Hacker News Reader

Comment by EnigmaCurry | Hacker News Reader

https://ericdraken.com/usb-mouse-jiggler/

That's a great solution, which all of our developers are exploiting.

I feel like since I'm on the security team, I should find a non-exploit method to actually resolve the policy failure.

Perhaps the mouse jiggler IS the answer. Not to solve your own plight as a result of the policy by using one, but to illustrate what lengths people are going to in order to mitigate the undesirable effects of the policy.

Agreed man. If developers are resorting to this the policy is wrong, not the developers.

Note most SIEM's (your SOC team) can detect this (not by default as far as I know).

Depending on the desk, a downward facing bass speaker and a raspberry pi+webcam that detects your presence could do the job while maintaining an airgap (assuming you're using a mouse, not a trackpad).

...and now I have a project for this weekend.

Genuinely curious: how would they do this?

The naive approach is to look at device ID, but article already talks about copying identification data, and the rest of USB descriptor is trivially copyable as well.

Is the system going to have a rule like "mouse moves same amount of pixels with equally spaced pauses"? But what if they randomize motion commands and intervals between them?

Probably they are lot more advanced then they used to be, but yeah, checking for device ID / Process ID in combination with binary (.exe) and location. Typically these Programs are portable (no installation required, just run the .exe.) and on a corporate machine there are not many places to store it (typically within your user profile). Programs like "Process Explorer" and "Process Monitor" will give a great amount of detail on processes which can be used for detection.

https://docs.microsoft.com/en-us/sysinternals/downloads/proc...

The linked device is a hardware mouse jiggler, not software. USB devices are easy to imitate, so such a jiggler could be programmed to look like, for example, last year's most popular wireless mouse.

But this a physical USB device which presents exactly the same interface as a real mouse, likely up to the device descriptor.

There is no device ID, process ID or binary to match.

Well, my siem probably wonders why I randomly and repeatedly mash the F15 key through the day sometimes (keeps teams status as "Alive and Present")

Reply on news.ycombinator.com