Google Inc. utility , allowing for tracking and blocking , carried out using malicious USB devices that simulate a USB keyboard for stealthy injection of fake keystrokes (for example, during an attack, a sequence of keystrokes may lead to the opening of a terminal and the execution of arbitrary commands). The code is written in Python and under the Apache 2.0 license.
The utility runs as a systemd service and can operate in monitoring and prevention modes. In monitoring mode, it detects potential attacks and logs activity related to attempts to misuse USB devices for input substitution. In protection mode, upon detecting a potentially malicious device, it disconnects it from the system at the driver level.
Malicious activity is identified based on heuristic analysis of the nature of input and delays between keystrokes — an attack is usually conducted in the presence of the user, and in order to remain unnoticed, simulated keystrokes are sent with atypical minimal delays for regular keyboard input. Two settings, KEYSTROKE_WINDOW and ABNORMAL_TYPING, are proposed to alter the logic of attack detection (the first defines the number of keystrokes for analysis, and the second sets the threshold interval between keystrokes).
An attack can be carried out using a seemingly innocuous device with modified firmware; for example, a keyboard can be simulated in a , , or (in a special input substitution utility is offered for use with a smartphone connected to the USB port running the Android platform). To complicate USB attacks, in addition to ukip, the , which allows the connection of devices only from a whitelist or blocks the connection of external USB devices during screen lock and prevents operation with such devices after the user returns.
Source: opennet.ru
