Hacker News Reader

Comment by raziel2p | Hacker News Reader

Yes, but that's unrelated. The idea here is that if a USB device is connected to your machine, it's an indicator that your machine is compromised. Mouse jigglers that stop your lock screen from activating are very common when confiscating machines: https://www.cru-inc.com/products/wiebetech/mouse_jiggler_mj-...

And of course, depending on the OS, it's possible to craft a USB stick that copies files to a remote server as soon as it's plugged in.

View on HN

Once I have seen a coworker improvising one of these by placing a second (optical) mouse on top of a mechanical wristwatch.

Hmm, this is actually rather nifty, although one issue I see is it will only last a few days at most. I don't know how long people who confiscate laptops normally need to run mouse jigglers.

Battery operated mechanical wrist watches last years!

I believe you're thinking of an analog (usually quartz) watch, not a mechanical analog watch which doesn't have a battery.

https://en.wikipedia.org/wiki/Mechanical_watch

Should have known better than to wonder into a conversation about watches.

I know nothing!

> depending on the OS, it's possible to craft a USB stick that copies files to a remote server as soon as it's plugged in.

Is this possible with Linux?

You can get a 'USB rubber ducky' [1] which emulates both a USB memory stick and a USB keyboard, allowing you to script keystrokes for the keyboard [2]

So it can do anything a newly plugged in keyboard can do. Which, if the user is already logged in, makes grabbing the user's files easy.

[1] https://shop.hak5.org/collections/usb-rubber-ducky/products/... [2] https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Payloads

This will only work, I suppose, if the attacker knows beforehand a keychord that will focus a terminal.

on most desktop linux distros: <windows>terminal<enter> is enough

Hehehe...on my machine that selects "Emacs (Terminal)". Good luck with those key combos...

Yes, the device can present itself as both a keyboard and storage device and send the copy commands via keystrokes.

yes. Mouse jiggers pretend to be regular mice an keyboard.

Yes and no. The idea is to emulate a keyboard and mouse. You then use OS shortcuts to, for example, start a terminal and type command in it. So it can work with Linux but, because of the diversity of Distribution, DE, etc, it is more difficult to be sure of the shortcuts that you can use, whereas on windows or mac, they will usually always be the same (for exemple, Windows+R on windows to launch a launcher, and then type cmd.exe).

An alternative approach may be to check idVendor and idProduct (lsusb) to see if either matches a mouse jiggler supplier or product.

Those can be easily spoofed. I don’t know if current mouse jigglers in use have a specific Id or not, but there’s no reason they would have to have a recognizable Id.

Not sure if a blacklist-aproach is the most reasonable solution when you're in a situation that you have to worry about these things in the first place.

Reply on news.ycombinator.com