I'm in a fun security-battle with a co-worker, where we each try to attach each others system in order to send out an email to all other co-workers in which they are invited to come and have a sweet treat.

I run Ubuntu 14.04 and have an encrypted harddrive. I use a passphrase to unlock that and have a fairly strong password on my account. I automatically lock the screen each time.

I tried to think of attack vectors, and thought of a hardware keylogger. I think that is basically undetectable, but what IS detectable is the detachment of my usb-keyboard.

I tried to built something myself, by reading the output of lsusb and calling notify if something has changed. This is kinda cumbersome, so basically what I would like to know:

TL;DR Is there a tool that provides alerts on usb attachment / detachments of devices?


If he is plugging in a USB, whether is is set up U3 or as a HID device, I believe it will always show up in dmesg.

As far as an unplug alert, you would essentially follow these udev rule instructions, substituting "add" for "remove"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.