4 ms·
Plug and Pwn attack uses fake USB devices for Windows SYSTEM access
- Terr_ 2mo agoI wonder if this could be mitigated with a daemon that monitors USB devices and disconnects them (or even reboots entirely [0]) when an unexpected kind is connected. A workaround for a lack of permission/control in the OS, as it were. Sure, attackers could connect something mimic a whitelisted USB vendor+product ID, but in that case the drivers/co-installers are probably already present anyway, and it still greatly reduces the attack-surface since they need to find an exploit in those particular products. [0] https://en.wikipedia.org/wiki/USBKill https://en.wikipedia.org/wiki/USBKill