Too bad kaspersky has been banned/cancelled in my country (USA). Any alternatives? I don’t necessarily use antivirus, thought it was unnecessary with Windows 11 built in Security. But now my mind is changing… anyways There should be a open source tool for Windows that only allows only 1 trusted keyboard/mouse to input and monitors for anything sketchy in USB firmware. Seems easy enough to create.
Still doesn't protect you from a wireless reply attack assuming no encryption in your device is present or hid spoofing. The safest scenario will be using encryption always even with cable keyboard/mouse and a pre-auth with a public/private key scheme like the one in android debugger bridge or TLS.
it has no way of telling that that device isn't a logitech keyboard, and can't tell that it's not the user opening up elevated cmd.exe and accepting the prompt
Comments
This is a well-known mode of attack and some anti-virus software have protections against it: https://www.kaspersky.com/blog/weaponized-usb-devices/26495/
Too bad kaspersky has been banned/cancelled in my country (USA). Any alternatives? I don’t necessarily use antivirus, thought it was unnecessary with Windows 11 built in Security. But now my mind is changing… anyways There should be a open source tool for Windows that only allows only 1 trusted keyboard/mouse to input and monitors for anything sketchy in USB firmware. Seems easy enough to create.
The paid version of Windows Defender can do it: https://docs.microsoft.com/en-us/microsoft-365/security/defe...
I found this which claims to block these attacks: https://www.gdatasoftware.com/antivirus-windows
Still doesn't protect you from a wireless reply attack assuming no encryption in your device is present or hid spoofing. The safest scenario will be using encryption always even with cable keyboard/mouse and a pre-auth with a public/private key scheme like the one in android debugger bridge or TLS.
how can anti-virus protect against it?
it has no way of telling that that device isn't a logitech keyboard, and can't tell that it's not the user opening up elevated cmd.exe and accepting the prompt
From the linked article: