations. These devices are frequently viewed by security teams as "low hanging fruit": easily exploitable targets offering high-value access to an attacker.

A self-service kiosk located outside a building perimeter must communicate with the internal ordering system — which in turn connects to payment gateways and internal corporate networks. Consequently, exploiting a physical vulnerability on the building exterior can lead to complete compromise of the internal infrastructure.

Even though kiosk attack surfaces appear limited (no mouse, touchscreen-only, operating in restricted "kiosk mode"), an attacker only needs a single entry point. One exposed USB port can result in total environmental control. Among red team operators and adversaries, this technique is categorized under MITRE ATT&CK as ID T1674 — Input Injection.

Input Injection (MITRE ATT&CK T1674)

Unlike traditional USB flash drives — where the operating system must mount a storage volume and execute a binary — USB Human Interface Devices (HID) emulate keyboards. They are natively trusted by target operating systems as legitimate keyboards typing commands at superhuman speeds.

In the popular series Mr. Robot, an iconic HAK5 tool called the Rubber Ducky is featured ($100 USD). As HAK5 puts it: "To a human it's a Flash Drive. To a computer it's a keyboard, typing at superhuman speeds."

A cost-effective and widely accessible alternative is the Digispark (powered by the ATTiny85 microcontroller). It can be programmed directly in the Arduino IDE using the legitimate DigiKeyboard.h library.

In Practice: Anatomy of an Attack in a Real Operation

During a real-world Red Team operation conducted by UMBRA operators, we identified a self-service kiosk positioned in an unrestricted public area prior to any access control checks. Anyone could approach the terminal without raising suspicion due to heavy pedestrian traffic.

Enumerating the kiosk revealed a Windows operating system and an exposed USB port on the side panel. To establish covert initial access, we programmed a Digispark with the following execution flow:

• Insertion: Plug device into the exposed USB port.
• OS Handshake: Delay 750ms for HID driver initialization.
• Execution Shortcut: Trigger Windows + R to launch the Run dialog.
• Shell Invocation: Type powershell and press ENTER.
• Payload Dropper: Download and execute an in-memory PowerShell script establishing persistence and a reverse shell back to our C2 infrastructure.

// Windows + R shortcut to launch Run prompt
DigiKeyboard.sendKeyStroke(KEY_R, MOD_GUI_LEFT);
DigiKeyboard.delay(750);

// Launch PowerShell
DigiKeyboard.print("powershell");
DigiKeyboard.sendKeyStroke(KEY_ENTER);
DigiKeyboard.delay(2000);

Within seconds, the attack established a clean, persistent communication channel back to our Command & Control (C2) servers.

The kiosk was joined directly to the corporate Active Directory domain. Despite updated antivirus software on the endpoint, direct physical exploitation granted immediate initial network access without requiring any user credentials or prior domain privileges.

Offensive Visibility vs. Perimeter Security Theatre

Security strategies are often built around visible controls: firewalls, EDRs, MFA policies, and network segmentation. While critical, Red Team operations consistently prove that a single overlooked physical exposure can bypass millions in software defenses.

Evaluating your attack surface through the eyes of a real-world adversary is not an academic exercise. It is the most effective way to uncover physical and technical blind spots before an attacker exploits them.