The @certcc notified both Microsoft and Apple about these sorts of attacks almost 10 years ago, tracked as VU#522033.
Microsoft - no reply.
Apple - "The screen lock on Mac OS X is an effective mitigating factor against this "attack". "
It sure would be nice if Windows client would pop-up some sort of dynamic challenge (like eg. a very simple CAPTCHA) on screen when a peripheral reporting as an HID device was plugged in before allowing input from that device to manipulate things in the OS. Sure would be nice.https://twitter.com/mame82/status/1205538348934352897 …
1:27
USBSamurai Pro 
USB cable with implant for bi-directional RF communication connects mobile phone in airplane mode, with Win10 box (no network connections).
2nd mobile injects keystrokes and brings up a covert channel shell, using the RF implant. File transfer still works pic.twitter.com/yAAQST6onL
USB cable with implant for bi-directional RF communication connects mobile phone in airplane mode, with Win10 box (no network connections).
2nd mobile injects keystrokes and brings up a covert channel shell, using the RF implant. File transfer still works pic.twitter.com/yAAQST6onL
Prikaži ovu nit
-
-
-
While it is targeted for enterprises, there are USB controls in W10 to mitigate these type of threats.https://docs.microsoft.com/en-us/windows/security/threat-protection/device-control/control-usb-devices-using-intune#block-untrusted-and-unsigned-processes-on-usb-peripherals …
- Još 5 drugih odgovora
Novi razgovor -
-
-
That would be a very efficient counter measure (at least for HID keyboards). Could involve issues with clickers and other hardware promoting keyboards, but not having all physical keys (if the new device should enter the CAPTCHA).
-
Also should be implemented by OS vendor (
@Microsoft in this demo case). Most 3rd party Endpoint Protection and DLP solutions have issues with devices, as they have to hook/replace PnP OS drivers to enforce filter logic. Otherwise I totally agree with the idea. - Još 11 drugih odgovora
Novi razgovor -
-
-
Paging
@epakskape and the mitigation masters at Microsoft.. this seems too easy to not do it. Maybe not on by default if there’s some reason but I don’t think people should need to download a 3rd party driver for something so trivial to put into the OS, what do you say? -
Could tie it into Microsoft Authenticator push message, plz just don’t require sign in to local user with a Microsoft acct :)
Kraj razgovora
Novi razgovor -
-
-
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
This is in the palladium spec
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.