0

I'm in a fun security-battle with a co-worker, where we each try to attach each others system in order to send out an email to all other co-workers in which they are invited to come and have a sweet treat.

I run Ubuntu 14.04 and have an encrypted harddrive. I use a passphrase to unlock that and have a fairly strong password on my account. I automatically lock the screen each time.

I tried to think of attack vectors, and thought of a hardware keylogger. I think that is basically undetectable, but what IS detectable is the detachment of my usb-keyboard.

I tried to built something myself, by reading the output of lsusb and calling notify if something has changed. This is kinda cumbersome, so basically what I would like to know:

TL;DR Is there a tool that provides alerts on usb attachment / detachments of devices?

Rob Audenaerde
  • 253

1 Answers1

1

If he is plugging in a USB, whether is is set up U3 or as a HID device, I believe it will always show up in dmesg.

As far as an unplug alert, you would essentially follow these udev rule instructions, substituting "add" for "remove"

Community
  • 1
cremefraiche
  • 307