(untitled)

everyone has seen those nice videos or articles where someone pretends to be someone's external keyboard and takes advantage of the victim's system being trusting and does whatever to prove the concept, right? so i was wondering, is there any reason why external usb devices don't use signatures to prove the signal is coming from them? i am not even talking about encryption (possibility of eavesdropping on key strokes for example is another thing), just to say "hey. yeah, it's me." it's just a thought, so if it's not possible for any reason, sorry, but i couldn't find any reason why not do this.

oh also maybe when a device connects it would have to introduce itself (what kind of type device it is), so you won't have instances when headphones can type or whatever... the fact systems don't check for this is silly (yes i know devices could lie, the point is when i connect my headphones and someone wants to hijack the signal they wouldn't be able to type)

>>10723 I would recomend you ask in an exising thread or QTDDTOT. There are standards so that a system knows what a device is to figure out how to use it. Malicious actors can use a "rubber ducky" to act like a keyboard. If someone is taking over a computer that might be a RAT remote access trojan. I you are talking about people using wireless keyboard and the signal getting intercepted, please clarify. Bluetooth pairing already has the "hey it's me" thing you were talking about.

The real question is: why would an OS accept another keyboard without prompting user? Why can't user control what ports are powered currently and which of them allow keyboards to be connected?

>>10725 Gamepads. They give keyboard signals too. You can disable usb ports in bios and on OS lvl.

>>10726 The OS still has to inform user when an input device is connected, and possibly also not mount it's storage automatically eiher. Especially when user connects a flash drive and not a game pad. That way, these rubber duckies are no different from connecting a keyboard and typing rm -rf really quick and being prompted with admin password entry, lol.

>>10724 can't find that article at the moment (will try to check if my old computer got the link saved somewhere), but there have been cases of relatively reputable manufacturers selling external devices and their dongles just didn't really care you connected different thing to them (including another computer - so basically a rubber duck as you mentioned) so it seems dongles do trust blindly any schmuck that connect to them.

>>10725 Qubes actually protects against this by disabling usb input on laptops with i2c keyboards.

>>10734 That's real nice. Is there some kind of kernel patch, etc. that it uses to do this or is it purely able to by virtue of hypervisor?

>>10757 Qubes isolates all usb devices in a usb vm including input if you have non usb input devices available.