Hacker News Reader

Comment by ComradePhil | Hacker News Reader

This is a well-known mode of attack and some anti-virus software have protections against it: https://www.kaspersky.com/blog/weaponized-usb-devices/26495/

View on HN

Too bad kaspersky has been banned/cancelled in my country (USA). Any alternatives? I don’t necessarily use antivirus, thought it was unnecessary with Windows 11 built in Security. But now my mind is changing… anyways There should be a open source tool for Windows that only allows only 1 trusted keyboard/mouse to input and monitors for anything sketchy in USB firmware. Seems easy enough to create.

The paid version of Windows Defender can do it: https://docs.microsoft.com/en-us/microsoft-365/security/defe...

I found this which claims to block these attacks: https://www.gdatasoftware.com/antivirus-windows

> USB Keyboard Guard

> Protects you against manipulated USB devices that pretend to be keyboards, even though they look like USB sticks or external hard drives.

Still doesn't protect you from a wireless reply attack assuming no encryption in your device is present or hid spoofing. The safest scenario will be using encryption always even with cable keyboard/mouse and a pre-auth with a public/private key scheme like the one in android debugger bridge or TLS.

how can anti-virus protect against it?

it has no way of telling that that device isn't a logitech keyboard, and can't tell that it's not the user opening up elevated cmd.exe and accepting the prompt

From the linked article:

> Kaspersky Endpoint Security's technology will not authorize any HIDs unless the user inputs a code using a HID already authorized to do so.

Reply on news.ycombinator.com