4 ms·

What's stopping this thing from keylogging or inserting keystrokes? Malicious USB devices are fairly common, and this certainly has the 'right' form factor. T

by fooker 1y ago

What's stopping this thing from keylogging or inserting keystrokes? Malicious USB devices are fairly common, and this certainly has the 'right' form factor. There's a reason 'do not plug in a USB drive you have found in the parking lot' is reiterated in every corp security training.

userbinator 1y ago
Keylogging? Just how do you think it can read any keystrokes? As for inserting keystrokes, that will be obvious if it enumerates as a keyboard. You should turn down your paranoia a little more.
- phito 1y ago
  You need to install an executable on your machine.
- croes 1y ago
  The better attack vector would be the programs you need to use the display
- fooker 1y ago
  There are plenty of USB keyloggers available for purchase right now. While I can try and conjecture how those might work, that's not really in my lane.
  - aaronmdjones 1y ago
    Those work by sitting between the real keyboard and the computer, often deliberately designed to appear as an innocuous adapter (say, a USB-A keyboard plugged into a PC's USB-C port or vice versa) or extension cable.
- aaronmdjones 1y ago
  > As for inserting keystrokes, that will be obvious if it enumerates as a keyboard. This is true, but this also doesn't need to happen at insertion time. An HID keyboard can show up, say, 3 hours after you plug it in. I miss grsecurity's patch set so much. It had an option to defeat this (deny all USB device enumeration post-boot, i.e. after the kernel executes init).
- 6c696e7578 1y ago
  I think the paranoia stems from the HID inserting winflag+r, powershell curl https... which installs keylogging software. It can do that after a 10 minute or so countdown timer so it might not seem immediately obvious, or might seem like part of a auto-update with powershell postinstall.
  - fooker 1y ago
    The paranoia stems from this being a suspiciously cheap device that is meant to be ordered in bulk from China.

by fooker 1y ago

userbinator 1y ago

Keylogging? Just how do you think it can read any keystrokes? As for inserting keystrokes, that will be obvious if it enumerates as a keyboard. You should turn down your paranoia a little more.

phito 1y ago
You need to install an executable on your machine.
croes 1y ago
The better attack vector would be the programs you need to use the display
fooker 1y ago
There are plenty of USB keyloggers available for purchase right now. While I can try and conjecture how those might work, that's not really in my lane.
- aaronmdjones 1y ago
  Those work by sitting between the real keyboard and the computer, often deliberately designed to appear as an innocuous adapter (say, a USB-A keyboard plugged into a PC's USB-C port or vice versa) or extension cable.
aaronmdjones 1y ago
> As for inserting keystrokes, that will be obvious if it enumerates as a keyboard. This is true, but this also doesn't need to happen at insertion time. An HID keyboard can show up, say, 3 hours after you plug it in. I miss grsecurity's patch set so much. It had an option to defeat this (deny all USB device enumeration post-boot, i.e. after the kernel executes init).
6c696e7578 1y ago
I think the paranoia stems from the HID inserting winflag+r, powershell curl https... which installs keylogging software. It can do that after a 10 minute or so countdown timer so it might not seem immediately obvious, or might seem like part of a auto-update with powershell postinstall.
- fooker 1y ago
  The paranoia stems from this being a suspiciously cheap device that is meant to be ordered in bulk from China.