Hacker News Reader

Comment by mpeg | Hacker News Reader

As a user, it'd be nice to assume that if I'm not logged in new USB devices won't be installed though.

What about a keyboard? How are you going to log in if your computer won't accept the keyboard that you are trying to plug in?

To expand on that, you could just allow keyboards and not enable other devices but then how do you log in if your login is a network based... now you have to allow network cards. And now this hack is just as effective.

Beyond that, you could disguise non-keyboard hardware as a keyboard.

But then it doesn't get registered as an ethernet device, bypassing this particular problem.

It does if you make a keyboard that registers as a hub with both a keyboard and network adapter installed

I'm cool with HIDs being installed, but an Ethernet device that hijacks my entire network and then quietly disappears? Uh...

I'd notice a new usb plugged in, but I wouldn't easily notice this.

I believe there is a proof of concept evil USB device that looks like a USB key, but actually emulates a keyboard and enters all sorts of damaging keystrokes when plugged in. So allowing keyboards is dangerous anyway (although having the screen locked should help).

This is the reason why keyboard/mouse connectors should look different to USB connectors, so we can tell the difference.

Screen locking would fix the keyboard attack. It has no input coming back from the computer so it works by blind-spraying keypresses in and hoping.

The numlock and capslock indicators can be used as confirmation signals coming back so it knows if it is working.

Not really. By the time you make those signals provide feedback about your task rather than just whether Caps Lock is on, you'll have already accomplished your task and be into the part of the process where you're trying to download or compile some hack to use code to send something useful along Caps Lock signals. It's not a useful feedback mechanism when getting the feedback is an order of magnitude or two harder than the task you're trying to perform in the first place.

https://github.com/hak5darren/USB-Rubber-Ducky/wiki

Could restrict it to HID class USB devices.

What if you're not logged in on the console, but have an SSH session open over the network? Does that count as 'logged in' or not? Imagine a server under a desk with no monitor attached. Or, a thin-client situation, where I am logged in to a virtual console over VNC or RDP or X, but have no access to the actual machine's USB ports?

Reply on news.ycombinator.com