Saila: Human Interface Device (HID) Injection Protection with Smart Phone based Passwordless Security

• Main Authors: Ghosh, Anisha, Mitra, Aditya, Sibi Chakkaravarathy, S, Devi Priya, V S, Anitha, S, Babu, Rakesh Thoppaen Suresh
• Format: Conference Proceeding
• Language: English
• Subjects: Authentication; Computers; FIDO2; HID Injection; HID injection prevention; Human Interface Device; Information security; Input devices; Keyboards; Mice; Object recognition; Passwordless Authentication; Universal Serial Bus
• ISSN: 2332-5666
• DOI: 10.1109/ICDCSW63686.2024.00023

The necessity for data protection is growing rapidly due to the increase in different kinds of attacks on information security systems. Standard computers and data processing machines are designed to be user-friendly, allowing human interaction through input devices like keyboards, mice, pointing devices, joysticks, game controllers, and more, collectively known as Human Interface Devices (HID). Malicious actors exploit these components to design attacks such as HID Injection. It entails plugging an accessible device-such as a USB stick-into the computer. The USB stick emulates a HID device, generally a keyboard, and enters malicious commands or scripts as if the user is manually typing it. This work presents an approach, Saila, that analyses and computes the configurations of peripheral devices that are attached, enabling it to automatically identify malicious USB. We employ FIDO2 specifications to evaluate the comparability between registered hardware and potentially dangerous hardware connected to the system. Saila has been tested using a variety of HID injection tools and has been observed that it disconnects the USB port and stops the attacker from moving forward if the evaluation is unsuccessful.