The Human Interface Device Attack from the Perspective of the Attacker and the Forensic Analyst

The main prerequisite to extract data from a smartphone or exploit the device is to bypass its lock screen protection. The Human Interface Device (HID) attack is a promising method to break the Android lock screen protection. An attacker can use a smartphone as an attack device. Therefore, this attack can be carried out unnoticed in some cases. This work describes a way to effectively detect the HID attack, whether attack was executed successful or failed, determines its time frame and compares the outputs of several devices from different manufacturers and points out the connections and differences between them. The work examines the defense strategy against HID attack and prevention before losing data in buffers.