Podjetje Google orodje , allowing tracking and blocking , carried out using malicious USB devices that simulate a USB keyboard for hidden keypress spoofing (for example, during an attack, there may be a sequence of keystrokes that leads to the opening of a terminal and execution of arbitrary commands). The code is written in Python and pod licenco Apache 2.0.
The utility runs as a systemd service and can operate in monitoring and prevention modes. In monitoring mode, it identifies potential attacks and logs activity related to attempts to misuse USB devices for input spoofing. In protection mode, upon detecting a potentially malicious device, it disconnects it from the system at the driver level.
Malicious activity is identified based on heuristic analysis of the input nature and delays between keystrokes — the attack is usually conducted in the presence of a user, and to remain undetected, the simulated keystrokes are sent with atypical minimum delays for normal keyboard input. Two settings, KEYSTROKE_WINDOW and ABNORMAL_TYPING (the former defines the number of keystrokes for analysis, while the latter sets a threshold interval between keystrokes), are proposed to change the attack detection logic.
An attack can be carried out using a non-suspicious device with modified firmware; for example, a keyboard can be simulated in , , ili (v a special utility is offered for input spoofing from a smartphone connected to a USB port running the Android platform). To complicate USB attacks, in addition to ukip, the package , which allows connecting devices only from a whitelist or blocks the possibility of connecting unauthorized USB devices when the screen is locked and does not allow interaction with such devices after the user returns.
Izvor: opennet.ru
