Close

Hardware Protection Improvements and New Monitoring Features

A project log for Cerberus — A USB Watchdog

Cerberus is my extension of USBvalve. Built on a Raspberry Pi Pico, it detects malicious USB devices to stop them before they reach the host

glitchboiGlitchboi 9 hours ago0 Comments

Hi guys, these past few days I’ve been working more on the project, and I realized there were several things I could improve. For example, I managed to make the device withstand voltage spikes of up to 1500 V without being damaged, which greatly helps protect the hardware. The previous prototype could handle a USB Killer up to version 2, but starting from version 3 it no longer worked, so I had to adapt the design so it could withstand version 3 as well.

I added a fuse to prevent any component from burning out. This allowed me to avoid having to replace the entire circuit component by component in case of an overload.

I also had to redesign the entire prototype. The PCB was provided by PCBWay, a great sponsor that not only supplied a high-quality PCB but also helped source and solder some of the best components, which were difficult to find due to how unique they are. This made the result higher quality while keeping the cost very reasonable.

On the software side, I’ve also been doing quite a lot of work. For the Blue Team, I developed several functions that allow us to obtain more information about the detected devices. For example, it is now possible to see what type of device it is, what is being typed, and even how many words per second are being typed. All of this helps generate faster and more precise responses to potential attacks.

For the Red Team, in addition to having access to this information, attacks can now also be adjusted depending on the device that gets connected, making them more effective or harder to detect depending on the situation.

I also added something that I personally felt was very necessary: console commands to review the system history. With these commands, it’s now possible to see the most recent recorded attacks, identify what type of device was involved, and save that information to analyze it later in more detail. This is very useful when you want to understand exactly what happened during a test or improve strategies for the next one.

Discussions