Build a better mouse jiggler and the world will beat a path to your door

Been getting lots of ads for Amazon electronics on Facebook lately. Tonight one of the items was an “Undetectable Mechanical Mouse Jiggler”. Never having heard of one I clicked through and had to read quite a bit of the page before it hit me what it is for: it allows remote workers with monitoring software on their computers to look like they are working when they are not.

https://www.amazon.com/dp/B0BX5C88B2

Gotta say that this is a product category that never occurred to me before, but somebody imagined the niche and filled it.

Allegedly, the captchas that just consist of checking “I am not a robot” also work (in part) by detecting human-like mouse-jiggle. So it could also be used for beating those.

That explains a lot.

I have a second mouse plugged into my laptop with an old sensor that will start “jiggling” by placing it on the edge of a small stack of paper. I use it at work not to fake working for any length of time but because Teams is set so it calls me “Away” if I stop inputting for more than about two minutes. Get a cup of coffee, “away”. Reading a PDF, “away”, answering my work phone, “away”, etc. Sometimes I’m using my home computer for work stuff (since it’s considerably more powerful than my laptop) but I’m right next to my laptop that’s declaring me AWOL. It’s annoying and so I use the second mouse to keep it “active” while I’m active – just not actively typing on the thing.

Back around the year 2000 I signed up for several “paid to surf” companies and actually got paid a few grand or so iirc. So, basically if you ran a certain adbrowser thing (Man, I’m getting old because I don’t remember what these things were called) and stayed active you would get paid for all the time you were active online and they served you ads. There were many of them, they all had a MLM/referral component and there was even a free site where you could put all your IDs for every one you joined and anyone who went to that link would join them all under you and you got so many tiers of a %. They were all over the place, people would put their links on (physical irl) bulletin boards and at laundromats, grocery stores, campuses, etc.

So, you got paid for being active in your browser. And I don’t remember what we used, but there was some way (maybe multiple ways) to trick it and keep you active for long periods of time when you were away. Probably some easily detectible software that wouldn’t work, I guess. But I’m surprised they didn’t have a mouse jiggler back then.

Mechanical mouse jiggler? That’s a new one to me. I have heard of people cobbling something like that together, but just figured they hadn’t heard of the electronic kind.

The electronic version has been around for quite some time, and it’s actually a fun little Arduino project to write if you get one of those esp32 usb dongle thingmabobs. All it does is present itself as a new USB mouse, and it sends random mouse movements every few seconds. In fact, it’s one of the demo projects for the Arduino IDE, I believe.

Besides slackers using them to appear like they are doing work, they are in many hacker’s toolkits, both black hats and white hats. It is handy tool to use to keep an unlocked computer from going to sleep. Forensics folks even use them as they carefully move a PC in the wild onto a portable power supply so they can cart the whole kit and caboodle, still running and logged in, back to the lab where they can do whatever it is that they need to do.

One trick I was told about was to place your mouse on a functional analog watch. Apparently the laser picks up the movement of the hands and shows you “active.”

Neato! I just set my mouse on my Seiko and watched as the cursor danced a little jig once a minute as the second hand swept by.

Good one. I remember hearing about someone tipping a big speaker cabinet on its back and letting the mouse dance around on the woofer.

My Seiko is a self-winder so I then need to put the watch on an auto winder, and then tape the mouse to it. Shoot, I use a corded mouse which will rapidly get tangled up so I’ll need to engineer some sort of whole computer rotater that runs off a battery pack. No wonder this mouse jiggler is complicated stuff!

These would also help if you’ve got a computer that times out and locks itself too quickly, and for which logging back in is a pain in the neck. I was on a project a few years ago that involved getting into the laptop, then connecting to a virtual desktop, then when THERE, connecting to 3-4 other things. It was a huge pain, and I looked into getting such a gadget.

Sadly, they won’t work with my trackball mouse.

I once read a suggestion of opening up a notepad document, and jamming a card or something into the keyboard to force it to continuously type a character.

I never tried that one.

If we had a Roomba or a dog, I’d consider attaching my Fitbit to it just to see what it would do. Same concept, if a very different purpose. Maybe a wireless mouse could keep a computer alive that way too!

We had a shared computer at work a couple years ago (it was a PC attached to a document scanner) that was getting to be so old that the network didn’t want to recognize it. If you were logged on you were OK, but if you logged off you might not get logged back in. And in fact we were down to only one late-shift user who could still log in, so we had to come up with a way to keep him “active” all night after he went home so that he didn’t get automatically logged out.

What he did was set the keyboard repeat rate to the slowest possible rate, then opened Notepad and set a stapler on the space bar. Then he would turn the monitor off so it looked like the PC was off. When the morning crew came in, they would turn on the monitor and take the stapler off the space bar. And the PC was still logged in.

