usbguard VS duckhunt

You want USBGuard. Its probably available in your distro repository. Its a very neat piece of software!

If I were an attacker, could I clone the device id and attributes of the victim's previously approved devices? https://github.com/USBGuard/usbguard#before-the-first-start

Anyway I enjoy this HID stuff, I've been playing with using a computer as a keyboard to another computer. With scroll, num, and capslock LED's, bidirectional communication can be achieved and by injecting a small process I think some new kind of universal REPL can be accomplished.

Few days ago I found this: https://usbguard.github.io/ but during read some information how-to, I found comments similar to this: "A USB device can identify itself basically however it wants ". What's your opinion? USBGuard could be a tool, that nice to have or could be useless for some reason?

Hello lynet_101 I think that UsbGuard is what you are looking for: https://usbguard.github.io/

For those wondering, there is an easy defense against this on Linux, USBGuard (https://usbguard.github.io/)

RHEL7+ include USBGuard as part of the standard repo [0]

[0] https://access.redhat.com/documentation/en-us/red_hat_enterp...

Isn't UsbGuard designed to prevent exactly just that?

The cheapest way is a solution that monitors for high-speed keystroke injection, which is what the rubber ducky is generally used for. One such project is https://github.com/pmsosa/duckhunt (I have no affiliation with this project. It appears to have been updated about 2.5 years ago)

(Found some code that does it, but I'm not sure if it's the same one that first I saw a while back)

If it acts as a keyboard, then it is a fast one and can be prevented. https://github.com/pmsosa/duckhunt

If you worry about badusb use this https://github.com/pmsosa/duckhunt it blocks keyboard input when detected too fast typing.

Looks like it doesn't even run on Linux. https://github.com/pmsosa/duckhunt#todo

It depends on the sophistication of the attack. You could for example try to detect it based on the manufacturer. That is your best option to prevent the attack by blocking it to act as a keyboard. If spoofed, or you don't have such a measure, you can try to detect it and then stop it. Typically, by focusing on the behavior from the keyboard. E.g., connected and tying without pause, monitoring the actual first commands from the keyboard,.. Have a look at https://github.com/pmsosa/duckhunt for example.