An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks. These services, including IP-based keyboard, video, or mouse (KVM) devices such as TinyPilot and PiKVM, are commonly used as legitimate tools and may be allowed by peripheral device policies within a target environment.
Remote access hardware may be physically installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote session with the target system. Using hardware-based remote access tools may allow threat actors to bypass software security solutions and gain more control over the compromised device(s).(Citation: Palo Alto Unit 42 North Korean IT Workers 2024)(Citation: Google Cloud Threat Intelligence DPRK IT Workers 2024)
Detect Remote Access via USB Hardware (TinyPilot, PiKVM)
Limit Hardware Installation: Prevent unauthorized users or groups from installing or using hardware, such as external drives, peripheral devices, or unapproved internal hardware components, by enforcing hardware usage policies and technical controls. This includes disabling USB ports, restricting driver installation, and implementing endpoint security tools to monitor and block unapproved devices. This mitigation can be implemented through the following measures:
Disable USB Ports and Hardware Installation Policies:
Deploy Endpoint Protection and Device Control Solutions:
Harden BIOS/UEFI and System Firmware:
Restrict Peripheral Devices and Drivers:
Disable Bluetooth and Wireless Hardware:
Logging and Monitoring:
Tools for Implementation
USB and Device Control:
Endpoint Monitoring:
Hardware Whitelisting:
BIOS/UEFI Security:
No cross-framework mappings available