This got us through a couple weeks until we finally got a replacement PC from corporate IT and got it set up.

Eons ago, my wife worked with a young lady who decided to get her MSW and got their employer to sign the paperwork saying her work efforts counted as clinic hours (they are not a clinic of any kind). She got her Masters degree and, for equally twisted reasons, decided she would go for her PhD and finagled a deal with management that required her to be working 70% of the time in the office.

Then she started asking co-workers to help her. “Hey, I’m going to go do some research in the library. Can you bump my desk or wiggle my mouse a couple times an hour? That will let IT think I’m still at my desk.”

The lady was really smart, but not all that ethical.

My wife refused to play along, telling her coworker that she should mark her time in the library as research time and work her required hours in the office. Eventually, more and more of their coworkers stopped helping to deceive the company. My wife commented about that to me and we both commiserated about the mixture of intelligence and lack of ethics. Then, since I’m in IT, I gave her more to laugh about:

“You know that doesn’t work, right?” I asked. She didn’t know, so I explained the deeper details to her: IF management brings in IT to discover if a person was (or is) working during a certain time, they’re not checking for mouse movements. If the past is being questioned, they’re looking for data that shows the person has accessed the Internet, a database, and/or network servers somehow – pulling, pushing, or transmitting data somewhere, researching something, saving documents, accessing information, entering data into forms that are the ‘front end’ of a database. If management wants IT to see if someone is working ‘right now’ then the employee’s computer can be quietly accessed in real time and IT can watch and/or record the keystrokes being entered and/or the movement of the mouse – and humans don’t just jiggle the mouse, they sweep it in a non-linear fashion from point A to point B to point D to point C to click or right-click, all while scrolling the on-screen material up and down and sometimes sideways. And while the clicks make perfect sense to a human who’s doing real activity, they make partial sense to a software or AI observer while not quite being completely random. Therefore a human observer would be able to discern whether or not a real person was using the computer-in-question within a few minutes.

As has been noted above, a mouse-jiggler might be fine for keeping a computer’s screen-lock or account-lock from engaging, but not for much more than that.

– G!

[Epilogue, for those who are curious: My wife’s coworker eventually earned her PhD over a few years. During that time, some of those other coworkers moved into management positions. When she got her Doctorate, the smart/unethical one said “Hey, I’ve got a PhD now. Move me into a C-suite!” The fact is that some of those managers were the former coworkers whom she had asked to help her by wiggling her mouse so they knew her ethics and didn’t want her becoming their boss. The company couldn’t un-sign its documentation supporting the PhD program, but they didn’t want her in a leadership position, either. HR and the executives said, “Congratulations on your achievement! We don’t have any positions open for such high qualifications. You’ll have to find a different company to work for.”]

I actually use one of the USB versions for work. I’ve got one monitor I need to keep a dashboard open on and I’m not permitted to disable the monitor timeout. This one has a mode where it moves the mouse one pixel up/down/left/right. That let’s the mouse move without attracting my peripheral vision.

re: Undetectable. LOL. Sure, it shows up in device manager as a generic mouse, but who is going to be using a mouse continuously for 10 minutes without clicking somewhere or typing something on the keyboard?

I recently learned about mouse jigglers and online monitoring of remote workers just a few months ago. How pervasive is this?

I am a leader in a very large company and many of my team of several hundred work in a hybrid mode. We don’t deploy any such monitoring. Performance is checked and evaluated on what work gets done…not by mouse movement.

Do you think many employees believe their mouse and keystroke movements are monitored when they actually aren’t?

I don’t know how closely mouse and keyboard activity is being examined, but mouse jigglers prevent a machine from sleeping, logging out, or just going to an offline status. Those conditions are frequently monitored. It is quite easy when an employee is supposed to have an app active and a list of current users can be seen at a glance.

This is why I use one. It’s not to fool anyone into thinking I’m putting in 40 hours when I’m actually asleep on the couch, it’s because even brief periods of not typing/mousing on the laptop sends Teams into saying I’m away and throwing that yellow AWOL dot next to my name. If I could change the Away timer to 15min, I probably wouldn’t bother with the mouse thing.

[quote=“Omar_Little, post:15, topic:998519”]
Do you think many employees believe their mouse and keystroke movements are monitored ? [/quote]
(1) Well, actually, yes. I really does seem like many wage-earning employees think management might/could/probably are spot-checking employee’s activities by their mouse-movements and/or the related Present/Away/Offline indicators that are available as part of MS Outlook/Teams/Office suite. I think the real question is ‘Do many employees believe their managers have nothing better to do than spot-check their subordinates’ mouse-movements?

