From stolen laptop to inside the company network

Re:From stolen laptop to inside the company network by theamk on Wednesday July 28, 2021 @07:22PM (#27991011)

Genuinely curious: how would they do this?

The naive approach is to look at device ID, but article already talks about copying identification data, and the rest of USB descriptor is trivially copyable as well.

Is the system going to have a rule like "mouse moves same amount of pixels with equally spaced pauses"? But what if they randomize motion commands and intervals between them?

[ Parent | on HN ]

Re:From stolen laptop to inside the company network by not1ofU on Wednesday July 28, 2021 @08:42PM (#27991505)

Probably they are lot more advanced then they used to be, but yeah, checking for device ID / Process ID in combination with binary (.exe) and location. Typically these Programs are portable (no installation required, just run the .exe.) and on a corporate machine there are not many places to store it (typically within your user profile). Programs like "Process Explorer" and "Process Monitor" will give a great amount of detail on processes which can be used for detection.

https://docs.microsoft.com/en-us/sysinternals/downloads/proc...

[ Parent | on HN ]

Re:From stolen laptop to inside the company network by wiml on Wednesday July 28, 2021 @09:52PM (#27991948)

The linked device is a hardware mouse jiggler, not software. USB devices are easy to imitate, so such a jiggler could be programmed to look like, for example, last year's most popular wireless mouse.

[ Parent | on HN ]

Re:From stolen laptop to inside the company network by theamk on Wednesday July 28, 2021 @10:54PM (#27992300)

But this a physical USB device which presents exactly the same interface as a real mouse, likely up to the device descriptor.

There is no device ID, process ID or binary to match.

[ Parent | on HN ]