[malfist]

Do hardware keyloggers trigger endpoint security?

[Sohcahtoa82]

A hardware keylogger has to sit as a MitM between the keyboard and the USB port.

Sufficiently paranoid endpoint security could trip when the keyboard is unplugged and then plugged back in.

[dannyw]

That must have a lot of false positives for all but the most paranoid environments.

[RedTeamPT]

No, but hardware keylogger require physical access.

[malfist]

What is the difference between "physical access" and "powerful position with local access"

[Robin_Message]

It's the difference between the evil maid attack (someone sneaks a keylogger into your turned-off machine whilst cleaning your room) vs local privilege escalation (the sysadmin installs a game and now your entire network is owned).

[sumedh]

I asked ChatGpt "where can I buy hardware keyloggers"

It just shut me down "I can't assist with that request."

[ametrau]

This company makes nice ones:

https://shop.hak5.org/blogs/payloads/duckylogger

[eddythompson80]

They do not