4 ms·
Or you could just bring a keyboard and mouse with you and take control of the computer the old fashioned way. I'm sure it would be much easier to type on than t
by fleitz 16y ago
Or you could just bring a keyboard and mouse with you and take control of the computer the old fashioned way. I'm sure it would be much easier to type on than the android on screen keyboard.
Also, there are USB keyboard replay devices out already that are much smaller than an android phone, if the goal was to automate the process.
I really fail to see why this is noteworthy other than the fact that someone developed a USB keyboard driver for android which is cool. It doesn't open any new attack vectors. I mean really how many computers are out there that don't have a keyboard and mouse but have accessible USB ports AND that it would look suspicious to have brought your own keyboard and mouse, but it wouldn't look suspicious to plug your phone into it.
I suppose the one thing it would enable is a social engineering trick where you convince the persons secretary to go plug your phone into the computer you don't have access to. Maybe something along the lines of "<insert boss' name here>, needs you to plug his phone it's running low on battery, can you plug it in?" and then come back a few minutes later to get the phone.
- wzdd 16y agoIt opens one new attack vector I think---any exploit targeting an Android phone could be used to deliver a different exploit to the computer the phone is connected to. Given that this requires a kernel driver (on the phone side), it would have to be pretty great exploit. You would have to be pretty motivated to do this instead of, e.g. sending 1 billion emails with an attached virus.jpg.exe, but it is a new vector.
- stcredzero 16y agoFor penetrating a particular target, this is very interesting. Bribe a repairman into leaving such a device plugged into a developer workstation at a company where everyone goes home at 5 or 6. The device presents itself as a USB hub, then waits until late at night, when it connects its keyboard and types out and compiles an entire rootkit. This would even work at companies which lock down USB ports against removable drives. Better yet, the device could act as an attacker's remote shell by downloading commands using curl and uploading redirected stdout and stderr.
- dalore 16y agoWouldn't the computer be auto locked? It's going to have to type out the password.
- JonnieCache 16y ago>The device presents itself as a USB hub, then waits until late at night, when it connects its keyboard and types out and compiles an entire rootkit. This idea is terrifying.
- neworbit 16y agoYou'd presumably have to be in a shell (or compiler window) and on a system that didn't lock itself - but yeah, yikes. How are you with centrifuges?
- stcredzero 16y agoYou can bring up a command line with just the keyboard, even in Windows. The lock would be a problem.
- frankus 16y agoI wouldn't underestimate the social engineering aspect of it. Refusing to charge someone's dying phone with your computer comes across as kind of a dick move, since it's perceived as costing you nothing and really helping out the other person. Especially now that POS systems and what not have USB ports, it's not too farfetched that someone would ask a non-techy waitperson to please charge their phone for them, meanwhile it downloads the last thousand customers' credit card numbers.
- jacmet 16y agoMinor correction: someone reimplemented a USB keyboard driver for Linux - f_hid has been part of the mainline kernel since ~1 year: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=71adf11894 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6... I don't know why they didn't just use that one - Presumably because their Android phone uses an ancient kernel version.