Re: USB Keyloggers

[Brad Judy <win-hied () BRADJUDY COM>]

> I've investigated one of the recovered devices and it actually has a Texas
Instruments USB hub chip installed.  So it does show up as an additional
device.  I haven't gotten around >to testing if the other device we've
recovered acts as a hub also, but in theory we could deny all devices except
for the mouse and keyboard.

In general, a computer is going to have at least a USB root hub, if not an
additional built-in USB hub (at least in terms of the device/driver level
stuff), so it would be a question of whether those tools are able to
differentiate between a necessary, built-in USB hub and the keylogger.  

Brad Judy