usb keyboard connected randomly to dedi (hetzner)

Kkkkm

hello,
to our concern, on a server we manage, without us ever asking for support, a
random usb keyboard was connected to the dedicated server, after over 100+ day uptime. Is this normal? usb rubber ducky?lol

We just managed to find the below on our dmesg logs..

]# dmesg -T
[Sat Feb 26 04:13:30 2022] usb 1-4: new high-speed USB device number 2
using xhci_hcd
[Sat Feb 26 04:13:31 2022] usb 1-4: device descriptor read/64, error -71
[Sat Feb 26 04:13:31 2022] usb 1-4: New USB device found,
idVendor=1a40, idProduct=0101, bcdDevice= 1.11
[Sat Feb 26 04:13:31 2022] usb 1-4: New USB device strings: Mfr=0,
Product=1, SerialNumber=0
[Sat Feb 26 04:13:31 2022] usb 1-4: Product: USB 2.0 Hub
[Sat Feb 26 04:13:31 2022] hub 1-4:1.0: USB hub found
[Sat Feb 26 04:13:31 2022] hub 1-4:1.0: 4 ports detected
[Sat Feb 26 04:13:31 2022] usb 1-4.1: new low-speed USB device number
3 using xhci_hcd
[Sat Feb 26 04:13:31 2022] usb 1-4.1: New USB device found,
idVendor=046d, idProduct=c31c, bcdDevice=64.00
[Sat Feb 26 04:13:31 2022] usb 1-4.1: New USB device strings: Mfr=1,
Product=2, SerialNumber=0
[Sat Feb 26 04:13:31 2022] usb 1-4.1: Product: USB Keyboard
[Sat Feb 26 04:13:31 2022] usb 1-4.1: Manufacturer: Logitech
[Sat Feb 26 04:13:31 2022] input: Logitech USB Keyboard as
/devices/pci0000:00/0000:00:14.0/usb1/1-4/1-4.1/1-4.1:1.0/input/input4
[Sat Feb 26 04:13:31 2022] hid-generic 0003:046D:C31C.0001:
input,hidraw0: USB HID v1.10 Keyboard [Logitech USB Keyboard] on
usb-0000:00:14.0-4.1/input0
[Sat Feb 26 04:13:31 2022] input: Logitech USB Keyboard as
/devices/pci0000:00/0000:00:14.0/usb1/1-4/1-4.1/1-4.1:1.1/input/input5
[Sat Feb 26 04:13:31 2022] hid-generic 0003:046D:C31C.0002:
input,hidraw1: USB HID v1.10 Device [Logitech USB Keyboard] on
usb-0000:00:14.0-4.1/input1
[Sat Feb 26 04:13:44 2022] usb 1-4: USB disconnect, device number 2
[Sat Feb 26 04:13:44 2022] usb 1-4.1: USB disconnect, device number 3

ExpertVM

Maybe a honest mistake since the person notice it after 10 seconds that the server he suppose to work on that the mouse not responding?

Vita

Well if someone was trying to bruteforce your login credential from the DC via keyboard I guess you would see that in logs as well. Also they could have just staged an "incident" situation pull your disks and get the data they need .

So probably a mistake.

jar

+1 to mistake. I can't imagine what you could do in such a short time frame that would be of any consequence.

jmgcaguicla

Nuke it, they already have all your data

Hetzner_OL

Hi there @Kkkkm - If you write to our support team via your Robot account, they can most likely tell you what happened here. --Katie