Security Basics mailing list archives

Re: Programmable USB device that can send keystrokes?


From: "vipw01 () gmail com" <vipw01 () gmail com>
Date: Mon, 7 Apr 2008 18:08:00 +0200

On 07/04/2008, Matt Bragano <maestro485 () comcast net> wrote:
I assume you want to take advantage of the auto-execute property on many
Windows machines.  Unfortunately, many Windows machines are configured to
automatically execute a given program when a disc or USB stick is inserted
even though it isn't the most secure behavior.  However, the goal you are
describing really isn't possible.  Any program that is executed on a given
machine must be loaded into memory one way or another.  Apart from writing
some low level assembly, you're likely going to have to employ some other
system libraries to initiate a mouse movement event in whatever code you
write.  (Of course, even the assembly code will be 'loaded' on the computer,
but possibly more discreetly.)  Despite this, auto-execute can still be
quite useful as a security test.  Write some "malicious" code, toss the USB
stick in the machine and see what happens.

You don't have to use Windows features. This USB-device can emulate
USB keyboard and mouse (in theory :-)). It does not have to be OS
dependent.


Current thread: