Was hoping to get your support to help to explain to our system admins how come the AV can't protect our enterprise from attacks that can be generated from USBninja. How can I explain our system admins that AV can't protect our enterprise machines from malware that come from USBninja?
It surprises me that you have to. But then, they might be unfamiliar with the USBninja. Explaining what the USBninja does should be sufficient for sysadmins. But the best way is to show them. Buy one. Set-up a HID-script that copies some data from the system to your USBninja. And have them run their anti-virusses at their leisure.
In mass storage mode, the USBninja is detectable by anti-virus. It will behave as a storage device, which might be useful if you want to extract larger chunks of data. However, you will probably not put a virus on it.
Experiment a bit with HID scripts. Get a few from the Internet like:
DELAY 5000 GUI r DELAY 1000 PRINT notepad ENTER DELAY 1000 PRINT Hello, World!
In general, a short presentation, followed by a demo should be sufficient.
- First explain what anti-virus does (signature detection, sometimes program behaviour)
- Explain what a USBninja does. Especially, explain the HID-mode. Make them understand that anti-virusses do not protect from keyboards.
- For fun, buy some cheap USB-cables that you leave scattered around the room. If they understood the message, no-one will dare to use those cables.