you are viewing a single comment's thread
view the rest of the comments
[–] 5 points 2 months ago (5 children)

If I got it right, you could easily detect this drive by just creating password.txt. as the article says it creation is intercepted and skipped. Hence if there is no password.txt afterwards, you know what you're dealing with. Still, you have to know this AND care.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 10 points 2 months ago (2 children)

    It looks for a string "password:xyz" bring written to any file, where xyz is the password. If you get the password wrong it'll just write the file normally

  • source
  • parent
  • hideshow 2 child comments