4

I have managed to stop most of the attack vectors using a varity of different group policies. The only one that I'm having issues with is when it uses the HID attack method.

Has anybody come up with a solution of how to stop it imitating a keyboard and getting let into the system?

  • Have you tried simply Googling methods for preventing Rubber Duckys? – J.J Jun 11 '18 at 12:06
  • Yes and i found most of the way's to stop except the one above which is why i am asking for advice – ben950 Jun 11 '18 at 12:33
  • My apologies Ben I poorly read the title and body. However, your title doesn't quite match the body. "Stop a rubber ducky" then in the body you're having an issue with a SPECIFIC method. I think you should edit the title – J.J Jun 11 '18 at 12:54
  • 1
    Will do now sorry for confusion – ben950 Jun 11 '18 at 14:08
  • Look into USBGuard for kernel-level USB access control, which prevents untrusted devices from doing anything. – multithr3at3d Jun 11 '18 at 22:52
1

Physical access to a USB port means you're pretty much screwed.

HID (ie, keyboard) emulation is only one thing that a USB device can do. It can also pretend to be an ethernet interface, or a modem, and offer "network access" to the PC. If the OS helpfully autoconfigures it, and decides to use it, then the device will be able to sniff the network traffic, spoof DNS queries, etc.

More details here.

Now, if you're only interested in stopping this and not the other attacks, you can stop it with software that will detect an excessive typing speed. That won't stop a slow rubber ducky of course. You could check the USB VID/PID of the keyboard, but a USB device can easily spoof these.

Really, USB is physical access, it's insecure.

1

Well I guess writing a filesystem filter would not hurt? Then when a USB is plugged in you can somehow get a copy of the firmware. I guess > http://openocd.org/. then you can analyze from there and then block/allow it...

But take a look at this, https://www.kanguru.com/info/kanguru-usb-drives-with-secure-firmware.shtml "USB flash drives .... built with digitally-signed secure firmware"

Or you can just "educate" the user I suppose...

1

You should get software that locks the screen when a HID is inserted. (For example Penteract Disguised Keyboard Detector.)

That should protect your computer provided you have a strong enough password for it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.