Can one not just connect the KVM to something other than the organisation’s network itself? I was thinking of something like a cellular network or similar? Will that not completely remove any risk of it being detected by the organisaton?
For the network side yes.
But not if the laptop is company property, they likely look at the connected hardware.
I did noticed somewhere that the mounting for example still install a gl-inet driver, and likely even if mounting was not active for the first time there is a chance the gl monitor driver was installed previously but shown as inactive when edid was modified.
I think it is something like that, their agent software creates a record of everything what happened even when offline.
Also you could try my theory with wazuh, I think they use something very similar like wazuh as agent to get a broader understanding how such agents on a system can see everything 
1 Like
Not sure if this has been discussed, but picking the “Logitech Unifying Receiver for Keyboard” under custom device has the KVM present vid/pid of 046D/C526. Couple of issues that could cause someone to get flagged if Security wanted to get really tight:
- Product string presented by GLKVM is “Logitech, Inc. Unifying Receiver”. It should simply be “Unifying Receiver”
- Product ID presented by GLKVM is C526, which is “Nano Receiver”. “Unifying Receiver” should be C52B or C532
- The logitech microphone device is placed under the Unifying / Nano receiver composite device, which is physically impossible. These receivers only support keyboard and mouse. GLKVM should present the logitech zone wireless unifying + audio receiver instead, which is probably 0A90, and the corresponding zone headset
Has anyone else noticed these discrepancies?
1 Like
That’s not good… which one are you thinking is the most accurate at this point? @minmie Flagging this post from @beefcafe in case dev team didn’t see it
Out of curiosity, would it be possible to emulate a USB hub layout, with each device being connected to a port on the virtual hub? That way the PC sees a hub attached to its USB port with individual devices attached instead of a single composite devices.
There is no way to simulate a USB Hub.
In that case, the best approach is probably to emulate the unifying receiver + audio. That is the only plausible way a dongle composite device would have keyboard, mouse and a headset (microphone in our case)
1 Like
this is the best comment
This is not possible.
The problem is that the driver still needs to be signed, contains various metadata which is immutable telling it is a composite hub.
Having this dynamic would therefor force unsigned drivers breaking the chain of trust of the entire OS and then windows is not happy about this + that is a more red flag in security in their systems.
All fun that the name can be spoofed but this does not mean all the other things can.
huh? wym
It was detected immediately. I was online really late at night on a holiday trying to test it out and crowdstrike immediately sent me a notification and prevented me from accessing the internet etc.
1 Like
@trinhxh - sorry no updates on this. I gave up on adjusting the device identifiers.
Could you provide a detailed description of your device's configuration prior to detection?