@_MG_ @ektoplant @Korsakoff1 @campuscodi @LucaBongiorni Agreed on both. Depends on attack style.
If a user should do injection by accident and the attack should succeed before intervention (f.e. device looking like flashdrive), typing has to be fast (and will still be noticed).
1/n
If a user should do injection by accident and the attack should succeed before intervention (f.e. device looking like flashdrive), typing has to be fast (and will still be noticed).
1/n
@_MG_ @ektoplant @Korsakoff1 @campuscodi @LucaBongiorni If you have interactive control on injection (point in time when it should happen; speed; actual payload to type), typing speed is less a concern. Injection could be carried out when the user doesn't notice it (f.e. injection implants in legit devices).
2/n
2/n
@_MG_ @ektoplant @Korsakoff1 @campuscodi @LucaBongiorni In both variants, first infection stage (the one typed out) should require only a few characters. This is esp. true for Internet connected targets (f.e. short download cradles in stage 1).
3/n
3/n
@_MG_ @ektoplant @Korsakoff1 @campuscodi @LucaBongiorni Behavior analysis/typing speed analysis is a valid mitigation for most attacks IMO.
Still I'd prefer enforced user confirmation whenever drivers for secondary input devices are loaded
4/4
Still I'd prefer enforced user confirmation whenever drivers for secondary input devices are loaded
4/4
