https://github.com/cispa/peripheralinstinct
Science Score: 36.0%
This score indicates how likely this project is to be science-related based on various indicators:
-
○CITATION.cff file
-
✓codemeta.json file
Found codemeta.json file -
○.zenodo.json file
-
✓DOI references
Found 3 DOI reference(s) in README -
✓Academic publication links
Links to: zenodo.org -
○Academic email domains
-
○Institutional organization owner
-
○JOSS paper metadata
-
○Scientific vocabulary similarity
Low similarity (9.7%) to scientific vocabulary
Repository
Basic Info
- Host: GitHub
- Owner: cispa
- License: mit
- Language: HTML
- Default Branch: main
- Size: 284 KB
Statistics
- Stars: 0
- Watchers: 3
- Forks: 0
- Open Issues: 0
- Releases: 1
Metadata Files
README.md
Peripheral Instinct: How External Devices Breach Browser Sandboxes
This repository contains the proof-of-concepts for our paper "Peripheral Instinct: How External Devices Breach Browser Sandboxes" which was presented at The ACM Web Conference 2025. The paper can be found here.
The repository is merely a collection of proof-of-concepts and is thus not well-documented, maintained or suitable for direct use.
The artifact is citable via the following DOI: 
Exploit
This part of the repository contains the code that can be used to reprogram devices from the web using different Browser APIs.
We cover the following devices:
- Logitech Devices using HID++ 1.0 and 2.0+
- CH57X-based macropads
- Zelotes Gaming Mouse
- Launchpad MK2 (webmidi)
- Hayes Modem (webserial)
Note that keyboards using the VIA firmware may already be configured from the web via their own application which is open-source.
Further it contains a few payloads for different systems that may occasionally rely on the clipboard.
Miscellaneous
This part of the repository contains the test and results for the minimal timing differences between macro-emitted keystrokes. Further it contains a variety of smaller tests that were used to evaluate general permissions of the WebHID API.
Mitigation
This folder contains the extension-based mitigation that we propose in our paper.
In addition, it contains the proposed tool to identify reprogrammable devices.
Another demonstration modifies the firmware of the Blink(1) which can be found in this repository. It relies on the Usage to make functionality inaccessible to WebHID.
Disclaimer
This repository is for educational purposes only. The authors do not take any responsibility for the misuse of the information provided in this repository. Do not run the code on devices you do not own or have permission to modify. We are not responsible for any damage caused by the use of the code in this repository.
Owner
- Name: CISPA
- Login: cispa
- Kind: organization
- Email: front-office@cispa.de
- Location: Saarbrücken, Saarland, Germany
- Website: https://cispa.de
- Twitter: CISPA
- Repositories: 7
- Profile: https://github.com/cispa
GitHub Events
Total
- Watch event: 1
- Public event: 1
- Push event: 1
- Fork event: 1
- Create event: 1
Last Year
- Watch event: 1
- Public event: 1
- Push event: 1
- Fork event: 1
- Create event: 1
Dependencies
- @testing-library/jest-dom ^5.16.5
- @testing-library/react ^13.4.0
- @testing-library/user-event ^13.5.0
- @types/jest ^27.5.2
- @types/node ^16.18.11
- @types/react ^18.0.27
- @types/react-bootstrap ^0.32.32
- @types/react-dom ^18.0.10
- bootstrap ^5.2.3
- react ^18.2.0
- react-bootstrap ^2.7.0
- react-dom ^18.2.0
- react-scripts 5.0.1
- typescript ^4.9.4
- web-vitals ^2.1.4