The case of the haunted keyboard, or why I now ask about pets before malware

Posted by 4QuasarMoth@reddit | talesfromtechsupport | View on Reddit | 46 comments

A few months ago I got a ticket from a user we'll call $Penny from Accounting. The summary line was already doing a lot of work: "Computer typing on its own, possible compromise." Those are the kind of words that make everyone sit up a bit straighter, because now we're not talking about a broken mouse or Outlook being Outlook again, we're suddenly in the territory of "maybe security incident, maybe someone's credentials are already halfway to another continent."

$Penny was dead serious when I called her. She said random characters kept appearing in cells, sometimes windows would close, sometimes the cursor would jump, and once she swore something had started scrolling without her touching anything. She had already changed her password, unplugged and replugged everything, and informed her manager that she may have been hacked. Her manager then informed his manager, which is how this thing got upgraded from mildly annoying to urgent before it even reached me. I asked the usual questions first. Was this only in one app. No. Did it happen after a reboot. Yes. Any new software. No. Did anyone else use the machine. No, not unless the attacker was physically in her house, which she said in a very flat voice that made me think she had considered that too.

Since she was remote, I connected in and waited. For about two minutes, nothing happened. Then a line of nonsense appeared in a spreadsheet. Not total nonsense either, which would've almost been easier. It was like short bursts of repeated letters, then a tab, then a menu opening, then nothing. Very annoying, very inconsistent. I checked for stuck keys, background tools, accessibility settings, weird drivers, language switching, all the usual fun. Nothing obvious. Device manager looked fine. AV was clean. Startup was boring. I was about ready to escalate it as some ugly hardware issue when it happened again, only this time I caught a tiny clue. One of the inputs was exactly the sort of key mash you'd get if something heavy landed partly across the keyboard, not if a person was actually typing.

So I asked her a question that made a long pause happen.

"Do you have a cat."

Another pause. Then she says, "Yes, but she's old and lazy, why."

Reader, the cat was not lazy. The cat had apparently discovered that the warm laptop by the window was an excellent place to launch herself whenever $Penny stepped away for coffee. Worse, the external keyboard sat on a pull out tray just low enough that the cat could land a paw on it from the desk edge and then walk across it like she paid rent. $Penny had never seen it happen because the weird input mostly started when she was out of the room. We proved it in about four minutes. She went to refill her mug, came back, and right on cue the cat hopped up, stepped on the keyboard, opened a menu, inserted a string of garbage into Excel, and somehow managed to hit print preview just to really sell the haunting.

No malware. No attacker. Just a furry little chaos engineer with excellent timing.

I closed the ticket as a keyboard input issue caused by environmental interference, which is still one of the funnier things I've ever typed with a straight face. $Penny was embarrassed, but honestly I was just relieved it wasn't some nightmare compromise. Since then, whenever someone says their computer is possessed, I still do the security checks first. But somewhere near the top of my mental list now is: ask about pets , before you ask about nation states.