Which vulnerability is exploited when malware masquerades as a legitimate USB device to record input?