duckhunt VS exabgp

The cheapest way is a solution that monitors for high-speed keystroke injection, which is what the rubber ducky is generally used for. One such project is https://github.com/pmsosa/duckhunt (I have no affiliation with this project. It appears to have been updated about 2.5 years ago)

(Found some code that does it, but I'm not sure if it's the same one that first I saw a while back)

If it acts as a keyboard, then it is a fast one and can be prevented. https://github.com/pmsosa/duckhunt

If you worry about badusb use this https://github.com/pmsosa/duckhunt it blocks keyboard input when detected too fast typing.

Looks like it doesn't even run on Linux. https://github.com/pmsosa/duckhunt#todo

It depends on the sophistication of the attack. You could for example try to detect it based on the manufacturer. That is your best option to prevent the attack by blocking it to act as a keyboard. If spoofed, or you don't have such a measure, you can try to detect it and then stop it. Typically, by focusing on the behavior from the keyboard. E.g., connected and tying without pause, monitoring the actual first commands from the keyboard,.. Have a look at https://github.com/pmsosa/duckhunt for example.

I'm curious how ExaBGP works. In particular:

I don’t know of a specific Java implementation but https://github.com/Exa-Networks/exabgp might fit in ok. Use exa to talk bgp but write java applets to “do things” with what exa hands you.

> not to be tenable in Python

https://github.com/Exa-Networks/exabgp is written in python

"Those translation queries are answered by our authoritative name servers that occupy well known IP addresses themselves, which in turn are advertised to the rest of the internet via another protocol called the border gateway protocol (BGP)."

"To ensure reliable operation, our DNS servers disable those BGP advertisements if they themselves can not speak to our data centers, since this is an indication of an unhealthy network connection."

Correct me if I am wrong, but here "DNS servers" means the computers, not the software running on them, i.e., each computer is running both DNS server software and a BGP daemon.

For example, with a BGP daemon like ExaBGP the output of a DNS query can be checked and routes could be removed if the query fails.

https://github.com/Exa-Networks/exabgp

13 years ago I wrote a nice reference implementation for BGP "client" use - I just treated it as an API onto Cisco routers: https://github.com/BytemarkHosting/bgpfeeder is 1300 lines of Ruby, one file, no dependencies, and quite verbose.

At the time I was running a hosting company & wanted to feed updates to our IP lists from a web-based database into our routers (e.g. a customer wants a new IP to their servers, or moves their VPS images between physical hosts). But I couldn't understand how to get tight control of quagga, or the Ciscos and wondered how how to speak it directly?

It took about a week poring over the RFCs and the Net::BGP Perl module, but I can go back to it now for some useful revision. It brought a lot of disparate BGP knowledge together in one place, and re-expressed it in a language I still know. So if you know Ruby and are curious about BGP it might help you see what you can do with it.

Though if you want to use BGP to control your network devices today, you'd use https://github.com/Exa-Networks/exabgp instead. It can pull every trick you could possibly want with BGP - e.g. DDoS mitigation, anycast, and generally letting you mess with BGP via JSON. There are lots of extensions to BGP, and I only cared about the ones to send v4 & v6 routes around. Also I only wanted to write it all in one file :)