3 ms·

This is a well-known mode of attack and some anti-virus software have protections against it: https://www.kaspersky.com/blog/weaponized-usb-devices/26495/ https

This is a well-known mode of attack and some anti-virus software have protections against it: https://www.kaspersky.com/blog/weaponized-usb-devices/26495/ https://www.kaspersky.com/blog/weaponized-usb-devices/26495/

5ESS 4y ago
Too bad kaspersky has been banned/cancelled in my country (USA). Any alternatives? I don’t necessarily use antivirus, thought it was unnecessary with Windows 11 built in Security. But now my mind is changing… anyways There should be a open source tool for Windows that only allows only 1 trusted keyboard/mouse to input and monitors for anything sketchy in USB firmware. Seems easy enough to create.
- t0mmyb0y 4y ago
- ComradePhil 4y ago
  I found this which claims to block these attacks: https://www.gdatasoftware.com/antivirus-windows https://www.gdatasoftware.com/antivirus-windows > USB Keyboard Guard > Protects you against manipulated USB devices that pretend to be keyboards, even though they look like USB sticks or external hard drives.
  - daedalus2027 4y ago
    Still doesn't protect you from a wireless reply attack assuming no encryption in your device is present or hid spoofing. The safest scenario will be using encryption always even with cable keyboard/mouse and a pre-auth with a public/private key scheme like the one in android debugger bridge or TLS.
- JackGreyhat 4y ago
  The paid version of Windows Defender can do it: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mde-device-control-device-installation?view=o365-worldwide#allow-installation-and-usage-of-usb-drives-and-other-peripherals https://docs.microsoft.com/en-us/microsoft-365/security/defe...
blibble 4y ago
how can anti-virus protect against it? it has no way of telling that that device isn't a logitech keyboard, and can't tell that it's not the user opening up elevated cmd.exe and accepting the prompt
- ComradePhil 4y ago
  From the linked article: > Kaspersky Endpoint Security's technology will not authorize any HIDs unless the user inputs a code using a HID already authorized to do so.

5ESS 4y ago

Too bad kaspersky has been banned/cancelled in my country (USA). Any alternatives? I don’t necessarily use antivirus, thought it was unnecessary with Windows 11 built in Security. But now my mind is changing… anyways There should be a open source tool for Windows that only allows only 1 trusted keyboard/mouse to input and monitors for anything sketchy in USB firmware. Seems easy enough to create.

t0mmyb0y 4y ago
ComradePhil 4y ago
I found this which claims to block these attacks: https://www.gdatasoftware.com/antivirus-windows https://www.gdatasoftware.com/antivirus-windows > USB Keyboard Guard > Protects you against manipulated USB devices that pretend to be keyboards, even though they look like USB sticks or external hard drives.
- daedalus2027 4y ago
  Still doesn't protect you from a wireless reply attack assuming no encryption in your device is present or hid spoofing. The safest scenario will be using encryption always even with cable keyboard/mouse and a pre-auth with a public/private key scheme like the one in android debugger bridge or TLS.
JackGreyhat 4y ago
The paid version of Windows Defender can do it: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mde-device-control-device-installation?view=o365-worldwide#allow-installation-and-usage-of-usb-drives-and-other-peripherals https://docs.microsoft.com/en-us/microsoft-365/security/defe...

blibble 4y ago

how can anti-virus protect against it? it has no way of telling that that device isn't a logitech keyboard, and can't tell that it's not the user opening up elevated cmd.exe and accepting the prompt

ComradePhil 4y ago
From the linked article: > Kaspersky Endpoint Security's technology will not authorize any HIDs unless the user inputs a code using a HID already authorized to do so.