[quote=“Omar_Little, post:15, topic:998519”]
many of my team of several hundred work in a hybrid mode. We don’t deploy any such monitoring. Performance is checked and evaluated on what work gets done. [/quote]
(2) THIS is how performance should be checked.
If I’m your sales manager and you’ve met or exceeded your quota for the period, I don’t care if you did that by working 4-hour days twice a week or 18-hours over six-day weeks. If I’m expecting you to process so much data or provide a number of leads or whatever, I’m a capitalist who doesn’t care how it gets done so long as the numbers are met. [That, of course, led to the Wells Fargo scandal, but we’ll refrain from digressing…]

[quote=“Omar_Little, post:15, topic:998519”]
I recently learned about mouse jigglers and online monitoring of remote workers just a few months ago. How pervasive is this? [/quote]
(3) Apparently pervasive enough that wage-workers don’t want to get caught on the wrong side of it. OR it might be one of those urban legend type things in which people who don’t quite understand the technology they work with are speculating on weird ways that technology might be used – whether or not it has ever been used that way.

When USB cameras were first introduced, people used to put post-it notes or Band-Aids or electrical tape over the lenses because they ‘didn’t want people spying on them’ when they weren’t intentionally using their cameras. It was a non-issue and those people were laughed at because users had to activate the camera-leveraging software to consciously involve themselves in video conversations. But then the next generation of cameras and software had soft-switches and remotely accessing someone’s computer started becoming easier (particularly with the installation of malware from various Internet sources). Then there was a wave of people being extorted by Bad Guys ™ who were using those USB cameras to capture images of people who were partly-dressed and unaware that their camera was active when they were walking past their computer (which they thought was idle). So that ridiculous urban legend had turned into a real problem. And the USB camera manufacturers (and aftermarket gadget makers) made little camera-covers that people could use to actively cover up those lenses – they look better than strips of electrical tape. :see_no_evil:

From the IT Support/Infrastructure side, I’ll throw out a couple more anecdotes:

One of our new database geniuses submitted a few support tickets saying his computer was locking him out frequently. The Level 1 Helpdesk people couldn’t replicate the issues. During our IT Team meeting I started asking one of the workstation builder guys some seemingly unrelated questions:
“Hey, Jeff, how long does it take for our screen-savers to kick in.”
“They’re set for 5 minutes.”
“And that’s the squiggly lines that sweep across the screen?”
“Well, you can do that, but the default is the same picture that shows up behind the log-in screen.”
“And, for our security standards, people can’t just wiggle the mouse and make the screen-saver go away; we make people log-in after the screen-saver kicks in.”
“Of course. You’ve done that for over a decade with us.”
“Ah! So Donovan is probably initiating some massive SQL query and, while it runs and crunches numbers, he’s getting up, making a cup of coffee, letting the dog out – maybe throwing the ball a couple times, wandering back inside, reheating his cup of coffee, making a sandwich to go along with it, strolling back to the living-room, and finding that his default log-in screen is showing. Imagine that!”

A mouse-jiggler would have prevented that confusion. He could also have changed his screen-saver so it wouldn’t make him think he was logged-out. If he changed the idle time setting, our group policy would eventually override what he set and go back to a 5-minute limit.


A new team manager came aboard. After a couple months we started getting Helpdesk tickets from him, asking if IT could access phone logs and idle times and network activity and server interactions related to one of the team members he had hired. We fulfilled a few of his requests and the ticket was closed. A couple months later, we got another requests for all those logs related to the same person. It was very clear that the new manager suspected that team member of wasting time. We could not discern whether that team member wasn’t meeting some kind of quota or wasn’t answering the manager’s phone calls or team chats or what was causing suspicion. After a bit of speculation and discussion, we resolved to require such request come from HR rather than any particular team leader. That way IF there’s a search for evidence to support dismissal-with-cause, the HR department would be involved from the start (because HR’s job is to protect the company, not the employees or their managers).

Note that internal logs and tracking are not exhaustive or conclusive as far as grounds-for-termination go. Much depends on the nature of the work and not every job requires a steady unrelenting pace@ of work. As Omar noted, a lot of people are working from home. If someone’s generating sales leads by flipping through the Yellow Pages, that activity won’t register on her workstation or any of the company technology connected to it. Some of our phenomenal litigators are somewhat older and do their case research by using printed books at their local law libraries. We don’t require them to be on-line or off-line when they’re building their arguments; we just care whether or not they lose their cases.

–G!

@Right, Lucy & Ethel/Laverne & Shirley?

Now that I’ve clicked through to the mouse jiggler link, Facebook decided I might want a phone tapper. (No, not that kind of phone tapper.)

https://www.amazon.com/dp/B09MHF77Z3

I would love something that jiggles the mouse at a website while I’m looking something up on another tab. Amex logs me out after just 5 minutes of inactivity when I’m researching charges on other websites.