4 ms·

https://ericdraken.com/usb-mouse-jiggler/ https://ericdraken.com/usb-mouse-jiggler/

merlincorey 5y ago
That's a great solution, which all of our developers are exploiting. I feel like since I'm on the security team, I should find a non-exploit method to actually resolve the policy failure.
- CodeWriter23 5y ago
  Perhaps the mouse jiggler IS the answer. Not to solve your own plight as a result of the policy by using one, but to illustrate what lengths people are going to in order to mitigate the undesirable effects of the policy.
- k4ch0w 5y ago
  Agreed man. If developers are resorting to this the policy is wrong, not the developers.
not1ofU 5y ago
Note most SIEM's (your SOC team) can detect this (not by default as far as I know).
- messe 5y ago
  Depending on the desk, a downward facing bass speaker and a raspberry pi+webcam that detects your presence could do the job while maintaining an airgap (assuming you're using a mouse, not a trackpad). ...and now I have a project for this weekend.
- theamk 5y ago
  Genuinely curious: how would they do this? The naive approach is to look at device ID, but article already talks about copying identification data, and the rest of USB descriptor is trivially copyable as well. Is the system going to have a rule like "mouse moves same amount of pixels with equally spaced pauses"? But what if they randomize motion commands and intervals between them?
  - not1ofU 5y ago
    Probably they are lot more advanced then they used to be, but yeah, checking for device ID / Process ID in combination with binary (.exe) and location. Typically these Programs are portable (no installation required, just run the .exe.) and on a corporate machine there are not many places to store it (typically within your user profile). Programs like "Process Explorer" and "Process Monitor" will give a great amount of detail on processes which can be used for detection. https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer https://docs.microsoft.com/en-us/sysinternals/downloads/proc... https://docs.microsoft.com/en-us/sysinternals/downloads/procmon https://docs.microsoft.com/en-us/sysinternals/downloads/proc...
    - wiml 5y ago
      The linked device is a hardware mouse jiggler, not software. USB devices are easy to imitate, so such a jiggler could be programmed to look like, for example, last year's most popular wireless mouse.
    - theamk 5y ago
      But this a physical USB device which presents exactly the same interface as a real mouse, likely up to the device descriptor. There is no device ID, process ID or binary to match.
- jdironman 5y ago
  Well, my siem probably wonders why I randomly and repeatedly mash the F15 key through the day sometimes (keeps teams status as "Alive and Present")

That's a great solution, which all of our developers are exploiting. I feel like since I'm on the security team, I should find a non-exploit method to actually resolve the policy failure.

CodeWriter23 5y ago
Perhaps the mouse jiggler IS the answer. Not to solve your own plight as a result of the policy by using one, but to illustrate what lengths people are going to in order to mitigate the undesirable effects of the policy.
k4ch0w 5y ago
Agreed man. If developers are resorting to this the policy is wrong, not the developers.

not1ofU 5y ago

Note most SIEM's (your SOC team) can detect this (not by default as far as I know).

messe 5y ago
Depending on the desk, a downward facing bass speaker and a raspberry pi+webcam that detects your presence could do the job while maintaining an airgap (assuming you're using a mouse, not a trackpad). ...and now I have a project for this weekend.
theamk 5y ago
Genuinely curious: how would they do this? The naive approach is to look at device ID, but article already talks about copying identification data, and the rest of USB descriptor is trivially copyable as well. Is the system going to have a rule like "mouse moves same amount of pixels with equally spaced pauses"? But what if they randomize motion commands and intervals between them?
- not1ofU 5y ago
  Probably they are lot more advanced then they used to be, but yeah, checking for device ID / Process ID in combination with binary (.exe) and location. Typically these Programs are portable (no installation required, just run the .exe.) and on a corporate machine there are not many places to store it (typically within your user profile). Programs like "Process Explorer" and "Process Monitor" will give a great amount of detail on processes which can be used for detection. https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer https://docs.microsoft.com/en-us/sysinternals/downloads/proc... https://docs.microsoft.com/en-us/sysinternals/downloads/procmon https://docs.microsoft.com/en-us/sysinternals/downloads/proc...
  - wiml 5y ago
    The linked device is a hardware mouse jiggler, not software. USB devices are easy to imitate, so such a jiggler could be programmed to look like, for example, last year's most popular wireless mouse.
  - theamk 5y ago
    But this a physical USB device which presents exactly the same interface as a real mouse, likely up to the device descriptor. There is no device ID, process ID or binary to match.
jdironman 5y ago
Well, my siem probably wonders why I randomly and repeatedly mash the F15 key through the day sometimes (keeps teams status as "Alive and Present")