From stolen laptop to inside the company network

Re:From stolen laptop to inside the company network by not1ofU on Wednesday July 28, 2021 @08:42PM (#27991505)

Probably they are lot more advanced then they used to be, but yeah, checking for device ID / Process ID in combination with binary (.exe) and location. Typically these Programs are portable (no installation required, just run the .exe.) and on a corporate machine there are not many places to store it (typically within your user profile). Programs like "Process Explorer" and "Process Monitor" will give a great amount of detail on processes which can be used for detection.

https://docs.microsoft.com/en-us/sysinternals/downloads/proc...

[ Parent | on HN ]

Re:From stolen laptop to inside the company network by wiml on Wednesday July 28, 2021 @09:52PM (#27991948)

The linked device is a hardware mouse jiggler, not software. USB devices are easy to imitate, so such a jiggler could be programmed to look like, for example, last year's most popular wireless mouse.

[ Parent | on HN ]

Re:From stolen laptop to inside the company network by theamk on Wednesday July 28, 2021 @10:54PM (#27992300)

But this a physical USB device which presents exactly the same interface as a real mouse, likely up to the device descriptor.

There is no device ID, process ID or binary to match.

[ Parent | on HN ]